mirror of
https://github.com/magicsword-io/LOLDrivers
synced 2026-06-08 15:38:06 +00:00
The Haag
f5c39432b1
Improves accuracy of the overlap calculation between LOLDrivers samples and Microsoft's Vulnerable Driver Blocklist: - Match by OriginalFilename + FileVersion against deny rules' version ranges (MinimumFileVersion / MaximumFileVersion). Filename hits where the sample version falls outside the declared window are no longer counted as overlap; they're surfaced as filename_excluded_out_of_range for transparency. - Match by signer cert chain when the sample's CA TBS hash is on the denied-signer list, with optional CertPublisher CN scoping. Signers constrained by FileAttribRef are credited to the filename bucket; signers constrained by CertOemID are skipped (LOLDrivers YAML doesn't extract OEM IDs from cert chains, so we can't verify them). - Add diagnostic fields: overlap_by_hash, overlap_by_filename_versioned, overlap_by_filename_unbounded, overlap_by_signer, filename_excluded_out_of_range, filename_excluded_unknown_version. - Equivalent updates in bin/blocklist_analysis.py for the standalone CLI report. Frontend metrics.html shortcode is unchanged; the fields it consumes (overlap_count, overlap_pct, etc.) are still produced.