Free while we’re in preview

Get DeviceDriver

Seal a driver folder's fingerprints, then prove months later that not one byte changed.

The Mac button is for Apple Silicon. On an older Intel Mac, get this one instead.

One file, both ways. Double-click it for the window. Run the same file from a command prompt with arguments and it behaves as the command-line tool, because the engine is inside it. Nothing else to download and nothing to keep beside it.

Early preview. The window has been built and run, but not yet on a real Windows PC or Mac, so expect rough edges. The engine underneath it is fully tested.

One file — no installer
Runs on your machine, offline
Source code published below

Free while in preview. It isn’t signed yet, so Windows or macOS will ask you to confirm the first time you open it. At launch, DeviceDriver is included in every plan along with the rest of the range.

Seal, then verify

devicedriver seal ./DriverStore --out approved.json --note "approved by ops-desk, CR-4471" walks every file, not only the .inf files, and records each one’s relative path, size, mtime and SHA-256, plus a single store digest folded from the sorted path-and-hash pairs. That digest ignores walk order and timestamps, so sealing an unchanged store twice gives the identical value, and one changed byte anywhere changes it.

verify re-walks and reports each file as OK, MODIFIED, MISSING or ADDED, naming the .inf package it belongs to so you know which driver to re-fetch. Detection is by content hash, so a file whose contents were swapped and whose size and mtime were then restored is still caught. Exit code 2 on any difference.

compare diffs two seals with the store nowhere in sight, which is how you check the build server’s seal against a machine in the field. inspect lists .inf metadata and, usefully, stray files that no .inf accounts for.

The limit of the security model

No Authenticode. No .cat catalog signature checking. A .cat file gets hashed like anything else and its cryptographic contents are never examined. Seal a malicious driver and this will confirm forever that your malicious driver is unchanged. The seal is only as good as the moment you took it.

Reading on the job itself

How to back up drivers before an update Copy the driver store to somewhere off the machine before you change anything, and record a hash of every f...

The rest of Driver Safety Center

Drivers and the state a machine was in before you touched them: a saved copy, a version list, a sealed record, and a way back.

DriverGuard

Simple Ready

Copy a folder's exact bytes now, so you can put one file back later.

DriverPilot

Vertical Ready

Inventory a driver folder before and after an update, then diff the two.

DriverRollback

Team Ready

Snapshot a driver tree, then get the exact bytes back. Dry run unless you insist.

Advanced & technical details Command-line builds, source code, checksums and a recorded session — for developers and IT teams

A working command-line build of the sealing engine: it walks a driver store, parses each INF for its version and hardware IDs, and seals every file with SHA-256 into a manifest whose digest does not depend on walk order. Verification catches modified, missing and added files, including a change made with the size and timestamp put back. It only reads; live Windows driver-store operations are out of scope.

Naming status

Working name only — brand verdict **AVOID** (Very High). Collision: DeviceDriver. Do not use as a brand.

What it draws on

Existing paid software whose best ideas shaped this program: IObit Driver Booster Pro, Driver Easy Pro, Auslogics Driver Updater, Revo Uninstaller Pro.

Command line

There is nothing extra to install. The program you download is the command-line tool as well: give it arguments instead of double-clicking it and it runs as one, with its output on your terminal. The standalone builds below are the same engine on its own, for machines where you would rather not ship a window at all.

DeviceDriver 1.0.0 - Driver Safety Center

Seal a driver store folder into a manifest of every file's SHA-256, then prove
later that the folder on disk is still EXACTLY what you sealed. This checks FILE
INTEGRITY against your own manifest. It does NOT verify Authenticode or catalog
signatures, never touches the live Windows driver store, and installs nothing.
It is strictly read-only on the store; only the --out manifest is written.

USAGE
  devicedriver <command> [options]

COMMANDS
  seal <driver-store-dir> --out <manifest.json> [--note "text"] [--json]
        Walk every file (not only .inf), record relative path, size, mtime and
        SHA-256, plus package count, file count, total bytes and one overall
        store digest folded from the sorted per-file hashes.

  verify <driver-store-dir> --manifest <manifest.json> [--json]
        Compare the store against the seal: OK / MODIFIED / MISSING / ADDED per
        file, naming the .inf package each affected file belongs to. Detection
        is by content hash, so restoring a file's size and mtime does not hide
        a change. Exits 2 if anything differs.

  compare --before <a.json> --after <b.json> [--json]
        Diff two seals directly, without the store being present. Exits 2 if
        the two seals differ.

  inspect <driver-store-dir> [--json]
        What is in this store: every .inf package with provider, class,
        DriverVer and hardware IDs, plus files no .inf accounts for.

  help, -h, --help      Show this help.
  version               Print version.

EXIT CODES
  0  success, nothing differs
  1  usage error, unreadable input, or a manifest for a different store
  2  verify/compare found at least one difference

EXAMPLES
...

Recorded from the shipped binary, not written by hand.

Windows (amd64) macOS (Apple Silicon) macOS (Intel) Linux (amd64)

Source

Every file the program is built from:

console.go · console_test.go · guided.go · main.go

SHA-256 checksums · build instructions & scope notes · full build plan

DeviceDriver

Preview