DrvHunter

Download vulnerable and patched Windows drivers by CVE ID — inspired by diffrays.

Overview

DrvHunter is a streamlined tool that automates the process of obtaining Windows driver binaries for vulnerability research. Given a CVE ID, it fetches vulnerability metadata from the Microsoft Security Response Center (MSRC) API, resolves the affected driver filename, queries the Winbindex database for version history, and downloads both the vulnerable and patched versions of the driver from the Microsoft Symbol Server.

This project is a stripped-down derivative of diffrays by PwnFuzz, retaining only the CVE-to-driver resolution and download pipeline while removing the IDA Pro-based binary diffing and web visualization components.

How It Works

Pipeline

1. Fetch CVE metadata — Queries https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/{CVE-ID} to retrieve the affected component name (tag) and patch release month (releaseNumber).
2. Resolve filename — Maps the MSRC component name to a concrete driver filename (e.g., "Windows Common Log File System Driver" → clfs.sys) via a built-in lookup table.
3. Download version database — Fetches the compressed JSON database from Winbindex (https://winbindex.m417z.com/data/by_filename_compressed/{filename}.json.gz) containing all known versions of the file.
4. Select target versions — Searches the database for releases near Patch Tuesday of the patched month and the previous (vulnerable) month, filtered by Windows version (default: 11-24H2).
5. Download drivers — Constructs Microsoft Symbol Server URLs (https://msdl.microsoft.com/download/symbols/{filename}/{timestamp}{size}/{filename}) and downloads both versions, naming them with their release version (e.g., clfs_10.0.26100.3775.sys).

Project Structure

DrvHunter/
├── pyproject.toml              # PEP 517 build configuration
├── README.md
├── LICENSE
└── drvhunter/
    ├── __init__.py             # Package metadata
    ├── cli.py                  # CLI entry point (argparse)
    ├── cve_fetcher.py          # MSRC API client, CVE parsing, component mapping
    └── driver_downloader.py    # Winbindex DB, version selection, symbol server download

Key Design Decisions

• No IDA Pro dependency — Unlike diffrays, DrvHunter does not require IDA Pro or the ida_domain package. It only downloads drivers; analysis is left to external tools.
• Minimal dependencies — Only requests (HTTP) and colorama (terminal colors). Python 3.8+.
• pip install . ready — Uses standard pyproject.toml with setuptools, installable in any Python environment.
• Patch Tuesday heuristic — Version selection prioritizes releases within 2 days of Microsoft's monthly Patch Tuesday (second Tuesday), matching the typical security update cadence.
• Fallback matching — When a direct Windows version match is not found, the tool checks otherWindowsVersions cross-references in the Winbindex data.

Installation

git clone https://github.com/AO031/DrvHunter.git
cd DrvHunter
pip install .

Usage

CVE Mode (recommended)

Automatically resolves the affected driver and patch month from the CVE:

drvhunter --cve CVE-2025-29824
drvhunter --cve CVE-2025-29824 -w 11-24H2 -o ./drivers

Manual Mode

Specify the driver filename and patch month directly:

drvhunter -f clfs.sys -m 2025-09
drvhunter -f ntfs.sys -m 2025-04 -w 11-23H2

Options

Option	Description
--cve CVE	CVE ID (e.g., CVE-2025-29824)
-f, --filename	Driver filename (e.g., clfs.sys)
-m, --patch-month	Patch month in YYYY-MM format
-w, --windows-version	Windows version (default: 11-24H2)
-o, --output-dir	Output directory (default: current dir)

Example Output

$ drvhunter --cve CVE-2025-29824

=== Fetching CVE Data ===
CVE Title:         Windows Common Log File System Driver Elevation of Privilege Vulnerability
Tag:               Windows Common Log File System Driver
Release Number:    2025-Apr
[+] Matched component: Windows Common Log File System Driver -> clfs.sys
[+] Patch month: 2025-04

=== Finding Target Versions ===
[+] Selected patch version: 10.0.26100.3775 (2025-04-08)
[+] Selected vulnerable version: 10.0.26100.3470 (2025-03-11)

=== Downloading Drivers ===
[+] Downloaded: clfs_10.0.26100.3775.sys (546,224 bytes)   # patched
[+] Downloaded: clfs_10.0.26100.3470.sys (546,224 bytes)   # vulnerable

Relationship to diffrays

DrvHunter borrows its CVE resolution and driver download logic from diffrays, an excellent binary patch diffing tool by Nikhil John Thomas and Ayushman Dubey. Specifically:

• The MSRC API query flow (fetch_cve_data → extract_cve_info → find_matching_components)
• The component name-to-filename mapping table
• The Winbindex database download and Patch Tuesday-based version selection algorithm
• The Microsoft Symbol Server URL construction

What DrvHunter removes from diffrays:

• IDA Pro / ida_domain dependency (the entire analysis engine)
• Flask web server and visualization
• Heuristic function matching and correlator
• SQLite database generation

The goal is a lightweight, focused tool that handles just the "get me the right driver binaries" part of the workflow, leaving binary analysis to the researcher's tools of choice (IDA Pro, Ghidra, Binary Ninja, etc.).

License

MIT License — see LICENSE for details.

The original diffrays project is also MIT-licensed.