code: def is_driver(self):
          
  
          # Checking that the ImageBase field of the OptionalHeader is above or
          # equal to 0x80000000 (that is, whether it lies in the upper 2GB of
          # the address space, normally belonging to the kernel) is not a
          # reliable enough indicator.  For instance, PEs that play the invalid
          # ImageBase trick to get relocated could be incorrectly assumed to be
          # drivers.
  
          # This is not reliable either...
          #
          # if any((section.Characteristics &
          #           SECTION_CHARACTERISTICS['IMAGE_SCN_MEM_NOT_PAGED']) for
          #        section in self.sections ):
          #    return True
  
          # If the import directory was not parsed (fast_load = True); do it now.
          if not hasattr(self, 'DIRECTORY_ENTRY_IMPORT'):
              self.parse_data_directories(directories=[
                  DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_IMPORT']])
  
          # If there's still no import directory (the PE doesn't have one or it's
          # malformed), give up.
          if not hasattr(self, 'DIRECTORY_ENTRY_IMPORT'):
              return False
  
          # self.DIRECTORY_ENTRY_IMPORT will now exist, although it may be empty.
          # If it imports from "ntoskrnl.exe" or other kernel components it should
          # be a driver
          #
          system_DLLs = set((b'ntoskrnl.exe', b'hal.dll', b'ndis.sys',
                             b'bootvid.dll', b'kdcom.dll'))
          if system_DLLs.intersection(
                  [imp.dll.lower() for imp in self.DIRECTORY_ENTRY_IMPORT]):
              return True
  
          driver_like_section_names = set(
              ('page', 'paged'))
          if driver_like_section_names.intersection(
                  [section.Name.lower().rstrip(b'\x00') for section in self.sections]) and (
              self.OPTIONAL_HEADER.Subsystem in (
                  SUBSYSTEM_TYPE['IMAGE_SUBSYSTEM_NATIVE'],
                  SUBSYSTEM_TYPE['IMAGE_SUBSYSTEM_NATIVE_WINDOWS'])):
              return True
  
          return False
docs: Check whether the file is a Windows driver.
  
          This will return true only if there are reliable indicators of the image
          being a driver.