Skip to content

Instantly share code, notes, and snippets.

@thebabush

thebabush/driver_dump.py

Created February 23, 2023 09:09
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save thebabush/1e588672a5f253f97975373b9fb67f01 to your computer and use it in GitHub Desktop.
Save thebabush/1e588672a5f253f97975373b9fb67f01 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
driver_dump.py
import glob
import os
import lief
def main(drivers_path):
drivers = sorted(glob.glob(os.path.join(drivers_path, '*.sys')))
for driver in drivers:
pe = lief.parse(driver)
if 'VmbChannelInitSetProcessPacketCallbacks' in pe.imported_functions:
print(driver)
if __name__ == '__main__':
main('C:/Windows/System32/drivers/')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment