equifox/ksdumper

Dumping processes using the power of kernel space !

🔴 This repo is outdated due to the Capcom driver being patched 🔴

Thanks to mastercodeon314 there's now a port working on Windows 11. Enjoy !
https://github.com/mastercodeon314/KsDumper-11

KsDumper

I always had an interest in reverse engineering. A few days ago I wanted to look at some game internals for fun, but it was packed & protected by EAC (EasyAntiCheat). This means its handle were stripped and I was unable to dump the process from Ring3. I decided to try to make a custom driver that would allow me to copy the process memory without using OpenProcess. I knew nothing about Windows kernel, PE file structure, so I spent a lot of time reading articles and forums to make this project.

Features

• Dump any process main module using a kernel driver (both x86 and x64)
• Rebuild PE32/PE64 header and sections
• Works on protected system processes & processes with stripped handles (anti-cheats)

Note: Import table isn't rebuilt.

Usage

Before using KsDumperClient, the KsDumper driver needs to be loaded.

It is unsigned so you need to load it however you want. I'm using drvmap for Win10. Everything is provided in this release if you want to use it aswell.

• Run Driver/LoadCapcom.bat as Admin. Don't press any key or close the window yet !
• Run Driver/LoadUnsignedDriver.bat as Admin.
• Press enter in the LoadCapcom cmd to unload the driver.
• Run KsDumperClient.exe.
• Profit !

Note: The driver stays loaded until you reboot, so if you close KsDumperClient.exe, you can just reopen it !
Note2: Even though it can dump both x86 & x64 processes, this has to run on x64 Windows.

Disclaimer

This project was a way for me to learn about Windows kernel, PE file structure and kernel-user space interactions. It has been made available for informational and educational purposes only.

Considering the nature of this project, it is highly recommended to run it in a Virtual Environment. I am not responsible for any crash or damage that could happen to your system.

Important: This tool makes no attempt at hiding itself. If you target protected games, the anti-cheat might flag this as a cheat and ban you after a while. Use a Virtual Environment !

References

• https://github.com/not-wlan/drvmap
• https://github.com/Zer0Mem0ry/KernelBhop
• https://github.com/NtQuery/Scylla/
• http://terminus.rewolf.pl/terminus/
• https://www.unknowncheats.me/

Compile Yourself

• Requires Visual Studio 2017
• Requires Windows Driver Kit (WDK)
• Requires .NET 4.6.1

ksdumper's Issues

Driver not loading

Whenever I run LoadCapcom.bat it says this

    1 file(s) copied.

[SC] CreateService FAILED 1073:

The specified service already exists.

[SC] StartService FAILED 647:

The driver was not loaded because it failed its initialization call.

Driver loaded, fire up the exploit now then press a key when exploit has been done.
If you see any access denied, close this and relaunch the bat as Administrator.
DO NOT PRESS ANY KEY UNTIL YOU HAVE FINISHED LAUNCHING THE EXPLOIT
Press any key to continue . . .****

Driver does not load

Does it suppose to work on win7sp1 x64?

I"m getting this:

c:\Tmp\Driver>"c:\Tmp\Driver\\drvmap.exe" "c:\Tmp\Driver\\KsDumperDriver.sys"
[+] loaded capcom driver: 0
[+] allocated 0x7000 bytes at 0xFFFFFA8015F06000
processing module: ntoskrnl.exe [0xFFFFF8000300A000]
Assertion failed: RtlFindExportedRoutineByName != nullptr, file c:\users\foxy\desktop\tools\drvmap-master\capcom\capcom.cpp, line 196

Please tell me how to get apex offset. Do you have a video tutorial on YouTube or anywhere else?

Please tell me how to get apex offset. Do you have a video tutorial on YouTube or anywhere else?

a

nvm

INVALID_HANDLE_VALUE

[+] loaded capcom driver: 0
Assertion failed: m_capcom_driver.get() != INVALID_HANDLE_VALUE, file c:\users\foxy\desktop\tools\drvmap-master\capcom\capcom.cpp, line 70

specified service does not exist

SERVICE_NAME: Capcom
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
[SC] DeleteService SUCCESS
[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

Could Not Find C:\Windows\system32\drivers\Capcom.sys
Cya

Where are the .bat files

Cant seem to find them ? Can author update the readme.

don't work driver on windows sandbox

does not show process list on windows sandbox

IAT Repair

Can you add an IAT repair feature?

old shiiiiiit

its tooo old driver and not working

No bat file.

LoadCapcom.bat

[bug] Returning early in DriverSleep

https://github.com/EquiFox/KsDumper/blob/master/KsDumperDriver/Utility.c#L12

Driver loading issues fixed for windows 11 (hopefully :)

This has been a long running issue ive had with KsDumper, it would always either not load the driver, or bsod my system when i would run it under windows 11. So far ive hod to use KsDumper in a windows 10 vm for anything i needed it for.
That is no longer! I have revived the project and found a new driver mapper that works on win 11.
I have also automated the driver loading, and updated the UI. Addition feature were added as well.

https://github.com/mastercodeon314/KsDumper-11

how to dump EAC games

You could just rename r5apex to eaclauncher and then it would've let you dump with Scylla. Sick job tho with all the work you put into this, im sure you'll improve much with your drivers as you rethink what's possible from kernel ;)

BSOD

I keep getting a BSoD idk why

help

    1 file(s) copied.

[SC] CreateService SUCCESS
[SC] StartService FAILED 577:

Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Driver loaded, fire up the exploit now then press a key when exploit has been done.
If you see any access denied, close this and relaunch the bat as Administrator.
DO NOT PRESS ANY KEY UNTIL YOU HAVE FINISHED LAUNCHING THE EXPLOIT
Press any key to continue . . .
[SC] ControlService FAILED 1062:

The service has not been started.

[SC] DeleteService SUCCESS
[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

Could Not Find C:\Windows\system32\drivers\Capcom.sys
Cya
Press any key to continue . . .

driver doesnt load

when launching LoadUnsignedDriver.bat it says

[+] loaded capcom driver: 0
Assertion failed: m_capcom_driver.get() != INVALID_HANDLE_VALUE, file c:\users\foxy\desktop\tools\drvmap-master\capcom\capcom.cpp, line 70

Unload function

https://github.com/EquiFox/KsDumper/blob/master/KsDumperDriver/Driver.c#L100

function signature should be with NTSTATUS return val (not required to return something actually).

Also:
https://github.com/EquiFox/KsDumper/blob/master/KsDumperDriver/Driver.c#L105

It's better make the symLink global and you are deleting wrong link anyway, it should be the one with "Dos" in the name. If have time, i'll make a pull request.

BSOD After running Unsigned Driver

I ran the first .bat as an admin, didn't close it, however after I ran as admin the second bat the system would BSOD and restart, am I doing something wrong?

Crash

Windows 10 1903 crashing after i open LoadUnsignedDriver.bat

BSOD when loading driver

Hello, so when I try to load the drivers I just get a BSOD.

When loading Capcom.sys it works but when I try to then load KsDumperDriver.sys I just blue screen.
I have disabled Hyper-V, Credential Guard and Device Guard.

Out of curiosity...

Hi there,

This isn't a issue I just wanted to know why you get the process list and process information (base address, process id etc) via the driver and not use the System.Diagonostics namespace in the C# Client (also gives you all the modules inside process)? Is that method some kind of detection with the anti-cheat? I understand the read/write memory section being all done via driver of course as you can't get a handle to the protected process.

Thanks man.