Skip to content

Instantly share code, notes, and snippets.

@jonny-jhnson
Last active October 8, 2024 19:57
Show Gist options
  • Save jonny-jhnson/0886573078494fc45089b853017b517d to your computer and use it in GitHub Desktop.
Save jonny-jhnson/0886573078494fc45089b853017b517d to your computer and use it in GitHub Desktop.
$LoadedDrivers = Get-CimInstance -ClassName Win32_SystemDriver
$LoadedDrivers | % {
if ($_.PathName -ne $null) {
# Check if the path starts with \??\ and adjust the relative path
if ($_.PathName.StartsWith("\??\")) {
$RelativePath = $_.PathName.Remove(0,4)
} else {
$RelativePath = $_.PathName
}
# Calculate hash only if a valid path is available
$Hash = (Get-FileHash -Path $RelativePath -Algorithm SHA256).Hash.ToLower()
# Create a custom object with path and hash
$CurrentLoaded = [PSCustomObject] @{Path = $RelativePath; Hash = $Hash}
}
}
$RequestContent = ((Invoke-WebRequest -Uri 'https://www.loldrivers.io/api/drivers.json' -UseBasicParsing).Content).toLower() | ConvertFrom-Json
$samples = $RequestContent | ForEach-Object { $_.knownvulnerablesamples }
foreach ($a in $samples.sha256) {
foreach ($b in $CurrentLoaded) {
if ($a -eq $b.Hash) {
$b
}
}
}
@GalliumPaul
Copy link

You cannot call a method on a null-valued expression.

+ if(($_.PathName.StartsWith("\??\") -eq $true) -and ($_.PathName -ne $ ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull

Possible update?

$LoadedDrivers = Get-CimInstance -ClassName Win32_SystemDriver 

$LoadedDrivers | ForEach-Object {
    if ($_.PathName -ne $null) {
        # Check if the path starts with \??\ and adjust the relative path
        if ($_.PathName.StartsWith("\??\")) {
            $RelativePath = $_.PathName.Remove(0,4)
        } else {
            $RelativePath = $_.PathName
        }

        # Calculate hash only if a valid path is available
        $Hash = (Get-FileHash -Path $RelativePath -Algorithm SHA256).Hash.ToLower()

        # Create a custom object with path and hash
        $CurrentLoaded = [PSCustomObject] @{Path = $RelativePath; Hash = $Hash}
    }
}

$RequestContent = ((Invoke-WebRequest -Uri 'https://www.loldrivers.io/api/drivers.json' -UseBasicParsing).Content).toLower() | ConvertFrom-Json
$samples = $RequestContent | ForEach-Object { $_.knownvulnerablesamples }

foreach ($a in $samples.sha256) {
    foreach ($b in $CurrentLoaded) {
        if ($a -eq $b.Hash) {
            $b
        }
    }    
}


@jonny-jhnson
Copy link
Author

Hey @GalliumPaul!
Sorry for the late response, but you are correct. There were actually two issues with my script:

  1. I was putting ($_.PathName.StartsWith("\??\") -eq $true) before ($_.PathName -ne $null)
  2. I was not wrapping the $Hash = (Get-FileHash -Path $RelativePath -Algorithm SHA256).Hash.ToLower() within the ($_.PathName.StartsWith("\??\") -eq $true block.

Thank you for looking at this and commenting! I will apply your changes :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment