Get-RunningVulnDrivers.ps1

$LoadedDrivers = Get-CimInstance -ClassName Win32_SystemDriver 

$LoadedDrivers | % {
if ($_.PathName -ne $null) {
        # Check if the path starts with \??\ and adjust the relative path
        if ($_.PathName.StartsWith("\??\")) {
            $RelativePath = $_.PathName.Remove(0,4)
        } else {
            $RelativePath = $_.PathName
        }

        # Calculate hash only if a valid path is available
        $Hash = (Get-FileHash -Path $RelativePath -Algorithm SHA256).Hash.ToLower()

        # Create a custom object with path and hash
        $CurrentLoaded = [PSCustomObject] @{Path = $RelativePath; Hash = $Hash}
    }
}

$RequestContent = ((Invoke-WebRequest -Uri 'https://www.loldrivers.io/api/drivers.json' -UseBasicParsing).Content).toLower() | ConvertFrom-Json
$samples = $RequestContent | ForEach-Object { $_.knownvulnerablesamples }

foreach ($a in $samples.sha256) {
    foreach ($b in $CurrentLoaded) {
        if ($a -eq $b.Hash) {
            $b
        }
    }    
}

Hey @GalliumPaul!
Sorry for the late response, but you are correct. There were actually two issues with my script:

1. I was putting ($_.PathName.StartsWith("\??\") -eq $true) before ($_.PathName -ne $null)
2. I was not wrapping the $Hash = (Get-FileHash -Path $RelativePath -Algorithm SHA256).Hash.ToLower() within the ($_.PathName.StartsWith("\??\") -eq $true block.

Thank you for looking at this and commenting! I will apply your changes :)