NoSharp/suspector

Identify possibly vulnerable PE files (.sys)

CMIT

Suspector

Identifies drivers potentially vulnerable to Physical Memory access attacks.

Running:

suspector.exe
python runner.py <in_dir> <vuln_dir>

Limitations:

Only supports PE32+ files.

Supports:

Windows

Credits:

https://blog.back.engineering/01/11/2020/ (the original idea for this project)