drop loaded driver inventory + signing info · detect known-vulnerable driver hashes · runs locally
matches ~40 curated BYOVD names/hashes · capcom · gdrv · rtcore · dbutil · asio · iqvw64e
heuristic screener · curated blocklist not exhaustive · hash match requires exact sha256 in export or dropped .sys