im not much of a math guy, I'm getting hung up on this part:
SHA1(P1+C1+X) = SHA1(P2+C2+X) for any X.
The example above seems like SHA1(GOOD_DRIVER) == SHA1(BAD_DRIVER+C2+X) somehow.
How does the C1 and X get appended to the signature of the good driver.
GOOD_DRIVER = P1 (good code and some data) + C1 (data) + X (more data)
BAD_DRIVER = P2 (bad code and some data) + C2 (data) + X (more data)
You'd disguise the random-looking block of C1 data in the middle of the good driver as e.g. a cryptographic key to avoid suspicion. The "more data" part couldn't be modified in the bad driver, but since you can arbitrarily modify P2 this wouldn't be a severe restriction.
The good driver is actually padded so that it can be later replaced with the bad driver. I.E This doesn't allow the attacker to replace any driver, but only one they prepared in advance to look innocent but have the right structure.