├── .gitignore ├── DarkControls ├── BlankForm.Designer.cs ├── BlankForm.cs ├── BlankForm.resx ├── Controls │ ├── AppIcon.cs │ ├── CloseButton.cs │ ├── CustomCheckedListBox.cs │ ├── CustomScrollBar.cs │ ├── CustomStatusStrip.cs │ ├── DarkButton.cs │ ├── DarkCheckBox.cs │ ├── DarkListView.cs │ ├── DarkSelectFileButton.cs │ ├── DarkTextBox.cs │ ├── FlatComboBox.cs │ ├── FlatScrollBar.cs │ ├── FlatScrollBar1.cs │ ├── MaximizeButton.cs │ ├── MinimizeButton.cs │ ├── NoFocusCueBotton.cs │ ├── ProgressBarEx.cs │ ├── SimpleColorTransforms.cs │ ├── TransparentLabel.cs │ ├── VisualStudioTabControl.cs │ └── WindowsDefaultTitleBarButton.cs ├── DarkControls.csproj ├── Properties │ ├── AssemblyInfo.cs │ ├── Resources.Designer.cs │ └── Resources.resx ├── Utils.cs ├── icons8-crossed-axes-100.png └── selectFileBtn.Image.png ├── DriverInterface ├── BSOD.cs ├── CancelableTask.cs ├── CrashMon.cs ├── Driver │ ├── KsDumperDriver.sys │ ├── ManualLoader.bat │ ├── Taigei64.dll │ ├── drv64.dll │ └── kdu.exe ├── DriverInterface.csproj ├── KduProvider.cs ├── KduProviderSettings.cs ├── KduSelfExtract.cs ├── KduWrapper.cs ├── KsDumperDriverInterface.cs ├── Operations.cs ├── PE │ ├── 32 │ │ ├── PE32File.cs │ │ └── PE32Header.cs │ ├── 64 │ │ ├── PE64File.cs │ │ └── PE64Header.cs │ ├── DOSHeader.cs │ ├── NativePEStructs.cs │ ├── PEFile.cs │ └── PESection.cs ├── ProcessDumper.cs ├── ProcessSummary.cs ├── Properties │ ├── AssemblyInfo.cs │ ├── Resources.Designer.cs │ └── Resources.resx ├── Utility │ ├── Logger.cs │ ├── MarshalUtility.cs │ ├── ProcessListView.cs │ └── WinApi.cs └── packages.config ├── KsDumper11.sln ├── KsDumper11 ├── Default.ico ├── Driver │ ├── KsDumperDriver.sys │ ├── ManualLoader.bat │ ├── Taigei64.dll │ ├── drv64.dll │ └── kdu.exe ├── DumperForm.Designer.cs ├── DumperForm.cs ├── DumperForm.resx ├── JsonSettings.cs ├── JsonSettingsManager.cs ├── KsDumper11.csproj ├── LabelDrawer.cs ├── ProcessDumper.cs ├── ProcessSummary.cs ├── Program.cs ├── Properties │ ├── AssemblyInfo.cs │ ├── Resources.Designer.cs │ ├── Resources.cs │ ├── Resources.resources │ ├── Resources.resx │ ├── Settings.Designer.cs │ └── Settings.settings ├── ProviderSelector.Designer.cs ├── ProviderSelector.cs ├── ProviderSelector.resx ├── SnifferBypass.cs ├── StartDriver.cs ├── Trigger.Designer.cs ├── Trigger.cs ├── Trigger.resx ├── TriggerForm.Designer.cs ├── TriggerForm.cs ├── TriggerForm.resx ├── Turn_OFF_Microsoft_Vulnerable_Driver_Blocklist.reg ├── Turn_ON_Microsoft_Vulnerable_Driver_Blocklist.reg ├── app.manifest ├── icons8-crossed-axes-100.png └── packages.config ├── KsDumperDriver ├── Driver.c ├── KsDumperDriver.vcxproj ├── KsDumperDriver.vcxproj.filters ├── NTUndocumented.h ├── ProcessLister.c ├── ProcessLister.h ├── UserModeBridge.h ├── Utility.c └── Utility.h ├── README.md └── Version.json /DarkControls/BlankForm.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace DarkControls 2 | { 3 | partial class BlankForm 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(BlankForm)); 32 | this.transparentLabel1 = new DarkControls.Controls.TransparentLabel(); 33 | this.closeBtn = new DarkControls.Controls.WindowsDefaultTitleBarButton(); 34 | this.appIcon1 = new DarkControls.Controls.AppIcon(); 35 | ((System.ComponentModel.ISupportInitialize)(this.appIcon1)).BeginInit(); 36 | this.SuspendLayout(); 37 | // 38 | // transparentLabel1 39 | // 40 | this.transparentLabel1.Font = new System.Drawing.Font("Microsoft Sans Serif", 12F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((byte)(0))); 41 | this.transparentLabel1.Location = new System.Drawing.Point(32, 4); 42 | this.transparentLabel1.Name = "transparentLabel1"; 43 | this.transparentLabel1.Size = new System.Drawing.Size(108, 20); 44 | this.transparentLabel1.TabIndex = 8; 45 | this.transparentLabel1.Text = "Form1"; 46 | // 47 | // closeBtn 48 | // 49 | this.closeBtn.ButtonType = DarkControls.Controls.WindowsDefaultTitleBarButton.Type.Close; 50 | this.closeBtn.ClickColor = System.Drawing.Color.Red; 51 | this.closeBtn.ClickIconColor = System.Drawing.Color.Black; 52 | this.closeBtn.HoverColor = System.Drawing.Color.OrangeRed; 53 | this.closeBtn.HoverIconColor = System.Drawing.Color.Black; 54 | this.closeBtn.IconColor = System.Drawing.Color.Black; 55 | this.closeBtn.IconLineThickness = 2; 56 | this.closeBtn.Location = new System.Drawing.Point(776, 0); 57 | this.closeBtn.Name = "closeBtn"; 58 | this.closeBtn.Size = new System.Drawing.Size(40, 40); 59 | this.closeBtn.TabIndex = 7; 60 | this.closeBtn.Text = "windowsDefaultTitleBarButton1"; 61 | this.closeBtn.UseVisualStyleBackColor = true; 62 | // 63 | // appIcon1 64 | // 65 | this.appIcon1.AppIconImage = ((System.Drawing.Image)(resources.GetObject("appIcon1.AppIconImage"))); 66 | this.appIcon1.Image = ((System.Drawing.Image)(resources.GetObject("appIcon1.Image"))); 67 | this.appIcon1.Location = new System.Drawing.Point(0, 1); 68 | this.appIcon1.Name = "appIcon1"; 69 | this.appIcon1.Scale = 3.5F; 70 | this.appIcon1.Size = new System.Drawing.Size(28, 28); 71 | this.appIcon1.TabIndex = 9; 72 | this.appIcon1.TabStop = false; 73 | // 74 | // Form1 75 | // 76 | this.AllowDrop = true; 77 | this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); 78 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 79 | this.BackColor = System.Drawing.Color.FromArgb(((int)(((byte)(33)))), ((int)(((byte)(33)))), ((int)(((byte)(33))))); 80 | this.ClientSize = new System.Drawing.Size(816, 489); 81 | this.Controls.Add(this.appIcon1); 82 | this.Controls.Add(this.transparentLabel1); 83 | this.Controls.Add(this.closeBtn); 84 | this.DoubleBuffered = true; 85 | this.ForeColor = System.Drawing.Color.Silver; 86 | this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.None; 87 | this.Name = "Form1"; 88 | this.Text = "Basic File Box"; 89 | ((System.ComponentModel.ISupportInitialize)(this.appIcon1)).EndInit(); 90 | this.ResumeLayout(false); 91 | 92 | } 93 | 94 | #endregion 95 | private DarkControls.Controls.WindowsDefaultTitleBarButton closeBtn; 96 | private DarkControls.Controls.TransparentLabel transparentLabel1; 97 | private DarkControls.Controls.AppIcon appIcon1; 98 | } 99 | } 100 | 101 | -------------------------------------------------------------------------------- /DarkControls/BlankForm.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.IO; 3 | using System.Collections.Generic; 4 | using System.ComponentModel; 5 | using System.Data; 6 | using System.Drawing; 7 | using System.Drawing.Drawing2D; 8 | using System.Linq; 9 | using System.Text; 10 | using System.Threading.Tasks; 11 | using System.Windows.Forms; 12 | using System.Runtime.InteropServices; 13 | using System.Diagnostics; 14 | using DarkControls; 15 | 16 | namespace DarkControls 17 | { 18 | public partial class BlankForm : Form 19 | { 20 | protected override CreateParams CreateParams 21 | { 22 | get 23 | { 24 | // Activate double buffering at the form level. All child controls will be double buffered as well. 25 | CreateParams cp = base.CreateParams; 26 | cp.ExStyle |= 0x02000000; // Turn on WS_EX_COMPOSITED 27 | return cp; 28 | } 29 | } 30 | 31 | public BlankForm() 32 | { 33 | 34 | InitializeComponent(); 35 | 36 | this.FormBorderStyle = FormBorderStyle.None; 37 | this.Region = Region.FromHrgn(Utils.CreateRoundRectRgn(0, 0, Width, Height, 10, 10)); 38 | this.closeBtn.Region = Region.FromHrgn(Utils.CreateRoundRectRgn(0, 0, closeBtn.Width, closeBtn.Height, 10, 10)); 39 | } 40 | 41 | protected override void WndProc(ref Message m) 42 | { 43 | base.WndProc(ref m); 44 | if (m.Msg == Utils.WM_NCHITTEST) 45 | m.Result = (IntPtr)(Utils.HT_CAPTION); 46 | } 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /DarkControls/Controls/AppIcon.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Drawing; 6 | using System.Threading.Tasks; 7 | using System.Windows.Forms; 8 | using System.Drawing.Drawing2D; 9 | using System.Drawing.Imaging; 10 | using System.ComponentModel; 11 | 12 | namespace DarkControls.Controls 13 | { 14 | public class AppIcon : PictureBox 15 | { 16 | private float _Scale = 3.5f; 17 | 18 | [ 19 | Description("The value used to scale down the icon"), 20 | DefaultValue("3.5"), 21 | RefreshProperties(RefreshProperties.All) 22 | ] 23 | public float Scale 24 | { 25 | get 26 | { 27 | return _Scale; 28 | } 29 | set 30 | { 31 | _Scale = value; 32 | SizeF sz = calcImgSize(); 33 | this.Image = ResizeImage(appIconImg, (int)sz.Width, (int)sz.Height); 34 | base.Size = new Size((int)sz.Width, (int)sz.Height); 35 | } 36 | } 37 | 38 | [ 39 | DefaultValue("50, 50"), 40 | RefreshProperties(RefreshProperties.All) 41 | ] 42 | public new Size Size 43 | { 44 | get 45 | { 46 | return base.Size; 47 | } 48 | set 49 | { 50 | //SizeF sz = calcImgSize(); 51 | //this.Image = ResizeImage(appIconImg, (int)sz.Width, (int)sz.Height); 52 | //base.Size = new Size((int)sz.Width, (int)sz.Height); 53 | base.Size = value; 54 | } 55 | } 56 | private bool drag = false; // determine if we should be moving the form 57 | private Point startPoint = new Point(0, 0); // also for the moving 58 | public Form DragForm { get; set; } = null; 59 | 60 | private Image appIconImg = Properties.Resources.icons8_crossed_axes_100; 61 | 62 | [ 63 | Description("The image that will be used for the icon"), 64 | RefreshProperties(RefreshProperties.All) 65 | ] 66 | public Image AppIconImage 67 | { 68 | get 69 | { 70 | return appIconImg; 71 | } 72 | set 73 | { 74 | appIconImg = value; 75 | } 76 | } 77 | 78 | public AppIcon() 79 | { 80 | SetStyle(ControlStyles.SupportsTransparentBackColor, true); 81 | BackColor = Color.FromArgb(33, 33, 33); 82 | 83 | this.MouseDown += AppLogo_MouseDown; 84 | this.MouseUp += AppLogo_MouseUp; 85 | this.MouseMove += AppLogo_MouseMove; 86 | SizeF sz = calcImgSize(); 87 | //this.Image = ResizeImage(appIconImg, (int)sz.Width, (int)sz.Height); 88 | //this.Size = new Size((int)sz.Width, (int)sz.Height); 89 | 90 | if (this.DesignMode == false) 91 | { 92 | if (DragForm != null) DragForm.Load += DragForm_Load; 93 | } 94 | } 95 | 96 | private SizeF calcImgSize() 97 | { 98 | float scale = 3.5f; 99 | SizeF sz = new SizeF(appIconImg.Width, appIconImg.Height); 100 | float x = sz.Width / (float)scale; 101 | float y = sz.Height / (float)scale; 102 | return new SizeF(x, y); 103 | } 104 | 105 | private void DragForm_Load(object sender, EventArgs e) 106 | { 107 | SizeF sz = calcImgSize(); 108 | //this.Image = ResizeImage(appIconImg, (int)sz.Width, (int)sz.Height); 109 | //this.Size = new Size((int)sz.Width, (int)sz.Height); 110 | this.Invalidate(); 111 | } 112 | 113 | private void AppLogo_MouseMove(object sender, MouseEventArgs e) 114 | { 115 | if (this.drag) 116 | { // if we should be dragging it, we need to figure out some movement 117 | Point p1 = new Point(e.X, e.Y); 118 | Point p2 = DragForm.PointToScreen(p1); 119 | Point p3 = new Point(p2.X - this.startPoint.X, 120 | p2.Y - this.startPoint.Y); 121 | DragForm.Location = p3; 122 | } 123 | } 124 | 125 | private void AppLogo_MouseUp(object sender, MouseEventArgs e) 126 | { 127 | if (e.Button == MouseButtons.Left) 128 | { 129 | this.drag = false; 130 | } 131 | } 132 | 133 | private void AppLogo_MouseDown(object sender, MouseEventArgs e) 134 | { 135 | if (e.Button == MouseButtons.Left) 136 | { 137 | this.startPoint = e.Location; 138 | this.drag = true; 139 | } 140 | } 141 | 142 | /// 143 | /// Resize the image to the specified width and height. 144 | /// 145 | /// The image to resize. 146 | /// The width to resize to. 147 | /// The height to resize to. 148 | /// The resized image. 149 | public static Bitmap ResizeImage(Image image, int width, int height) 150 | { 151 | var destRect = new Rectangle(0, 0, width, height); 152 | var destImage = new Bitmap(width, height); 153 | 154 | destImage.MakeTransparent(); 155 | 156 | destImage.SetResolution(image.HorizontalResolution, image.VerticalResolution); 157 | 158 | using (var graphics = Graphics.FromImage(destImage)) 159 | { 160 | graphics.CompositingMode = CompositingMode.SourceCopy; 161 | graphics.CompositingQuality = CompositingQuality.HighQuality; 162 | graphics.InterpolationMode = InterpolationMode.HighQualityBicubic; 163 | graphics.SmoothingMode = SmoothingMode.HighQuality; 164 | graphics.PixelOffsetMode = PixelOffsetMode.HighQuality; 165 | 166 | using (var wrapMode = new ImageAttributes()) 167 | { 168 | //Color cl = Color.White; 169 | wrapMode.SetColorKey(Color.FromArgb(230, 230, 230), Color.White, ColorAdjustType.Bitmap); 170 | wrapMode.SetWrapMode(WrapMode.TileFlipXY); 171 | graphics.DrawImage(image, destRect, 0, 0, image.Width, image.Height, GraphicsUnit.Pixel, wrapMode); 172 | } 173 | } 174 | 175 | return destImage; 176 | } 177 | } 178 | } 179 | -------------------------------------------------------------------------------- /DarkControls/Controls/CloseButton.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace DarkControls.Controls 8 | { 9 | public class CloseButton : WindowsDefaultTitleBarButton 10 | { 11 | public CloseButton() 12 | { 13 | this.ButtonType = DarkControls.Controls.WindowsDefaultTitleBarButton.Type.Close; 14 | this.ClickColor = System.Drawing.Color.Red; 15 | this.ClickIconColor = System.Drawing.Color.Black; 16 | this.HoverColor = System.Drawing.Color.OrangeRed; 17 | this.HoverIconColor = System.Drawing.Color.Black; 18 | this.IconColor = System.Drawing.Color.Black; 19 | this.IconLineThickness = 2; 20 | this.Size = new System.Drawing.Size(40, 40); 21 | this.UseVisualStyleBackColor = true; 22 | } 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /DarkControls/Controls/CustomCheckedListBox.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows.Forms; 7 | using System.Drawing; 8 | using System.Drawing.Text; 9 | using System.Drawing.Drawing2D; 10 | 11 | namespace DarkControls.Controls 12 | { 13 | public class CustomCheckedListBox : CheckedListBox 14 | { 15 | public CustomCheckedListBox() 16 | { 17 | //this.SetStyle( 18 | // ControlStyles.OptimizedDoubleBuffer | 19 | // ControlStyles.ResizeRedraw, 20 | // //ControlStyles.UserPaint, 21 | // true); 22 | //this.DrawMode = DrawMode.OwnerDrawFixed; 23 | 24 | this.BackColor = System.Drawing.Color.FromArgb(((int)(((byte)(33)))), ((int)(((byte)(33)))), ((int)(((byte)(33))))); 25 | this.ForeColor = Color.Silver; 26 | this.BorderStyle = System.Windows.Forms.BorderStyle.FixedSingle; 27 | this.CheckedItemColor = System.Drawing.Color.Silver; 28 | this.CheckOnClick = true; 29 | } 30 | 31 | 32 | 33 | protected override void OnPaint(PaintEventArgs e) 34 | { 35 | Region iRegion = new Region(e.ClipRectangle); 36 | e.Graphics.FillRegion(new SolidBrush(this.BackColor), iRegion); 37 | if (this.Items.Count > 0) 38 | { 39 | for (int i = 0; i < this.Items.Count; ++i) 40 | { 41 | System.Drawing.Rectangle irect = this.GetItemRectangle(i); 42 | if (e.ClipRectangle.IntersectsWith(irect)) 43 | { 44 | if ((this.SelectionMode == SelectionMode.One && this.SelectedIndex == i) 45 | || (this.SelectionMode == SelectionMode.MultiSimple && this.SelectedIndices.Contains(i)) 46 | || (this.SelectionMode == SelectionMode.MultiExtended && this.SelectedIndices.Contains(i))) 47 | { 48 | OnDrawItem(new DrawItemEventArgs(e.Graphics, this.Font, 49 | irect, i, 50 | DrawItemState.Selected, this.ForeColor, 51 | this.BackColor)); 52 | } 53 | else 54 | { 55 | OnDrawItem(new DrawItemEventArgs(e.Graphics, this.Font, 56 | irect, i, 57 | DrawItemState.Default, this.ForeColor, 58 | this.BackColor)); 59 | } 60 | iRegion.Complement(irect); 61 | } 62 | } 63 | } 64 | base.OnPaint(e); 65 | } 66 | 67 | protected override void OnDrawItem(DrawItemEventArgs e) 68 | { 69 | Size checkSize = CheckBoxRenderer.GetGlyphSize(e.Graphics, System.Windows.Forms.VisualStyles.CheckBoxState.CheckedNormal); 70 | int dx = (e.Bounds.Height - checkSize.Width) / 2; 71 | e.DrawBackground(); 72 | //e.DrawFocusRectangle(); 73 | if (this.Items.Count > 0) 74 | { 75 | //var isChecked = GetItemChecked(e.Index) ? CheckState.Checked : CheckState.Unchecked; 76 | bool isChecked = GetItemChecked(e.Index);//For some reason e.State doesn't work so we have to do this instead. 77 | //CheckBoxRenderer.DrawCheckBox(e.Graphics, new Point(dx, e.Bounds.Top + dx), isChecked ? System.Windows.Forms.VisualStyles.CheckBoxState.CheckedNormal : System.Windows.Forms.VisualStyles.CheckBoxState.UncheckedNormal); 78 | DarkCheckBox.DrawCheckBox(e.Graphics, new Point(dx, e.Bounds.Top + dx), this.GetItemCheckState(e.Index)); 79 | using (StringFormat sf = new StringFormat { LineAlignment = StringAlignment.Center }) 80 | { 81 | using (Brush brush = new SolidBrush(isChecked ? CheckedItemColor : ForeColor)) 82 | { 83 | e.Graphics.DrawString(Items[e.Index].ToString(), Font, brush, new Rectangle(e.Bounds.Height, e.Bounds.Top, e.Bounds.Width - e.Bounds.Height, e.Bounds.Height), sf); 84 | } 85 | } 86 | } 87 | 88 | //base.OnDrawItem(e); 89 | } 90 | Color checkedItemColor = Color.Green; 91 | public Color CheckedItemColor 92 | { 93 | get { return checkedItemColor; } 94 | set 95 | { 96 | checkedItemColor = value; 97 | //Invalidate(); 98 | } 99 | } 100 | } 101 | } 102 | -------------------------------------------------------------------------------- /DarkControls/Controls/CustomStatusStrip.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Drawing; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using System.Windows.Forms; 8 | 9 | namespace DarkControls.Controls 10 | { 11 | public class CustomStatusStrip : StatusStrip 12 | { 13 | protected override void OnPaint(PaintEventArgs e) 14 | { 15 | // Set the background color to RGB value 33, 33, 33 16 | this.BackColor = Color.FromArgb(33, 33, 33); 17 | 18 | // Set the foreground color to Silver 19 | this.ForeColor = Color.Silver; 20 | 21 | e.Graphics.Clear(this.BackColor); 22 | 23 | // Call the base OnPaint method to handle the actual rendering 24 | base.OnPaint(e); 25 | } 26 | 27 | //protected override void OnRender (ToolStripRenderEventArgs e) 28 | //{ 29 | // // Set the background color to RGB value 33, 33, 33 30 | // e.Graphics.Clear(Color.FromArgb(33, 33, 33)); 31 | // base.OnRenderToolStripBackground(e); 32 | //} 33 | 34 | //protected override void OnRenderToolStripContentPanelBackground(ToolStripContentPanelRenderEventArgs e) 35 | //{ 36 | // e.Graphics.Clear(Color.FromArgb(33, 33, 33)); 37 | // base.OnRenderToolStripContentPanelBackground(e); 38 | //} 39 | 40 | //protected override void OnRenderItem(ToolStripItemRenderEventArgs e) 41 | //{ 42 | // // Set the background color to RGB value 33, 33, 33 43 | // e.Item.BackColor = Color.FromArgb(33, 33, 33); 44 | 45 | // // Set the foreground color to Silver 46 | // e.Item.ForeColor = Color.Silver; 47 | 48 | // // Call the base OnRenderItem method to handle the actual rendering 49 | // base.OnRenderItem(e); 50 | //} 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /DarkControls/Controls/DarkButton.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows.Forms; 7 | using System.Drawing; 8 | 9 | namespace DarkControls.Controls 10 | { 11 | public class DarkButton : Button 12 | { 13 | public DarkButton() 14 | { 15 | this.BackColor = Color.FromArgb(33, 33, 33); 16 | this.ForeColor = Color.Silver; 17 | 18 | this.Size = new Size(75, 23); 19 | this.FlatStyle = System.Windows.Forms.FlatStyle.Flat; 20 | this.UseVisualStyleBackColor = true; 21 | 22 | //this.Region = Region.FromHrgn(Utils.CreateRoundRectRgn(0, 0, Width, Height, 25, 25)); 23 | } 24 | 25 | protected override void OnEnabledChanged(EventArgs e) 26 | { 27 | if (this.Enabled) 28 | { 29 | this.ForeColor = Color.Silver; 30 | this.Update(); 31 | this.Invalidate(); 32 | } 33 | else 34 | { 35 | this.ForeColor = Color.FromArgb(Color.Silver.R - 32, Color.Silver.G - 32, Color.Silver.B - 32); 36 | this.Update(); 37 | this.Invalidate(); 38 | } 39 | 40 | base.OnEnabledChanged(e); 41 | } 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /DarkControls/Controls/DarkListView.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Drawing; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using System.Windows.Forms; 8 | 9 | namespace DarkControls.Controls 10 | { 11 | public class DarkListView : ListView 12 | { 13 | public DarkListView() 14 | { 15 | this.BackColor = Color.FromArgb(33, 33, 33); 16 | this.ForeColor = Color.Silver; 17 | this.DoubleBuffered = true; 18 | //this.SetStyle(ControlStyles.UserPaint, true); 19 | this.SetStyle(ControlStyles.DoubleBuffer, true); 20 | //this.SetStyle(ControlStyles.AllPaintingInWmPaint, true); 21 | 22 | System.Windows.Forms.ListView view = this; 23 | 24 | colorListViewHeader(ref view, this.BackColor, this.ForeColor); 25 | } 26 | 27 | public static void colorListViewHeader(ref System.Windows.Forms.ListView list, Color backColor, Color foreColor) 28 | { 29 | list.OwnerDraw = true; 30 | list.DrawColumnHeader += 31 | new DrawListViewColumnHeaderEventHandler 32 | ( 33 | (sender, e) => headerDraw(sender, e, backColor, foreColor) 34 | ); 35 | list.DrawItem += new DrawListViewItemEventHandler(bodyDraw); 36 | } 37 | 38 | private static void headerDraw(object sender, DrawListViewColumnHeaderEventArgs e, Color backColor, Color foreColor) 39 | { 40 | using (SolidBrush backBrush = new SolidBrush(backColor)) 41 | { 42 | e.Graphics.FillRectangle(backBrush, e.Bounds); 43 | } 44 | 45 | using (SolidBrush foreBrush = new SolidBrush(foreColor)) 46 | { 47 | e.Graphics.DrawString(e.Header.Text, e.Font, foreBrush, e.Bounds); 48 | } 49 | } 50 | 51 | private static void bodyDraw(object sender, DrawListViewItemEventArgs e) 52 | { 53 | e.DrawDefault = true; 54 | } 55 | 56 | protected override void OnPaint(PaintEventArgs e) 57 | { 58 | base.OnPaint(e); 59 | } 60 | } 61 | } 62 | -------------------------------------------------------------------------------- /DarkControls/Controls/DarkSelectFileButton.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows.Forms; 7 | using System.Drawing; 8 | 9 | namespace DarkControls.Controls 10 | { 11 | public class DarkSelectFileButton : Button 12 | { 13 | public DarkSelectFileButton() 14 | { 15 | this.BackColor = Color.FromArgb(33, 33, 33); 16 | this.ForeColor = Color.Silver; 17 | this.FlatAppearance.BorderColor = System.Drawing.Color.Silver; 18 | this.FlatAppearance.BorderSize = 0; 19 | this.FlatAppearance.MouseOverBackColor = System.Drawing.Color.Silver; 20 | this.Image = Properties.Resources.selectFileBtn_Image; 21 | this.Size = new Size(75, 23); 22 | this.FlatStyle = System.Windows.Forms.FlatStyle.Flat; 23 | this.UseVisualStyleBackColor = true; 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /DarkControls/Controls/DarkTextBox.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows.Forms; 7 | using System.Drawing; 8 | using System.Windows.Forms.VisualStyles; 9 | using System.Diagnostics; 10 | 11 | namespace DarkControls.Controls 12 | { 13 | public class DarkTextBox : System.Windows.Forms.TextBox 14 | { 15 | public DarkTextBox() 16 | { 17 | // Initialize the renderer 18 | 19 | this.BackColor = System.Drawing.Color.FromArgb(((int)(((byte)(33)))), ((int)(((byte)(33)))), ((int)(((byte)(33))))); 20 | this.ForeColor = Color.Silver; 21 | 22 | this.BorderStyle = System.Windows.Forms.BorderStyle.FixedSingle; 23 | this.SetStyle( 24 | ControlStyles.AllPaintingInWmPaint | 25 | ControlStyles.DoubleBuffer, true); 26 | } 27 | 28 | protected override void OnPaint(PaintEventArgs e) 29 | { 30 | //Debugger.Break(); 31 | if (ScrollBarRenderer.IsSupported) 32 | { 33 | //Debugger.Break(); 34 | // Draw the custom scrollbar 35 | ScrollBarRenderer.DrawUpperVerticalTrack(e.Graphics, new Rectangle(this.Right - 18, this.Top, 18, this.Height), ScrollBarState.Normal); 36 | ScrollBarRenderer.DrawLowerVerticalTrack(e.Graphics, new Rectangle(this.Right - 18, this.Top, 18, this.Height), ScrollBarState.Normal); 37 | ScrollBarRenderer.DrawVerticalThumb(e.Graphics, new Rectangle(this.Right - 18, this.Top, 18, this.Height), ScrollBarState.Normal); 38 | ScrollBarRenderer.DrawVerticalThumbGrip(e.Graphics, new Rectangle(this.Right - 18, this.Top, 18, this.Height), ScrollBarState.Normal); 39 | } 40 | 41 | base.OnPaint(e); 42 | } 43 | 44 | //protected override void WndProc(ref Message m) 45 | //{ 46 | // base.WndProc(ref m); 47 | // if (m.Msg == 0x00F7) 48 | // { 49 | // m.Result = (IntPtr)1; 50 | // } 51 | //} 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /DarkControls/Controls/FlatComboBox.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.ComponentModel; 3 | using System.Drawing; 4 | using System.Runtime.InteropServices; 5 | using System.Windows.Forms; 6 | 7 | namespace DarkControls.Controls 8 | { 9 | public class FlatComboBox : ComboBox 10 | { 11 | private Color borderColor = Color.Gray; 12 | [DefaultValue(typeof(Color), "Gray")] 13 | public Color BorderColor 14 | { 15 | get { return borderColor; } 16 | set 17 | { 18 | if (borderColor != value) 19 | { 20 | borderColor = value; 21 | Invalidate(); 22 | } 23 | } 24 | } 25 | private Color buttonColor = Color.LightGray; 26 | [DefaultValue(typeof(Color), "LightGray")] 27 | public Color ButtonColor 28 | { 29 | get { return buttonColor; } 30 | set 31 | { 32 | if (buttonColor != value) 33 | { 34 | buttonColor = value; 35 | Invalidate(); 36 | } 37 | } 38 | } 39 | protected override void WndProc(ref Message m) 40 | { 41 | if (m.Msg == WM_PAINT && DropDownStyle != ComboBoxStyle.Simple) 42 | { 43 | var clientRect = ClientRectangle; 44 | var dropDownButtonWidth = SystemInformation.HorizontalScrollBarArrowWidth; 45 | var outerBorder = new Rectangle(clientRect.Location, 46 | new Size(clientRect.Width - 1, clientRect.Height - 1)); 47 | var innerBorder = new Rectangle(outerBorder.X + 1, outerBorder.Y + 1, 48 | outerBorder.Width - dropDownButtonWidth - 2, outerBorder.Height - 2); 49 | var innerInnerBorder = new Rectangle(innerBorder.X + 1, innerBorder.Y + 1, 50 | innerBorder.Width - 2, innerBorder.Height - 2); 51 | var dropDownRect = new Rectangle(innerBorder.Right + 1, innerBorder.Y, 52 | dropDownButtonWidth, innerBorder.Height + 1); 53 | if (RightToLeft == RightToLeft.Yes) 54 | { 55 | innerBorder.X = clientRect.Width - innerBorder.Right; 56 | innerInnerBorder.X = clientRect.Width - innerInnerBorder.Right; 57 | dropDownRect.X = clientRect.Width - dropDownRect.Right; 58 | dropDownRect.Width += 1; 59 | } 60 | var innerBorderColor = Enabled ? BackColor : SystemColors.Control; 61 | var outerBorderColor = Enabled ? BorderColor : SystemColors.ControlDark; 62 | var buttonColor = Enabled ? ButtonColor : SystemColors.Control; 63 | var middle = new Point(dropDownRect.Left + dropDownRect.Width / 2, 64 | dropDownRect.Top + dropDownRect.Height / 2); 65 | var arrow = new Point[] 66 | { 67 | new Point(middle.X - 3, middle.Y - 2), 68 | new Point(middle.X + 4, middle.Y - 2), 69 | new Point(middle.X, middle.Y + 2) 70 | }; 71 | var ps = new PAINTSTRUCT(); 72 | bool shoulEndPaint = false; 73 | IntPtr dc; 74 | if (m.WParam == IntPtr.Zero) 75 | { 76 | dc = BeginPaint(Handle, ref ps); 77 | m.WParam = dc; 78 | shoulEndPaint = true; 79 | } 80 | else 81 | { 82 | dc = m.WParam; 83 | } 84 | var rgn = CreateRectRgn(innerInnerBorder.Left, innerInnerBorder.Top, 85 | innerInnerBorder.Right, innerInnerBorder.Bottom); 86 | SelectClipRgn(dc, rgn); 87 | DefWndProc(ref m); 88 | DeleteObject(rgn); 89 | rgn = CreateRectRgn(clientRect.Left, clientRect.Top, 90 | clientRect.Right, clientRect.Bottom); 91 | SelectClipRgn(dc, rgn); 92 | using (var g = Graphics.FromHdc(dc)) 93 | { 94 | using (var b = new SolidBrush(buttonColor)) 95 | { 96 | g.FillRectangle(b, dropDownRect); 97 | } 98 | using (var b = new SolidBrush(outerBorderColor)) 99 | { 100 | g.FillPolygon(b, arrow); 101 | } 102 | using (var p = new Pen(innerBorderColor)) 103 | { 104 | g.DrawRectangle(p, innerBorder); 105 | g.DrawRectangle(p, innerInnerBorder); 106 | } 107 | using (var p = new Pen(outerBorderColor)) 108 | { 109 | g.DrawRectangle(p, outerBorder); 110 | } 111 | } 112 | if (shoulEndPaint) 113 | EndPaint(Handle, ref ps); 114 | DeleteObject(rgn); 115 | } 116 | else 117 | base.WndProc(ref m); 118 | } 119 | 120 | private const int WM_PAINT = 0xF; 121 | [StructLayout(LayoutKind.Sequential)] 122 | public struct RECT 123 | { 124 | public int L, T, R, B; 125 | } 126 | [StructLayout(LayoutKind.Sequential)] 127 | public struct PAINTSTRUCT 128 | { 129 | public IntPtr hdc; 130 | public bool fErase; 131 | public int rcPaint_left; 132 | public int rcPaint_top; 133 | public int rcPaint_right; 134 | public int rcPaint_bottom; 135 | public bool fRestore; 136 | public bool fIncUpdate; 137 | public int reserved1; 138 | public int reserved2; 139 | public int reserved3; 140 | public int reserved4; 141 | public int reserved5; 142 | public int reserved6; 143 | public int reserved7; 144 | public int reserved8; 145 | } 146 | [DllImport("user32.dll")] 147 | private static extern IntPtr BeginPaint(IntPtr hWnd, 148 | [In, Out] ref PAINTSTRUCT lpPaint); 149 | 150 | [DllImport("user32.dll")] 151 | private static extern bool EndPaint(IntPtr hWnd, ref PAINTSTRUCT lpPaint); 152 | 153 | [DllImport("gdi32.dll")] 154 | public static extern int SelectClipRgn(IntPtr hDC, IntPtr hRgn); 155 | 156 | [DllImport("user32.dll")] 157 | public static extern int GetUpdateRgn(IntPtr hwnd, IntPtr hrgn, bool fErase); 158 | public enum RegionFlags 159 | { 160 | ERROR = 0, 161 | NULLREGION = 1, 162 | SIMPLEREGION = 2, 163 | COMPLEXREGION = 3, 164 | } 165 | [DllImport("gdi32.dll")] 166 | internal static extern bool DeleteObject(IntPtr hObject); 167 | 168 | [DllImport("gdi32.dll")] 169 | private static extern IntPtr CreateRectRgn(int x1, int y1, int x2, int y2); 170 | } 171 | } 172 | -------------------------------------------------------------------------------- /DarkControls/Controls/FlatScrollBar.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace DarkControls.Controls 8 | { 9 | internal class FlatScrollBar 10 | { 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /DarkControls/Controls/MaximizeButton.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace DarkControls.Controls 8 | { 9 | public class MaximizeButton : WindowsDefaultTitleBarButton 10 | { 11 | public MaximizeButton() 12 | { 13 | this.ButtonType = DarkControls.Controls.WindowsDefaultTitleBarButton.Type.Maximize; 14 | this.ClickColor = System.Drawing.Color.DodgerBlue; 15 | this.ClickIconColor = System.Drawing.Color.Black; 16 | this.HoverColor = System.Drawing.Color.SkyBlue; 17 | this.HoverIconColor = System.Drawing.Color.Black; 18 | this.IconColor = System.Drawing.Color.Black; 19 | this.IconLineThickness = 2; 20 | this.Size = new System.Drawing.Size(40, 40); 21 | this.UseVisualStyleBackColor = true; 22 | } 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /DarkControls/Controls/MinimizeButton.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace DarkControls.Controls 8 | { 9 | public class MinimizeButton : WindowsDefaultTitleBarButton 10 | { 11 | public MinimizeButton() 12 | { 13 | this.ButtonType = DarkControls.Controls.WindowsDefaultTitleBarButton.Type.Minimize; 14 | this.ClickColor = System.Drawing.Color.DodgerBlue; 15 | this.ClickIconColor = System.Drawing.Color.Black; 16 | this.HoverColor = System.Drawing.Color.SkyBlue; 17 | this.HoverIconColor = System.Drawing.Color.Black; 18 | this.IconColor = System.Drawing.Color.Black; 19 | this.IconLineThickness = 2; 20 | this.Size = new System.Drawing.Size(40, 40); 21 | this.UseVisualStyleBackColor = true; 22 | } 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /DarkControls/Controls/NoFocusCueBotton.cs: -------------------------------------------------------------------------------- 1 | using System.ComponentModel; 2 | using System.Windows.Forms; 3 | 4 | namespace DarkControls.Controls 5 | { 6 | /// 7 | /// Modified button which has no focus rectangles when the form which contains this button loses fucus while the button was focused. 8 | /// 9 | [ToolboxItem(typeof(NoFocusCueBotton))] 10 | public class NoFocusCueBotton : Button 11 | { 12 | protected override bool ShowFocusCues => false; 13 | 14 | /// 15 | /// Creates a new instance of a 16 | /// 17 | public NoFocusCueBotton() { } 18 | 19 | public override void NotifyDefault(bool value) 20 | { 21 | base.NotifyDefault(false); 22 | } 23 | } 24 | } -------------------------------------------------------------------------------- /DarkControls/Controls/ProgressBarEx.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Windows.Forms; 3 | using System.Drawing; 4 | using System.Drawing.Drawing2D; 5 | 6 | namespace DarkControls.Controls 7 | { 8 | public class ProgressBarEx : ProgressBar 9 | { 10 | public ProgressBarEx() 11 | { 12 | this.SetStyle(ControlStyles.UserPaint, true); 13 | } 14 | 15 | protected override void OnPaintBackground(PaintEventArgs pevent) 16 | { 17 | // None... Helps control the flicker. 18 | } 19 | 20 | protected override void OnPaint(PaintEventArgs e) 21 | { 22 | const int inset = 2; // A single inset value to control teh sizing of the inner rect. 23 | 24 | using (Image offscreenImage = new Bitmap(this.Width, this.Height)) 25 | { 26 | using (Graphics offscreen = Graphics.FromImage(offscreenImage)) 27 | { 28 | offscreen.Clear(this.BackColor); 29 | Rectangle rect = new Rectangle(0, 0, this.Width, this.Height); 30 | offscreen.DrawRectangle(new Pen(Color.Silver, 2), rect); 31 | 32 | //if (ProgressBarRenderer.IsSupported) 33 | // ProgressBarRenderer.DrawHorizontalBar(offscreen, rect); 34 | 35 | rect.Inflate(new Size(-inset, -inset)); // Deflate inner rect. 36 | rect.Width = (int)(rect.Width * ((double)this.Value / this.Maximum)); 37 | if (rect.Width == 0) rect.Width = 1; // Can't draw rec with width of 0. 38 | 39 | //LinearGradientBrush brush = new LinearGradientBrush(rect, this.BackColor, this.ForeColor, LinearGradientMode.Horizontal); 40 | SolidBrush brush = new SolidBrush(this.ForeColor); 41 | 42 | offscreen.FillRectangle(brush, inset, inset, rect.Width, rect.Height); 43 | 44 | e.Graphics.DrawImage(offscreenImage, 0, 0); 45 | } 46 | } 47 | } 48 | } 49 | } 50 | -------------------------------------------------------------------------------- /DarkControls/Controls/TransparentLabel.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Windows.Forms; 7 | 8 | namespace DarkControls.Controls 9 | { 10 | public class TransparentLabel : Label 11 | { 12 | protected override void WndProc(ref Message m) 13 | { 14 | const int WM_NCHITTEST = 0x0084; 15 | const int HTTRANSPARENT = (-1); 16 | 17 | if (m.Msg == WM_NCHITTEST) 18 | { 19 | m.Result = (IntPtr)HTTRANSPARENT; 20 | } 21 | else 22 | { 23 | base.WndProc(ref m); 24 | } 25 | } 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /DarkControls/DarkControls.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C} 8 | Library 9 | Properties 10 | DarkControls 11 | DarkControls 12 | v4.8 13 | 512 14 | true 15 | 16 | 17 | 18 | true 19 | full 20 | false 21 | bin\x86\Debug\ 22 | DEBUG;TRACE 23 | prompt 24 | 4 25 | 26 | 27 | pdbonly 28 | true 29 | bin\Release\ 30 | TRACE 31 | prompt 32 | 4 33 | 34 | 35 | true 36 | bin\x64\Debug\ 37 | DEBUG;TRACE 38 | full 39 | x64 40 | 7.3 41 | prompt 42 | true 43 | 44 | 45 | bin\Release\x64\ 46 | TRACE 47 | true 48 | pdbonly 49 | AnyCPU 50 | 7.3 51 | prompt 52 | 53 | 54 | true 55 | bin\x86\Debug\ 56 | DEBUG;TRACE 57 | full 58 | x86 59 | 7.3 60 | prompt 61 | 62 | 63 | bin\x86\Release\ 64 | TRACE 65 | true 66 | pdbonly 67 | x86 68 | 7.3 69 | prompt 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | Component 88 | 89 | 90 | Component 91 | 92 | 93 | Component 94 | 95 | 96 | Component 97 | 98 | 99 | Component 100 | 101 | 102 | Component 103 | 104 | 105 | Component 106 | 107 | 108 | Component 109 | 110 | 111 | Component 112 | 113 | 114 | Component 115 | 116 | 117 | 118 | 119 | Component 120 | 121 | 122 | Component 123 | 124 | 125 | Component 126 | 127 | 128 | Component 129 | 130 | 131 | 132 | Component 133 | 134 | 135 | Component 136 | 137 | 138 | Component 139 | 140 | 141 | Form 142 | 143 | 144 | 145 | Component 146 | 147 | 148 | 149 | True 150 | True 151 | Resources.resx 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | Designer 161 | 162 | 163 | ResXFileCodeGenerator 164 | Resources.Designer.cs 165 | 166 | 167 | 168 | 169 | 170 | 171 | -------------------------------------------------------------------------------- /DarkControls/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("Lib")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("Lib")] 13 | [assembly: AssemblyCopyright("Copyright © 2023")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("66c94acb-63c7-42a3-9d83-a3801ced4f1c")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /DarkControls/Properties/Resources.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // This code was generated by a tool. 4 | // Runtime Version:4.0.30319.42000 5 | // 6 | // Changes to this file may cause incorrect behavior and will be lost if 7 | // the code is regenerated. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace DarkControls.Properties { 12 | using System; 13 | 14 | 15 | /// 16 | /// A strongly-typed resource class, for looking up localized strings, etc. 17 | /// 18 | // This class was auto-generated by the StronglyTypedResourceBuilder 19 | // class via a tool like ResGen or Visual Studio. 20 | // To add or remove a member, edit your .ResX file then rerun ResGen 21 | // with the /str option, or rebuild your VS project. 22 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "17.0.0.0")] 23 | [global::System.Diagnostics.DebuggerNonUserCodeAttribute()] 24 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 25 | internal class Resources { 26 | 27 | private static global::System.Resources.ResourceManager resourceMan; 28 | 29 | private static global::System.Globalization.CultureInfo resourceCulture; 30 | 31 | [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")] 32 | internal Resources() { 33 | } 34 | 35 | /// 36 | /// Returns the cached ResourceManager instance used by this class. 37 | /// 38 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 39 | internal static global::System.Resources.ResourceManager ResourceManager { 40 | get { 41 | if (object.ReferenceEquals(resourceMan, null)) { 42 | global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("DarkControls.Properties.Resources", typeof(Resources).Assembly); 43 | resourceMan = temp; 44 | } 45 | return resourceMan; 46 | } 47 | } 48 | 49 | /// 50 | /// Overrides the current thread's CurrentUICulture property for all 51 | /// resource lookups using this strongly typed resource class. 52 | /// 53 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 54 | internal static global::System.Globalization.CultureInfo Culture { 55 | get { 56 | return resourceCulture; 57 | } 58 | set { 59 | resourceCulture = value; 60 | } 61 | } 62 | 63 | /// 64 | /// Looks up a localized resource of type System.Drawing.Bitmap. 65 | /// 66 | internal static System.Drawing.Bitmap appIcon1_AppIconImage { 67 | get { 68 | object obj = ResourceManager.GetObject("appIcon1.AppIconImage", resourceCulture); 69 | return ((System.Drawing.Bitmap)(obj)); 70 | } 71 | } 72 | 73 | /// 74 | /// Looks up a localized resource of type System.Drawing.Bitmap. 75 | /// 76 | internal static System.Drawing.Bitmap appIcon1_Image { 77 | get { 78 | object obj = ResourceManager.GetObject("appIcon1.Image", resourceCulture); 79 | return ((System.Drawing.Bitmap)(obj)); 80 | } 81 | } 82 | 83 | /// 84 | /// Looks up a localized resource of type System.Drawing.Bitmap. 85 | /// 86 | internal static System.Drawing.Bitmap icons8_crossed_axes_100 { 87 | get { 88 | object obj = ResourceManager.GetObject("icons8_crossed_axes_100", resourceCulture); 89 | return ((System.Drawing.Bitmap)(obj)); 90 | } 91 | } 92 | 93 | /// 94 | /// Looks up a localized resource of type System.Drawing.Bitmap. 95 | /// 96 | internal static System.Drawing.Bitmap selectFileBtn_Image { 97 | get { 98 | object obj = ResourceManager.GetObject("selectFileBtn_Image", resourceCulture); 99 | return ((System.Drawing.Bitmap)(obj)); 100 | } 101 | } 102 | } 103 | } 104 | -------------------------------------------------------------------------------- /DarkControls/Utils.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Runtime.InteropServices; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | 8 | namespace DarkControls 9 | { 10 | public class Utils 11 | { 12 | [DllImport("Gdi32.dll", EntryPoint = "CreateRoundRectRgn")] 13 | public static extern IntPtr CreateRoundRectRgn 14 | ( 15 | int nLeftRect, // x-coordinate of upper-left corner 16 | int nTopRect, // y-coordinate of upper-left corner 17 | int nRightRect, // x-coordinate of lower-right corner 18 | int nBottomRect, // y-coordinate of lower-right corner 19 | int nWidthEllipse, // width of ellipse 20 | int nHeightEllipse // height of ellipse 21 | ); 22 | 23 | public static int WM_NCHITTEST = 0x84; 24 | public static int HT_CAPTION = 0x2; 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /DarkControls/icons8-crossed-axes-100.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/DarkControls/icons8-crossed-axes-100.png -------------------------------------------------------------------------------- /DarkControls/selectFileBtn.Image.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/DarkControls/selectFileBtn.Image.png -------------------------------------------------------------------------------- /DriverInterface/BSOD.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Diagnostics; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | 8 | namespace KsDumper11 9 | { 10 | public class BSOD 11 | { 12 | public static bool JustHappened() 13 | { 14 | List detectedCrashTimes = new List(); 15 | 16 | string eventLogName = "System"; 17 | 18 | EventLog eventLog = new EventLog(); 19 | eventLog.Log = eventLogName; 20 | 21 | foreach (EventLogEntry log in eventLog.Entries) 22 | { 23 | if (log.EventID == 1001) 24 | { 25 | detectedCrashTimes.Add(log.TimeGenerated); 26 | } 27 | } 28 | 29 | detectedCrashTimes = detectedCrashTimes.OrderByDescending(x => x).ToList(); 30 | 31 | foreach (DateTime crashTime in detectedCrashTimes) 32 | { 33 | if (CheckIfWithinFiveMinutes(crashTime, 5)) 34 | { 35 | return true; 36 | } 37 | } 38 | 39 | return false; 40 | } 41 | 42 | static bool CheckIfWithinFiveMinutes(DateTime dateTimeToCheck, int minutesAgo) 43 | { 44 | // Get the current time 45 | DateTime currentTime = DateTime.Now; 46 | 47 | // Calculate the time difference 48 | TimeSpan timeDifference = currentTime - dateTimeToCheck; 49 | 50 | // Check if the time difference is within 5 minutes 51 | if (timeDifference.TotalMinutes <= minutesAgo) 52 | { 53 | return true; 54 | } 55 | else 56 | { 57 | return false; 58 | } 59 | } 60 | } 61 | } 62 | -------------------------------------------------------------------------------- /DriverInterface/CancelableTask.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading; 6 | using System.Threading.Tasks; 7 | 8 | public class CancelableTask 9 | { 10 | private CancellationTokenSource cancellationTokenSource; 11 | 12 | public CancelableTask(CancellationToken cancellationToken) 13 | { 14 | cancellationTokenSource = new CancellationTokenSource(); 15 | cancellationToken.Register(() => cancellationTokenSource.Cancel()); 16 | } 17 | 18 | public Task CreateTask(Func taskFunction) 19 | { 20 | var taskCompletionSource = new TaskCompletionSource(); 21 | 22 | Task.Run(() => 23 | { 24 | try 25 | { 26 | T result = taskFunction(cancellationTokenSource.Token); 27 | taskCompletionSource.TrySetResult(result); 28 | } 29 | catch (OperationCanceledException) 30 | { 31 | taskCompletionSource.TrySetCanceled(); 32 | } 33 | catch (Exception ex) 34 | { 35 | taskCompletionSource.TrySetException(ex); 36 | } 37 | }); 38 | 39 | return taskCompletionSource.Task; 40 | } 41 | 42 | public void Cancel() 43 | { 44 | cancellationTokenSource.Cancel(); 45 | } 46 | } 47 | 48 | -------------------------------------------------------------------------------- /DriverInterface/CrashMon.cs: -------------------------------------------------------------------------------- 1 | using Newtonsoft.Json; 2 | using System; 3 | using System.Collections.Generic; 4 | using System.IO; 5 | using System.Linq; 6 | using System.Runtime.InteropServices; 7 | using System.Text; 8 | using System.Threading.Tasks; 9 | using static System.Net.Mime.MediaTypeNames; 10 | 11 | namespace KsDumper11 12 | { 13 | public class CrashMon 14 | { 15 | [DllImport("kernel32.dll", SetLastError = true)] 16 | private static extern bool FlushFileBuffers(IntPtr handle); 17 | 18 | private int _checkingProvider = -1; 19 | public int CheckingProvider 20 | { 21 | get 22 | { 23 | return _checkingProvider; 24 | } 25 | set 26 | { 27 | _checkingProvider = value; 28 | Save(); 29 | } 30 | } 31 | 32 | string savePath = KduSelfExtract.AssemblyDirectory + @"\\Setings.json"; 33 | 34 | public CrashMon() 35 | { 36 | if (File.Exists(savePath)) 37 | { 38 | _checkingProvider = JsonConvert.DeserializeObject(File.ReadAllText(savePath)); 39 | } 40 | else 41 | { 42 | _checkingProvider = -1; 43 | } 44 | } 45 | 46 | private void Save() 47 | { 48 | string json = JsonConvert.SerializeObject(_checkingProvider); 49 | 50 | if (!File.Exists(savePath)) 51 | { 52 | FileStream fs = File.Create(savePath); 53 | StreamWriter sw = new StreamWriter(fs); 54 | sw.Write(json); 55 | sw.Flush(); 56 | FlushFileBuffers(fs.Handle); 57 | sw.Close(); 58 | sw.Dispose(); 59 | } 60 | else 61 | { 62 | File.Delete(savePath); 63 | FileStream fs = File.Create(savePath); 64 | StreamWriter sw = new StreamWriter(fs); 65 | sw.Write(json); 66 | sw.Flush(); 67 | FlushFileBuffers(fs.Handle); 68 | sw.Close(); 69 | sw.Dispose(); 70 | } 71 | } 72 | } 73 | } 74 | -------------------------------------------------------------------------------- /DriverInterface/Driver/KsDumperDriver.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/DriverInterface/Driver/KsDumperDriver.sys -------------------------------------------------------------------------------- /DriverInterface/Driver/ManualLoader.bat: -------------------------------------------------------------------------------- 1 | kdu.exe -prv 1 -map KsDumperDriver.sys 2 | pause -------------------------------------------------------------------------------- /DriverInterface/Driver/Taigei64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/DriverInterface/Driver/Taigei64.dll -------------------------------------------------------------------------------- /DriverInterface/Driver/drv64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/DriverInterface/Driver/drv64.dll -------------------------------------------------------------------------------- /DriverInterface/Driver/kdu.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/DriverInterface/Driver/kdu.exe -------------------------------------------------------------------------------- /DriverInterface/DriverInterface.csproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | AnyCPU 7 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B} 8 | Library 9 | Properties 10 | DriverInterface 11 | DriverInterface 12 | v4.8 13 | 512 14 | true 15 | 16 | 17 | true 18 | full 19 | false 20 | bin\Debug\ 21 | DEBUG;TRACE 22 | prompt 23 | 4 24 | 25 | 26 | pdbonly 27 | true 28 | bin\x86\Release\ 29 | TRACE 30 | prompt 31 | 4 32 | 33 | 34 | 35 | ..\packages\Newtonsoft.Json.13.0.3\lib\net45\Newtonsoft.Json.dll 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | True 71 | True 72 | Resources.resx 73 | 74 | 75 | 76 | 77 | Component 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | ResXFileCodeGenerator 93 | Resources.Designer.cs 94 | 95 | 96 | 97 | -------------------------------------------------------------------------------- /DriverInterface/KduProvider.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Diagnostics; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | 8 | namespace KsDumper11 9 | { 10 | public class KduProvider 11 | { 12 | public int ProviderIndex { get; set; } 13 | 14 | public string ProviderName { get; set; } 15 | public string DriverName { get; set; } 16 | public string DeviceName { get; set; } 17 | public string SignerName { get; set; } 18 | public bool IsWHQL_Signed { get; set; } 19 | public string ShellcodeSupportMask { get; set; } 20 | 21 | public string MaxWindowsBuild { get; set; } 22 | public string MinWindowsBuild { get; set; } 23 | 24 | public string[] ExtraInfo { get; set; } 25 | 26 | public bool IsNonWorking 27 | { 28 | get 29 | { 30 | return this.ProviderName.Contains("NOT WORKING"); 31 | } 32 | } 33 | 34 | public bool IsWorking 35 | { 36 | get 37 | { 38 | return this.ProviderName.Contains("WORKING"); 39 | } 40 | } 41 | 42 | 43 | public KduProvider() 44 | { 45 | } 46 | 47 | public KduProvider(string provider) 48 | { 49 | processProvider(provider); 50 | } 51 | 52 | private void processProvider(string prov) 53 | { 54 | string[] lines = prov.Split('\n'); 55 | 56 | string id = lines[0].Split(',')[0]; 57 | 58 | ProviderIndex = int.Parse(id); 59 | 60 | string[] provInfo = lines[1].Split(','); 61 | 62 | ProviderName = provInfo[0]; 63 | 64 | string drvName = provInfo[1].Trim().Replace("DriverName ", "").Replace('"'.ToString(), ""); 65 | string devName = provInfo[2].Trim().Replace("DeviceName ", "").Replace('"'.ToString(), ""); 66 | DriverName = drvName; 67 | DeviceName = devName; 68 | 69 | string signer = lines[2].Trim().Replace("Signed by: ", "").Replace('"'.ToString(), ""); 70 | SignerName = signer; 71 | 72 | string shellCodeMask = lines[3].Trim().Replace("Shellcode support mask: ", "").Replace('"'.ToString(), ""); 73 | ShellcodeSupportMask = shellCodeMask; 74 | 75 | foreach (string ln in lines) 76 | { 77 | if (ln.Contains("Driver is WHQL signed")) 78 | { 79 | IsWHQL_Signed = true; 80 | } 81 | 82 | if (ln.StartsWith("Maximum Windows build undefined")) 83 | { 84 | MaxWindowsBuild = "No Restrictions"; 85 | } 86 | 87 | if (ln.StartsWith("Maximum supported Windows build: ")) 88 | { 89 | MaxWindowsBuild = ln.Replace("Maximum supported Windows build: ", ""); 90 | } 91 | 92 | if (ln.StartsWith("Minimum supported Windows build: ")) 93 | { 94 | MinWindowsBuild = ln.Replace("Minimum supported Windows build: ", ""); 95 | } 96 | } 97 | 98 | List extraInfoLines = new List(); 99 | 100 | for (int i = 4; i < lines.Length; i++) 101 | { 102 | if (lines[i].StartsWith("Minimum")) 103 | { 104 | break; 105 | } 106 | else if (!lines[i].Contains("Driver is WHQL signed")) 107 | { 108 | extraInfoLines.Add(lines[i]); 109 | } 110 | } 111 | 112 | ExtraInfo = extraInfoLines.ToArray(); 113 | } 114 | } 115 | } 116 | -------------------------------------------------------------------------------- /DriverInterface/KduProviderSettings.cs: -------------------------------------------------------------------------------- 1 | using KsDumper11; 2 | using System; 3 | using System.Collections.Generic; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | 8 | namespace KsDumper11 9 | { 10 | public class KduProviderSettings 11 | { 12 | public List Providers { get; set; } 13 | 14 | public int DefaultProvider { get; set; } = -1; 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /DriverInterface/KduSelfExtract.cs: -------------------------------------------------------------------------------- 1 | using Microsoft.Win32; 2 | using System; 3 | using System.Collections.Generic; 4 | using System.Diagnostics; 5 | using System.IO; 6 | using System.Linq; 7 | using System.Reflection; 8 | using System.Runtime.CompilerServices; 9 | using System.Text; 10 | using System.Threading.Tasks; 11 | 12 | namespace KsDumper11 13 | { 14 | public class KduSelfExtract 15 | { 16 | public static void DisableDriverBlockList() 17 | { 18 | RegistryKey configKey = Registry.LocalMachine.OpenSubKey(@"SYSTEM\CurrentControlSet\Control\CI\Config", true); 19 | 20 | if (configKey == null) 21 | { 22 | configKey = Registry.LocalMachine.CreateSubKey(@"SYSTEM\CurrentControlSet\Control\CI\Config"); 23 | } 24 | 25 | if (configKey != null) 26 | { 27 | if (configKey.GetValue("VulnerableDriverBlocklistEnable") == null) 28 | { 29 | configKey.SetValue("VulnerableDriverBlocklistEnable", 0); 30 | } 31 | } 32 | } 33 | 34 | static string asmDir = ""; 35 | static string driverDir = ""; 36 | static KduSelfExtract() 37 | { 38 | DisableDriverBlockList(); 39 | 40 | asmDir = AssemblyDirectory; 41 | driverDir = asmDir + @"\Driver"; 42 | } 43 | public static string AssemblyDirectory 44 | { 45 | get 46 | { 47 | string codeBase = Assembly.GetExecutingAssembly().CodeBase; 48 | UriBuilder uri = new UriBuilder(codeBase); 49 | string path = Uri.UnescapeDataString(uri.Path); 50 | return Path.GetDirectoryName(path); 51 | } 52 | } 53 | 54 | public static string KduPath 55 | { 56 | get 57 | { 58 | return driverDir + @"\kdu.exe"; 59 | } 60 | } 61 | 62 | private static bool Extracted() 63 | { 64 | bool result = false; 65 | 66 | string driverPath = driverDir + @"\KsDumperDriver.sys"; 67 | string kduPath = driverDir + @"\kdu.exe"; 68 | string drv64Path = driverDir + @"\drv64.dll"; 69 | string taigei64Path = driverDir + @"\Taigei64.dll"; 70 | 71 | if (!Directory.Exists(driverDir)) 72 | { 73 | return false; 74 | } 75 | else 76 | { 77 | if (!File.Exists(driverPath)) 78 | { 79 | return false; 80 | } 81 | else 82 | { 83 | result = true; 84 | } 85 | 86 | if (!File.Exists(kduPath)) 87 | { 88 | return false; 89 | } 90 | else 91 | { 92 | result = true; 93 | } 94 | 95 | if (!File.Exists(drv64Path)) 96 | { 97 | return false; 98 | } 99 | else 100 | { 101 | result = true; 102 | } 103 | 104 | if (!File.Exists(taigei64Path)) 105 | { 106 | return false; 107 | } 108 | else 109 | { 110 | result = true; 111 | } 112 | } 113 | return result; 114 | } 115 | 116 | public static void Extract() 117 | { 118 | if (!Extracted()) 119 | { 120 | string asmDir = AssemblyDirectory; 121 | string driverDir = asmDir + @"\Driver"; 122 | if (!Directory.Exists(driverDir)) 123 | { 124 | Directory.CreateDirectory(driverDir); 125 | } 126 | 127 | string driverPath = driverDir + @"\KsDumperDriver.sys"; 128 | string kduPath = driverDir + @"\kdu.exe"; 129 | string drv64Path = driverDir + @"\drv64.dll"; 130 | string taigei64Path = driverDir + @"\Taigei64.dll"; 131 | 132 | if (!File.Exists(driverPath)) 133 | { 134 | File.WriteAllBytes(driverPath, DriverInterface.Properties.Resources.KsDumperDriver); 135 | } 136 | 137 | if (!File.Exists(kduPath)) 138 | { 139 | File.WriteAllBytes(kduPath, DriverInterface.Properties.Resources.kdu); 140 | } 141 | 142 | if (!File.Exists(drv64Path)) 143 | { 144 | File.WriteAllBytes(drv64Path, DriverInterface.Properties.Resources.drv64); 145 | } 146 | 147 | if (!File.Exists(taigei64Path)) 148 | { 149 | File.WriteAllBytes(taigei64Path, DriverInterface.Properties.Resources.Taigei64); 150 | } 151 | } 152 | } 153 | } 154 | } 155 | -------------------------------------------------------------------------------- /DriverInterface/KsDumperDriverInterface.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.IO; 3 | using System.Runtime.InteropServices; 4 | using KsDumper11.Utility; 5 | 6 | namespace KsDumper11.Driver 7 | { 8 | public class KsDumperDriverInterface 9 | { 10 | public static KsDumperDriverInterface OpenKsDumperDriver() 11 | { 12 | return new KsDumperDriverInterface("\\\\.\\KsDumper"); 13 | } 14 | public static bool IsDriverOpen(string driverPath) 15 | { 16 | IntPtr handle = WinApi.CreateFileA(driverPath, FileAccess.ReadWrite, FileShare.ReadWrite, IntPtr.Zero, FileMode.Open, (FileAttributes)0, IntPtr.Zero); 17 | bool result = handle != WinApi.INVALID_HANDLE_VALUE; 18 | WinApi.CloseHandle(handle); 19 | return result; 20 | } 21 | 22 | public KsDumperDriverInterface(string registryPath) 23 | { 24 | this.driverHandle = WinApi.CreateFileA(registryPath, FileAccess.ReadWrite, FileShare.ReadWrite, IntPtr.Zero, FileMode.Open, (FileAttributes)0, IntPtr.Zero); 25 | } 26 | 27 | public bool HasValidHandle() 28 | { 29 | return this.driverHandle != WinApi.INVALID_HANDLE_VALUE; 30 | } 31 | 32 | public bool GetProcessSummaryList(out ProcessSummary[] result) 33 | { 34 | result = new ProcessSummary[0]; 35 | bool flag = this.driverHandle != WinApi.INVALID_HANDLE_VALUE; 36 | if (flag) 37 | { 38 | int requiredBufferSize = this.GetProcessListRequiredBufferSize(); 39 | bool flag2 = requiredBufferSize > 0; 40 | if (flag2) 41 | { 42 | IntPtr bufferPointer = MarshalUtility.AllocZeroFilled(requiredBufferSize); 43 | Operations.KERNEL_PROCESS_LIST_OPERATION operation = new Operations.KERNEL_PROCESS_LIST_OPERATION 44 | { 45 | bufferAddress = (ulong)bufferPointer.ToInt64(), 46 | bufferSize = requiredBufferSize 47 | }; 48 | IntPtr operationPointer = MarshalUtility.CopyStructToMemory(operation); 49 | int operationSize = Marshal.SizeOf(); 50 | bool flag3 = WinApi.DeviceIoControl(this.driverHandle, Operations.IO_GET_PROCESS_LIST, operationPointer, operationSize, operationPointer, operationSize, IntPtr.Zero, IntPtr.Zero); 51 | if (flag3) 52 | { 53 | operation = MarshalUtility.GetStructFromMemory(operationPointer, true); 54 | bool flag4 = operation.processCount > 0; 55 | if (flag4) 56 | { 57 | byte[] managedBuffer = new byte[requiredBufferSize]; 58 | Marshal.Copy(bufferPointer, managedBuffer, 0, requiredBufferSize); 59 | Marshal.FreeHGlobal(bufferPointer); 60 | result = new ProcessSummary[operation.processCount]; 61 | using (BinaryReader reader = new BinaryReader(new MemoryStream(managedBuffer))) 62 | { 63 | for (int i = 0; i < result.Length; i++) 64 | { 65 | result[i] = ProcessSummary.FromStream(reader); 66 | } 67 | } 68 | return true; 69 | } 70 | } 71 | } 72 | } 73 | return false; 74 | } 75 | 76 | private int GetProcessListRequiredBufferSize() 77 | { 78 | IntPtr operationPointer = MarshalUtility.AllocEmptyStruct(); 79 | int operationSize = Marshal.SizeOf(); 80 | bool flag = WinApi.DeviceIoControl(this.driverHandle, Operations.IO_GET_PROCESS_LIST, operationPointer, operationSize, operationPointer, operationSize, IntPtr.Zero, IntPtr.Zero); 81 | if (flag) 82 | { 83 | Operations.KERNEL_PROCESS_LIST_OPERATION operation = MarshalUtility.GetStructFromMemory(operationPointer, true); 84 | bool flag2 = operation.processCount == 0 && operation.bufferSize > 0; 85 | if (flag2) 86 | { 87 | return operation.bufferSize; 88 | } 89 | } 90 | return 0; 91 | } 92 | 93 | public bool CopyVirtualMemory(int targetProcessId, IntPtr targetAddress, IntPtr bufferAddress, int bufferSize) 94 | { 95 | bool flag = this.driverHandle != WinApi.INVALID_HANDLE_VALUE; 96 | bool flag2; 97 | if (flag) 98 | { 99 | Operations.KERNEL_COPY_MEMORY_OPERATION operation = new Operations.KERNEL_COPY_MEMORY_OPERATION 100 | { 101 | targetProcessId = targetProcessId, 102 | targetAddress = (ulong)targetAddress.ToInt64(), 103 | bufferAddress = (ulong)bufferAddress.ToInt64(), 104 | bufferSize = bufferSize 105 | }; 106 | IntPtr operationPointer = MarshalUtility.CopyStructToMemory(operation); 107 | bool result = WinApi.DeviceIoControl(this.driverHandle, Operations.IO_COPY_MEMORY, operationPointer, Marshal.SizeOf(), IntPtr.Zero, 0, IntPtr.Zero, IntPtr.Zero); 108 | Marshal.FreeHGlobal(operationPointer); 109 | flag2 = result; 110 | } 111 | else 112 | { 113 | flag2 = false; 114 | } 115 | return flag2; 116 | } 117 | 118 | public bool UnloadDriver() 119 | { 120 | if (driverHandle != WinApi.INVALID_HANDLE_VALUE) 121 | { 122 | bool result = WinApi.DeviceIoControl(driverHandle, Operations.IO_UNLOAD_DRIVER, IntPtr.Zero, 0, IntPtr.Zero, 0, IntPtr.Zero, IntPtr.Zero); 123 | this.Dispose(); 124 | return result; 125 | } 126 | return false; 127 | } 128 | 129 | private readonly IntPtr driverHandle; 130 | 131 | public void Dispose() 132 | { 133 | try 134 | { 135 | WinApi.CloseHandle(driverHandle); 136 | } 137 | catch (Exception ex) 138 | { 139 | return; 140 | } 141 | } 142 | 143 | ~KsDumperDriverInterface() 144 | { 145 | try 146 | { 147 | WinApi.CloseHandle(driverHandle); 148 | } 149 | catch (Exception ex) 150 | { 151 | return; 152 | } 153 | } 154 | } 155 | } 156 | -------------------------------------------------------------------------------- /DriverInterface/Operations.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using KsDumper11.Utility; 3 | using static KsDumper11.Utility.WinApi; 4 | 5 | namespace KsDumper11.Driver 6 | { 7 | public static class Operations 8 | { 9 | private static uint CTL_CODE(int deviceType, int function, int method, int access) 10 | { 11 | return (uint)((deviceType << 16) | (access << 14) | (function << 2) | method); 12 | } 13 | 14 | public static readonly uint IO_GET_PROCESS_LIST = Operations.CTL_CODE(WinApi.FILE_DEVICE_UNKNOWN, 5924, WinApi.METHOD_BUFFERED, WinApi.FILE_ANY_ACCESS); 15 | 16 | public static readonly uint IO_COPY_MEMORY = Operations.CTL_CODE(WinApi.FILE_DEVICE_UNKNOWN, 5925, WinApi.METHOD_BUFFERED, WinApi.FILE_ANY_ACCESS); 17 | 18 | public static readonly uint IO_UNLOAD_DRIVER = CTL_CODE(FILE_DEVICE_UNKNOWN, 0x1726, METHOD_BUFFERED, FILE_ANY_ACCESS); 19 | 20 | public struct KERNEL_PROCESS_LIST_OPERATION 21 | { 22 | public ulong bufferAddress; 23 | 24 | public int bufferSize; 25 | 26 | public int processCount; 27 | } 28 | 29 | public struct KERNEL_COPY_MEMORY_OPERATION 30 | { 31 | public int targetProcessId; 32 | 33 | public ulong targetAddress; 34 | 35 | public ulong bufferAddress; 36 | 37 | public int bufferSize; 38 | } 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /DriverInterface/PE/32/PE32File.cs: -------------------------------------------------------------------------------- 1 | using System.IO; 2 | using System.Runtime.InteropServices; 3 | 4 | using static KsDumper11.PE.NativePEStructs; 5 | 6 | namespace KsDumper11.PE 7 | { 8 | public class PE32File : PEFile 9 | { 10 | public DOSHeader DOSHeader { get; private set; } 11 | 12 | public byte[] DOS_Stub { get; private set; } 13 | 14 | public PE32Header PEHeader { get; private set; } 15 | 16 | public PE32File(IMAGE_DOS_HEADER dosHeader, IMAGE_NT_HEADERS32 peHeader, byte[] dosStub) 17 | { 18 | Type = PEType.PE32; 19 | DOSHeader = DOSHeader.FromNativeStruct(dosHeader); 20 | PEHeader = PE32Header.FromNativeStruct(peHeader); 21 | Sections = new PESection[peHeader.FileHeader.NumberOfSections]; 22 | DOS_Stub = dosStub; 23 | } 24 | 25 | public override void SaveToDisk(string fileName) 26 | { 27 | try 28 | { 29 | using (BinaryWriter writer = new BinaryWriter(new FileStream(fileName, FileMode.Create, FileAccess.Write))) 30 | { 31 | DOSHeader.AppendToStream(writer); 32 | writer.Write(DOS_Stub); 33 | PEHeader.AppendToStream(writer); 34 | AppendSections(writer); 35 | } 36 | } 37 | catch { } 38 | } 39 | 40 | public override int GetFirstSectionHeaderOffset() 41 | { 42 | return Marshal.OffsetOf("OptionalHeader").ToInt32() + 43 | PEHeader.FileHeader.SizeOfOptionalHeader; 44 | } 45 | 46 | public override void AlignSectionHeaders() 47 | { 48 | int newFileSize = DOSHeader.e_lfanew + 0x4 + 49 | Marshal.SizeOf() + 50 | PEHeader.FileHeader.SizeOfOptionalHeader + 51 | (PEHeader.FileHeader.NumberOfSections * Marshal.SizeOf()); 52 | 53 | OrderSectionsBy(s => s.Header.PointerToRawData); 54 | 55 | for (int i = 0; i < Sections.Length; i++) 56 | { 57 | Sections[i].Header.VirtualAddress = AlignValue(Sections[i].Header.VirtualAddress, PEHeader.OptionalHeader.SectionAlignment); 58 | Sections[i].Header.VirtualSize = AlignValue(Sections[i].Header.VirtualSize, PEHeader.OptionalHeader.SectionAlignment); 59 | Sections[i].Header.PointerToRawData = AlignValue((uint)newFileSize, PEHeader.OptionalHeader.FileAlignment); 60 | Sections[i].Header.SizeOfRawData = AlignValue((uint)Sections[i].DataSize, PEHeader.OptionalHeader.FileAlignment); 61 | 62 | newFileSize = (int)(Sections[i].Header.PointerToRawData + Sections[i].Header.SizeOfRawData); 63 | } 64 | 65 | OrderSectionsBy(s => s.Header.VirtualAddress); 66 | } 67 | 68 | public override void FixPEHeader() 69 | { 70 | PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress = 0; 71 | PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size = 0; 72 | 73 | for (uint i = PEHeader.OptionalHeader.NumberOfRvaAndSizes; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++) 74 | { 75 | PEHeader.OptionalHeader.DataDirectory[i].VirtualAddress = 0; 76 | PEHeader.OptionalHeader.DataDirectory[i].Size = 0; 77 | } 78 | 79 | PEHeader.OptionalHeader.NumberOfRvaAndSizes = IMAGE_NUMBEROF_DIRECTORY_ENTRIES; 80 | PEHeader.FileHeader.SizeOfOptionalHeader = (ushort)Marshal.SizeOf(); 81 | FixSizeOfImage(); 82 | 83 | int size = DOSHeader.e_lfanew + 0x4 + Marshal.SizeOf(); 84 | PEHeader.OptionalHeader.SizeOfHeaders = AlignValue((uint)(size + PEHeader.FileHeader.SizeOfOptionalHeader + (PEHeader.FileHeader.NumberOfSections * Marshal.SizeOf())), PEHeader.OptionalHeader.FileAlignment); 85 | 86 | RemoveIatDirectory(); 87 | } 88 | 89 | private uint AlignValue(uint value, uint alignment) 90 | { 91 | return ((value + alignment - 1) / alignment) * alignment; 92 | } 93 | 94 | private void FixSizeOfImage() 95 | { 96 | uint lastSize = 0; 97 | 98 | for (int i = 0; i < PEHeader.FileHeader.NumberOfSections; i++) 99 | { 100 | if (Sections[i].Header.VirtualAddress + Sections[i].Header.VirtualSize > lastSize) 101 | { 102 | lastSize = Sections[i].Header.VirtualAddress + Sections[i].Header.VirtualSize; 103 | } 104 | } 105 | PEHeader.OptionalHeader.SizeOfImage = lastSize; 106 | } 107 | 108 | private void RemoveIatDirectory() 109 | { 110 | uint iatDataAddress = PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress; 111 | 112 | PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress = 0; 113 | PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size = 0; 114 | 115 | if (iatDataAddress != 0) 116 | { 117 | for (int i = 0; i < PEHeader.FileHeader.NumberOfSections; i++) 118 | { 119 | if (Sections[i].Header.VirtualAddress <= iatDataAddress && 120 | Sections[i].Header.VirtualAddress + Sections[i].Header.VirtualSize > iatDataAddress) 121 | { 122 | Sections[i].Header.Characteristics |= DataSectionFlags.MemoryRead | DataSectionFlags.MemoryWrite; 123 | } 124 | } 125 | } 126 | } 127 | } 128 | } 129 | -------------------------------------------------------------------------------- /DriverInterface/PE/64/PE64File.cs: -------------------------------------------------------------------------------- 1 | using System.IO; 2 | using System.Runtime.InteropServices; 3 | 4 | using static KsDumper11.PE.NativePEStructs; 5 | 6 | namespace KsDumper11.PE 7 | { 8 | public class PE64File : PEFile 9 | { 10 | public DOSHeader DOSHeader { get; private set; } 11 | 12 | public byte[] DOS_Stub { get; private set; } 13 | 14 | public PE64Header PEHeader { get; private set; } 15 | 16 | public PE64File(IMAGE_DOS_HEADER dosHeader, IMAGE_NT_HEADERS64 peHeader, byte[] dosStub) 17 | { 18 | Type = PEType.PE64; 19 | DOSHeader = DOSHeader.FromNativeStruct(dosHeader); 20 | PEHeader = PE64Header.FromNativeStruct(peHeader); 21 | Sections = new PESection[peHeader.FileHeader.NumberOfSections]; 22 | DOS_Stub = dosStub; 23 | } 24 | 25 | public override void SaveToDisk(string fileName) 26 | { 27 | try 28 | { 29 | using (BinaryWriter writer = new BinaryWriter(new FileStream(fileName, FileMode.Create, FileAccess.Write))) 30 | { 31 | DOSHeader.AppendToStream(writer); 32 | writer.Write(DOS_Stub); 33 | PEHeader.AppendToStream(writer); 34 | AppendSections(writer); 35 | } 36 | } 37 | catch { } 38 | } 39 | 40 | public override int GetFirstSectionHeaderOffset() 41 | { 42 | return Marshal.OffsetOf("OptionalHeader").ToInt32() + 43 | PEHeader.FileHeader.SizeOfOptionalHeader; 44 | } 45 | 46 | public override void AlignSectionHeaders() 47 | { 48 | int newFileSize = DOSHeader.e_lfanew + 0x4 + 49 | Marshal.SizeOf() + 50 | PEHeader.FileHeader.SizeOfOptionalHeader + 51 | (PEHeader.FileHeader.NumberOfSections * Marshal.SizeOf()); 52 | 53 | OrderSectionsBy(s => s.Header.PointerToRawData); 54 | 55 | for (int i = 0; i < Sections.Length; i++) 56 | { 57 | Sections[i].Header.VirtualAddress = AlignValue(Sections[i].Header.VirtualAddress, PEHeader.OptionalHeader.SectionAlignment); 58 | Sections[i].Header.VirtualSize = AlignValue(Sections[i].Header.VirtualSize, PEHeader.OptionalHeader.SectionAlignment); 59 | Sections[i].Header.PointerToRawData = AlignValue((uint)newFileSize, PEHeader.OptionalHeader.FileAlignment); 60 | Sections[i].Header.SizeOfRawData = AlignValue((uint)Sections[i].DataSize, PEHeader.OptionalHeader.FileAlignment); 61 | 62 | newFileSize = (int)(Sections[i].Header.PointerToRawData + Sections[i].Header.SizeOfRawData); 63 | } 64 | 65 | OrderSectionsBy(s => s.Header.VirtualAddress); 66 | } 67 | 68 | public override void FixPEHeader() 69 | { 70 | PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].VirtualAddress = 0; 71 | PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT].Size = 0; 72 | 73 | for (uint i = PEHeader.OptionalHeader.NumberOfRvaAndSizes; i < IMAGE_NUMBEROF_DIRECTORY_ENTRIES; i++) 74 | { 75 | PEHeader.OptionalHeader.DataDirectory[i].VirtualAddress = 0; 76 | PEHeader.OptionalHeader.DataDirectory[i].Size = 0; 77 | } 78 | 79 | PEHeader.OptionalHeader.NumberOfRvaAndSizes = IMAGE_NUMBEROF_DIRECTORY_ENTRIES; 80 | PEHeader.FileHeader.SizeOfOptionalHeader = (ushort)Marshal.SizeOf(); 81 | FixSizeOfImage(); 82 | 83 | int size = DOSHeader.e_lfanew + 0x4 + Marshal.SizeOf(); 84 | PEHeader.OptionalHeader.SizeOfHeaders = AlignValue((uint)(size + PEHeader.FileHeader.SizeOfOptionalHeader + (PEHeader.FileHeader.NumberOfSections * Marshal.SizeOf())), PEHeader.OptionalHeader.FileAlignment); 85 | 86 | RemoveIatDirectory(); 87 | } 88 | 89 | private uint AlignValue(uint value, uint alignment) 90 | { 91 | return ((value + alignment - 1) / alignment) * alignment; 92 | } 93 | 94 | private void FixSizeOfImage() 95 | { 96 | uint lastSize = 0; 97 | 98 | for (int i = 0; i < PEHeader.FileHeader.NumberOfSections; i++) 99 | { 100 | if (Sections[i].Header.VirtualAddress + Sections[i].Header.VirtualSize > lastSize) 101 | { 102 | lastSize = Sections[i].Header.VirtualAddress + Sections[i].Header.VirtualSize; 103 | } 104 | } 105 | PEHeader.OptionalHeader.SizeOfImage = lastSize; 106 | } 107 | 108 | private void RemoveIatDirectory() 109 | { 110 | uint iatDataAddress = PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress; 111 | 112 | PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress = 0; 113 | PEHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size = 0; 114 | 115 | if (iatDataAddress != 0) 116 | { 117 | for (int i = 0; i < PEHeader.FileHeader.NumberOfSections; i++) 118 | { 119 | if (Sections[i].Header.VirtualAddress <= iatDataAddress && 120 | Sections[i].Header.VirtualAddress + Sections[i].Header.VirtualSize > iatDataAddress) 121 | { 122 | Sections[i].Header.Characteristics |= DataSectionFlags.MemoryRead | DataSectionFlags.MemoryWrite; 123 | } 124 | } 125 | } 126 | } 127 | } 128 | } 129 | -------------------------------------------------------------------------------- /DriverInterface/PE/DOSHeader.cs: -------------------------------------------------------------------------------- 1 | using System.IO; 2 | 3 | using static KsDumper11.PE.NativePEStructs; 4 | 5 | namespace KsDumper11.PE 6 | { 7 | public class DOSHeader 8 | { 9 | public string e_magic { get; set; } 10 | public ushort e_cblp { get; set; } 11 | public ushort e_cp { get; set; } 12 | public ushort e_crlc { get; set; } 13 | public ushort e_cparhdr { get; set; } 14 | public ushort e_minalloc { get; set; } 15 | public ushort e_maxalloc { get; set; } 16 | public ushort e_ss { get; set; } 17 | public ushort e_sp { get; set; } 18 | public ushort e_csum { get; set; } 19 | public ushort e_ip { get; set; } 20 | public ushort e_cs { get; set; } 21 | public ushort e_lfarlc { get; set; } 22 | public ushort e_ovno { get; set; } 23 | public ushort[] e_res1 { get; set; } 24 | public ushort e_oemid { get; set; } 25 | public ushort e_oeminfo { get; set; } 26 | public ushort[] e_res2 { get; set; } 27 | public int e_lfanew { get; set; } 28 | 29 | public void AppendToStream(BinaryWriter writer) 30 | { 31 | writer.Write(e_magic.ToCharArray()); 32 | writer.Write(e_cblp); 33 | writer.Write(e_cp); 34 | writer.Write(e_crlc); 35 | writer.Write(e_cparhdr); 36 | writer.Write(e_minalloc); 37 | writer.Write(e_maxalloc); 38 | writer.Write(e_ss); 39 | writer.Write(e_sp); 40 | writer.Write(e_csum); 41 | writer.Write(e_ip); 42 | writer.Write(e_cs); 43 | writer.Write(e_lfarlc); 44 | writer.Write(e_ovno); 45 | 46 | for (int i = 0; i < e_res1.Length; i++) 47 | { 48 | writer.Write(e_res1[i]); 49 | } 50 | writer.Write(e_oemid); 51 | writer.Write(e_oeminfo); 52 | 53 | for (int i = 0; i < e_res2.Length; i++) 54 | { 55 | writer.Write(e_res2[i]); 56 | } 57 | writer.Write(e_lfanew); 58 | } 59 | 60 | public static DOSHeader FromNativeStruct(IMAGE_DOS_HEADER nativeStruct) 61 | { 62 | return new DOSHeader 63 | { 64 | e_magic = new string(nativeStruct.e_magic), 65 | e_cblp = nativeStruct.e_cblp, 66 | e_cp = nativeStruct.e_cp, 67 | e_crlc = nativeStruct.e_crlc, 68 | e_cparhdr = nativeStruct.e_cparhdr, 69 | e_minalloc = nativeStruct.e_minalloc, 70 | e_maxalloc = nativeStruct.e_maxalloc, 71 | e_ss = nativeStruct.e_ss, 72 | e_sp = nativeStruct.e_sp, 73 | e_csum = nativeStruct.e_csum, 74 | e_ip = nativeStruct.e_ip, 75 | e_cs = nativeStruct.e_cs, 76 | e_lfarlc = nativeStruct.e_lfarlc, 77 | e_ovno = nativeStruct.e_ovno, 78 | e_res1 = nativeStruct.e_res1, 79 | e_oemid = nativeStruct.e_oemid, 80 | e_oeminfo = nativeStruct.e_oeminfo, 81 | e_res2 = nativeStruct.e_res2, 82 | e_lfanew = nativeStruct.e_lfanew 83 | }; 84 | } 85 | } 86 | } 87 | -------------------------------------------------------------------------------- /DriverInterface/PE/PEFile.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.IO; 3 | using System.Linq; 4 | 5 | namespace KsDumper11.PE 6 | { 7 | public abstract class PEFile 8 | { 9 | public PEType Type { get; protected set; } 10 | 11 | public PESection[] Sections { get; protected set; } 12 | 13 | 14 | public abstract int GetFirstSectionHeaderOffset(); 15 | 16 | public abstract void AlignSectionHeaders(); 17 | 18 | public abstract void FixPEHeader(); 19 | 20 | public abstract void SaveToDisk(string fileName); 21 | 22 | protected void AppendSections(BinaryWriter writer) 23 | { 24 | foreach (var sectionHeader in Sections.Select(s => s.Header)) 25 | { 26 | sectionHeader.AppendToStream(writer); 27 | } 28 | 29 | foreach (var section in Sections) 30 | { 31 | if (section.Header.PointerToRawData > 0) 32 | { 33 | if (section.Header.PointerToRawData > writer.BaseStream.Position) 34 | { 35 | long prePaddingSize = section.Header.PointerToRawData - writer.BaseStream.Position; 36 | writer.Write(new byte[prePaddingSize]); 37 | } 38 | 39 | if (section.DataSize > 0) 40 | { 41 | writer.Write(section.Content); 42 | 43 | if (section.DataSize < section.Header.SizeOfRawData) 44 | { 45 | long postPaddingSize = section.Header.SizeOfRawData - section.DataSize; 46 | writer.Write(new byte[postPaddingSize]); 47 | } 48 | } 49 | } 50 | } 51 | } 52 | 53 | protected void OrderSectionsBy(Func orderFunction) 54 | { 55 | Sections = Sections.OrderBy(orderFunction).ToArray(); 56 | } 57 | 58 | public enum PEType 59 | { 60 | PE32, 61 | PE64 62 | } 63 | } 64 | } 65 | -------------------------------------------------------------------------------- /DriverInterface/PE/PESection.cs: -------------------------------------------------------------------------------- 1 | using System.IO; 2 | 3 | using static KsDumper11.PE.NativePEStructs; 4 | 5 | namespace KsDumper11.PE 6 | { 7 | public class PESection 8 | { 9 | public PESectionHeader Header { get; set; } 10 | 11 | public byte[] Content { get; set; } 12 | 13 | public int InitialSize { get; set; } 14 | 15 | public int DataSize { get; set; } 16 | 17 | public class PESectionHeader 18 | { 19 | public string Name { get; set; } 20 | 21 | public uint VirtualSize { get; set; } 22 | 23 | public uint VirtualAddress { get; set; } 24 | 25 | public uint SizeOfRawData { get; set; } 26 | 27 | public uint PointerToRawData { get; set; } 28 | 29 | public uint PointerToRelocations { get; set; } 30 | 31 | public uint PointerToLinenumbers { get; set; } 32 | 33 | public ushort NumberOfRelocations { get; set; } 34 | 35 | public ushort NumberOfLinenumbers { get; set; } 36 | 37 | public DataSectionFlags Characteristics { get; set; } 38 | 39 | 40 | public void AppendToStream(BinaryWriter writer) 41 | { 42 | writer.Write(Name.ToCharArray()); 43 | writer.Write(VirtualSize); 44 | writer.Write(VirtualAddress); 45 | writer.Write(SizeOfRawData); 46 | writer.Write(PointerToRawData); 47 | writer.Write(PointerToRelocations); 48 | writer.Write(PointerToLinenumbers); 49 | writer.Write(NumberOfRelocations); 50 | writer.Write(NumberOfLinenumbers); 51 | writer.Write((uint)Characteristics); 52 | } 53 | 54 | public static PESectionHeader FromNativeStruct(IMAGE_SECTION_HEADER nativeStruct) 55 | { 56 | return new PESectionHeader 57 | { 58 | Name = nativeStruct.SectionName, 59 | VirtualSize = nativeStruct.VirtualSize, 60 | VirtualAddress = nativeStruct.VirtualAddress, 61 | SizeOfRawData = nativeStruct.SizeOfRawData, 62 | PointerToRawData = nativeStruct.PointerToRawData, 63 | PointerToRelocations = nativeStruct.PointerToRelocations, 64 | PointerToLinenumbers = nativeStruct.PointerToLinenumbers, 65 | NumberOfRelocations = nativeStruct.NumberOfRelocations, 66 | NumberOfLinenumbers = nativeStruct.NumberOfLinenumbers, 67 | Characteristics = nativeStruct.Characteristics 68 | }; 69 | } 70 | } 71 | } 72 | } 73 | -------------------------------------------------------------------------------- /DriverInterface/ProcessSummary.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Diagnostics; 3 | using System.IO; 4 | using System.Runtime.CompilerServices; 5 | using System.Text; 6 | using KsDumper11.Driver; 7 | using KsDumper11.Utility; 8 | 9 | namespace KsDumper11 10 | { 11 | // Token: 0x02000004 RID: 4 12 | public class ProcessSummary 13 | { 14 | // Token: 0x17000002 RID: 2 15 | // (get) Token: 0x06000039 RID: 57 RVA: 0x00004089 File Offset: 0x00002289 16 | // (set) Token: 0x0600003A RID: 58 RVA: 0x00004091 File Offset: 0x00002291 17 | public int ProcessId { get; set; } 18 | 19 | // Token: 0x17000003 RID: 3 20 | // (get) Token: 0x0600003B RID: 59 RVA: 0x0000409A File Offset: 0x0000229A 21 | // (set) Token: 0x0600003C RID: 60 RVA: 0x000040A2 File Offset: 0x000022A2 22 | public string ProcessName { get; set; } 23 | 24 | // Token: 0x17000004 RID: 4 25 | // (get) Token: 0x0600003D RID: 61 RVA: 0x000040AB File Offset: 0x000022AB 26 | // (set) Token: 0x0600003E RID: 62 RVA: 0x000040B3 File Offset: 0x000022B3 27 | public ulong MainModuleBase { get; set; } 28 | 29 | // Token: 0x17000005 RID: 5 30 | // (get) Token: 0x0600003F RID: 63 RVA: 0x000040BC File Offset: 0x000022BC 31 | // (set) Token: 0x06000040 RID: 64 RVA: 0x000040C4 File Offset: 0x000022C4 32 | public string MainModuleFileName { get; set; } 33 | 34 | // Token: 0x17000006 RID: 6 35 | // (get) Token: 0x06000041 RID: 65 RVA: 0x000040CD File Offset: 0x000022CD 36 | // (set) Token: 0x06000042 RID: 66 RVA: 0x000040D5 File Offset: 0x000022D5 37 | public uint MainModuleImageSize { get; set; } 38 | 39 | // Token: 0x17000007 RID: 7 40 | // (get) Token: 0x06000043 RID: 67 RVA: 0x000040DE File Offset: 0x000022DE 41 | // (set) Token: 0x06000044 RID: 68 RVA: 0x000040E6 File Offset: 0x000022E6 42 | public ulong MainModuleEntryPoint { get; set; } 43 | 44 | // Token: 0x17000008 RID: 8 45 | // (get) Token: 0x06000045 RID: 69 RVA: 0x000040EF File Offset: 0x000022EF 46 | // (set) Token: 0x06000046 RID: 70 RVA: 0x000040F7 File Offset: 0x000022F7 47 | public bool IsWOW64 { get; set; } 48 | 49 | // Token: 0x06000047 RID: 71 RVA: 0x00004100 File Offset: 0x00002300 50 | public static ProcessSummary ProcessSummaryFromID(KsDumperDriverInterface driver, string processName) 51 | { 52 | ProcessSummary result = null; 53 | ProcessSummary[] processes; 54 | driver.GetProcessSummaryList(out processes); 55 | bool flag = processes != null; 56 | if (flag) 57 | { 58 | foreach (ProcessSummary process in processes) 59 | { 60 | bool flag2 = process.ProcessName.ToLower().Contains(processName.ToLower()); 61 | if (flag2) 62 | { 63 | Logger.Log(process.ProcessName + " " + processName, Array.Empty()); 64 | return process; 65 | } 66 | } 67 | } 68 | return result; 69 | } 70 | 71 | // Token: 0x06000048 RID: 72 RVA: 0x0000418C File Offset: 0x0000238C 72 | private ProcessSummary(int processId, ulong mainModuleBase, string mainModuleFileName, uint mainModuleImageSize, ulong mainModuleEntryPoint, bool isWOW64) 73 | { 74 | this.ProcessId = processId; 75 | this.MainModuleBase = mainModuleBase; 76 | this.MainModuleFileName = this.FixFileName(mainModuleFileName); 77 | this.MainModuleImageSize = mainModuleImageSize; 78 | this.MainModuleEntryPoint = mainModuleEntryPoint; 79 | this.ProcessName = Path.GetFileName(this.MainModuleFileName); 80 | this.IsWOW64 = isWOW64; 81 | } 82 | 83 | // Token: 0x06000049 RID: 73 RVA: 0x000041EC File Offset: 0x000023EC 84 | private string FixFileName(string fileName) 85 | { 86 | bool flag = fileName.StartsWith("\\"); 87 | string text; 88 | if (flag) 89 | { 90 | text = fileName; 91 | } 92 | else 93 | { 94 | StringBuilder sb = new StringBuilder(256); 95 | int length = WinApi.GetLongPathName(fileName, sb, sb.Capacity); 96 | bool flag2 = length > sb.Capacity; 97 | if (flag2) 98 | { 99 | sb.Capacity = length; 100 | length = WinApi.GetLongPathName(fileName, sb, sb.Capacity); 101 | } 102 | text = sb.ToString(); 103 | } 104 | return text; 105 | } 106 | 107 | // Token: 0x0600004A RID: 74 RVA: 0x00004258 File Offset: 0x00002458 108 | public static ProcessSummary FromStream(BinaryReader reader) 109 | { 110 | return new ProcessSummary(reader.ReadInt32(), reader.ReadUInt64(), Encoding.Unicode.GetString(reader.ReadBytes(512)).Split(new char[1])[0], reader.ReadUInt32(), reader.ReadUInt64(), reader.ReadBoolean()); 111 | } 112 | } 113 | } 114 | -------------------------------------------------------------------------------- /DriverInterface/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System.Reflection; 2 | using System.Runtime.CompilerServices; 3 | using System.Runtime.InteropServices; 4 | 5 | // General Information about an assembly is controlled through the following 6 | // set of attributes. Change these attribute values to modify the information 7 | // associated with an assembly. 8 | [assembly: AssemblyTitle("DriverInterface")] 9 | [assembly: AssemblyDescription("")] 10 | [assembly: AssemblyConfiguration("")] 11 | [assembly: AssemblyCompany("")] 12 | [assembly: AssemblyProduct("DriverInterface")] 13 | [assembly: AssemblyCopyright("Copyright © 2023")] 14 | [assembly: AssemblyTrademark("")] 15 | [assembly: AssemblyCulture("")] 16 | 17 | // Setting ComVisible to false makes the types in this assembly not visible 18 | // to COM components. If you need to access a type in this assembly from 19 | // COM, set the ComVisible attribute to true on that type. 20 | [assembly: ComVisible(false)] 21 | 22 | // The following GUID is for the ID of the typelib if this project is exposed to COM 23 | [assembly: Guid("6f8b2a35-060d-4eb1-a6ba-a3057179304b")] 24 | 25 | // Version information for an assembly consists of the following four values: 26 | // 27 | // Major Version 28 | // Minor Version 29 | // Build Number 30 | // Revision 31 | // 32 | // You can specify all the values or you can default the Build and Revision Numbers 33 | // by using the '*' as shown below: 34 | // [assembly: AssemblyVersion("1.0.*")] 35 | [assembly: AssemblyVersion("1.0.0.0")] 36 | [assembly: AssemblyFileVersion("1.0.0.0")] 37 | -------------------------------------------------------------------------------- /DriverInterface/Properties/Resources.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // This code was generated by a tool. 4 | // Runtime Version:4.0.30319.42000 5 | // 6 | // Changes to this file may cause incorrect behavior and will be lost if 7 | // the code is regenerated. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace DriverInterface.Properties { 12 | using System; 13 | 14 | 15 | /// 16 | /// A strongly-typed resource class, for looking up localized strings, etc. 17 | /// 18 | // This class was auto-generated by the StronglyTypedResourceBuilder 19 | // class via a tool like ResGen or Visual Studio. 20 | // To add or remove a member, edit your .ResX file then rerun ResGen 21 | // with the /str option, or rebuild your VS project. 22 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "17.0.0.0")] 23 | [global::System.Diagnostics.DebuggerNonUserCodeAttribute()] 24 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 25 | internal class Resources { 26 | 27 | private static global::System.Resources.ResourceManager resourceMan; 28 | 29 | private static global::System.Globalization.CultureInfo resourceCulture; 30 | 31 | [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")] 32 | internal Resources() { 33 | } 34 | 35 | /// 36 | /// Returns the cached ResourceManager instance used by this class. 37 | /// 38 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 39 | internal static global::System.Resources.ResourceManager ResourceManager { 40 | get { 41 | if (object.ReferenceEquals(resourceMan, null)) { 42 | global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("DriverInterface.Properties.Resources", typeof(Resources).Assembly); 43 | resourceMan = temp; 44 | } 45 | return resourceMan; 46 | } 47 | } 48 | 49 | /// 50 | /// Overrides the current thread's CurrentUICulture property for all 51 | /// resource lookups using this strongly typed resource class. 52 | /// 53 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 54 | internal static global::System.Globalization.CultureInfo Culture { 55 | get { 56 | return resourceCulture; 57 | } 58 | set { 59 | resourceCulture = value; 60 | } 61 | } 62 | 63 | /// 64 | /// Looks up a localized resource of type System.Byte[]. 65 | /// 66 | internal static byte[] drv64 { 67 | get { 68 | object obj = ResourceManager.GetObject("drv64", resourceCulture); 69 | return ((byte[])(obj)); 70 | } 71 | } 72 | 73 | /// 74 | /// Looks up a localized resource of type System.Byte[]. 75 | /// 76 | internal static byte[] kdu { 77 | get { 78 | object obj = ResourceManager.GetObject("kdu", resourceCulture); 79 | return ((byte[])(obj)); 80 | } 81 | } 82 | 83 | /// 84 | /// Looks up a localized resource of type System.Byte[]. 85 | /// 86 | internal static byte[] KsDumperDriver { 87 | get { 88 | object obj = ResourceManager.GetObject("KsDumperDriver", resourceCulture); 89 | return ((byte[])(obj)); 90 | } 91 | } 92 | 93 | /// 94 | /// Looks up a localized resource of type System.Byte[]. 95 | /// 96 | internal static byte[] Taigei64 { 97 | get { 98 | object obj = ResourceManager.GetObject("Taigei64", resourceCulture); 99 | return ((byte[])(obj)); 100 | } 101 | } 102 | } 103 | } 104 | -------------------------------------------------------------------------------- /DriverInterface/Properties/Resources.resx: -------------------------------------------------------------------------------- 1 |  2 | 3 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | text/microsoft-resx 110 | 111 | 112 | 2.0 113 | 114 | 115 | System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 116 | 117 | 118 | System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 119 | 120 | 121 | 122 | ..\Driver\drv64.dll;System.Byte[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 123 | 124 | 125 | ..\Driver\kdu.exe;System.Byte[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 126 | 127 | 128 | ..\Driver\KsDumperDriver.sys;System.Byte[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 129 | 130 | 131 | ..\Driver\Taigei64.dll;System.Byte[], mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 132 | 133 | -------------------------------------------------------------------------------- /DriverInterface/Utility/Logger.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Diagnostics; 3 | using System.Runtime.CompilerServices; 4 | using System.Threading; 5 | 6 | namespace KsDumper11.Utility 7 | { 8 | // Token: 0x02000009 RID: 9 9 | public static class Logger 10 | { 11 | // Token: 0x14000001 RID: 1 12 | // (add) Token: 0x06000059 RID: 89 RVA: 0x00004500 File Offset: 0x00002700 13 | // (remove) Token: 0x0600005A RID: 90 RVA: 0x00004534 File Offset: 0x00002734 14 | public static event Action OnLog; 15 | 16 | // Token: 0x0600005B RID: 91 RVA: 0x00004568 File Offset: 0x00002768 17 | public static void SkipLine() 18 | { 19 | bool flag = Logger.OnLog != null; 20 | if (flag) 21 | { 22 | Logger.OnLog("\n"); 23 | } 24 | else 25 | { 26 | Console.WriteLine(); 27 | } 28 | } 29 | 30 | // Token: 0x0600005C RID: 92 RVA: 0x000045A0 File Offset: 0x000027A0 31 | public static void Log(string message, params object[] args) 32 | { 33 | message = string.Format("[{0}] {1}\n", DateTime.Now.ToLongTimeString(), string.Format(message, args)); 34 | bool flag = Logger.OnLog != null; 35 | if (flag) 36 | { 37 | Logger.OnLog(message); 38 | } 39 | else 40 | { 41 | Console.WriteLine(message); 42 | } 43 | } 44 | } 45 | } 46 | -------------------------------------------------------------------------------- /DriverInterface/Utility/MarshalUtility.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Runtime.InteropServices; 3 | 4 | namespace KsDumper11.Utility 5 | { 6 | // Token: 0x0200000A RID: 10 7 | public static class MarshalUtility 8 | { 9 | // Token: 0x0600005D RID: 93 RVA: 0x000045F4 File Offset: 0x000027F4 10 | public static IntPtr CopyStructToMemory(T obj) where T : struct 11 | { 12 | IntPtr unmanagedAddress = MarshalUtility.AllocEmptyStruct(); 13 | Marshal.StructureToPtr(obj, unmanagedAddress, true); 14 | return unmanagedAddress; 15 | } 16 | 17 | // Token: 0x0600005E RID: 94 RVA: 0x00004618 File Offset: 0x00002818 18 | public static IntPtr AllocEmptyStruct() where T : struct 19 | { 20 | int structSize = Marshal.SizeOf(); 21 | return MarshalUtility.AllocZeroFilled(Marshal.SizeOf()); 22 | } 23 | 24 | // Token: 0x0600005F RID: 95 RVA: 0x0000463C File Offset: 0x0000283C 25 | public static IntPtr AllocZeroFilled(int size) 26 | { 27 | IntPtr allocatedPointer = Marshal.AllocHGlobal(size); 28 | MarshalUtility.ZeroMemory(allocatedPointer, size); 29 | return allocatedPointer; 30 | } 31 | 32 | // Token: 0x06000060 RID: 96 RVA: 0x00004660 File Offset: 0x00002860 33 | public static void ZeroMemory(IntPtr pointer, int size) 34 | { 35 | for (int i = 0; i < size; i++) 36 | { 37 | Marshal.WriteByte(pointer + i, 0); 38 | } 39 | } 40 | 41 | // Token: 0x06000061 RID: 97 RVA: 0x00004690 File Offset: 0x00002890 42 | public static T GetStructFromMemory(IntPtr unmanagedAddress, bool freeMemory = true) where T : struct 43 | { 44 | T structObj = Marshal.PtrToStructure(unmanagedAddress); 45 | if (freeMemory) 46 | { 47 | Marshal.FreeHGlobal(unmanagedAddress); 48 | } 49 | return structObj; 50 | } 51 | } 52 | } 53 | -------------------------------------------------------------------------------- /DriverInterface/Utility/ProcessListView.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections; 3 | using System.Diagnostics; 4 | using System.Drawing; 5 | using System.IO; 6 | using System.Runtime.CompilerServices; 7 | using System.Runtime.InteropServices; 8 | using System.Windows.Forms; 9 | 10 | namespace KsDumper11.Utility 11 | { 12 | // Token: 0x0200000B RID: 11 13 | public class ProcessListView : ListView 14 | { 15 | // Token: 0x1700000D RID: 13 16 | // (get) Token: 0x06000062 RID: 98 RVA: 0x000046B8 File Offset: 0x000028B8 17 | // (set) Token: 0x06000063 RID: 99 RVA: 0x000046C0 File Offset: 0x000028C0 18 | public bool SystemProcessesHidden { get; set; } = true; 19 | 20 | // Token: 0x06000064 RID: 100 RVA: 0x000046C9 File Offset: 0x000028C9 21 | public ProcessListView() 22 | { 23 | base.OwnerDraw = true; 24 | this.DoubleBuffered = true; 25 | base.Sorting = SortOrder.Ascending; 26 | } 27 | 28 | // Token: 0x06000065 RID: 101 RVA: 0x000046F9 File Offset: 0x000028F9 29 | public void LoadProcesses(ProcessSummary[] processSummaries) 30 | { 31 | this.processCache = processSummaries; 32 | this.ReloadItems(); 33 | } 34 | 35 | // Token: 0x06000066 RID: 102 RVA: 0x0000470A File Offset: 0x0000290A 36 | public void ShowSystemProcesses() 37 | { 38 | this.SystemProcessesHidden = false; 39 | this.ReloadItems(); 40 | } 41 | 42 | // Token: 0x06000067 RID: 103 RVA: 0x0000471C File Offset: 0x0000291C 43 | public void HideSystemProcesses() 44 | { 45 | this.SystemProcessesHidden = true; 46 | this.ReloadItems(); 47 | } 48 | 49 | // Token: 0x06000068 RID: 104 RVA: 0x0000472E File Offset: 0x0000292E 50 | protected override void OnDrawItem(DrawListViewItemEventArgs e) 51 | { 52 | e.DrawDefault = true; 53 | } 54 | 55 | // Token: 0x06000069 RID: 105 RVA: 0x0000473C File Offset: 0x0000293C 56 | protected override void OnDrawColumnHeader(DrawListViewColumnHeaderEventArgs e) 57 | { 58 | e.DrawBackground(); 59 | using (StringFormat sf = new StringFormat()) 60 | { 61 | sf.Alignment = StringAlignment.Center; 62 | using (Font headerFont = new Font("Microsoft Sans Serif", 9f, FontStyle.Bold)) 63 | { 64 | e.Graphics.FillRectangle(new SolidBrush(this.BackColor), e.Bounds); 65 | e.Graphics.DrawString(e.Header.Text, headerFont, new SolidBrush(this.ForeColor), e.Bounds, sf); 66 | } 67 | } 68 | } 69 | 70 | // Token: 0x0600006A RID: 106 RVA: 0x000047F8 File Offset: 0x000029F8 71 | private void ReloadItems() 72 | { 73 | base.BeginUpdate(); 74 | int idx = 0; 75 | bool flag = base.SelectedIndices.Count > 0; 76 | if (flag) 77 | { 78 | idx = base.SelectedIndices[0]; 79 | bool flag2 = idx == -1; 80 | if (flag2) 81 | { 82 | idx = 0; 83 | } 84 | } 85 | base.Items.Clear(); 86 | string systemRootFolder = Environment.GetFolderPath(Environment.SpecialFolder.Windows).ToLower(); 87 | foreach (ProcessSummary processSummary in this.processCache) 88 | { 89 | bool flag3 = this.SystemProcessesHidden && (processSummary.MainModuleFileName.ToLower().StartsWith(systemRootFolder) || processSummary.MainModuleFileName.StartsWith("\\")); 90 | if (!flag3) 91 | { 92 | ListViewItem lvi = new ListViewItem(processSummary.ProcessId.ToString()); 93 | lvi.BackColor = this.BackColor; 94 | lvi.ForeColor = this.ForeColor; 95 | lvi.SubItems.Add(Path.GetFileName(processSummary.MainModuleFileName)); 96 | lvi.SubItems.Add(processSummary.MainModuleFileName); 97 | lvi.SubItems.Add(string.Format("0x{0:x8}", processSummary.MainModuleBase)); 98 | lvi.SubItems.Add(string.Format("0x{0:x8}", processSummary.MainModuleEntryPoint)); 99 | lvi.SubItems.Add(string.Format("0x{0:x4}", processSummary.MainModuleImageSize)); 100 | lvi.SubItems.Add(processSummary.IsWOW64 ? "x86" : "x64"); 101 | lvi.Tag = processSummary; 102 | base.Items.Add(lvi); 103 | } 104 | } 105 | base.ListViewItemSorter = new ProcessListView.ProcessListViewItemComparer(this.sortColumnIndex, base.Sorting); 106 | base.Sort(); 107 | base.Items[idx].Selected = true; 108 | base.EndUpdate(); 109 | } 110 | 111 | // Token: 0x0600006B RID: 107 RVA: 0x000049FC File Offset: 0x00002BFC 112 | protected override void OnColumnClick(ColumnClickEventArgs e) 113 | { 114 | bool flag = e.Column != this.sortColumnIndex; 115 | if (flag) 116 | { 117 | this.sortColumnIndex = e.Column; 118 | base.Sorting = SortOrder.Ascending; 119 | } 120 | else 121 | { 122 | bool flag2 = base.Sorting == SortOrder.Ascending; 123 | if (flag2) 124 | { 125 | base.Sorting = SortOrder.Descending; 126 | } 127 | else 128 | { 129 | base.Sorting = SortOrder.Ascending; 130 | } 131 | } 132 | base.ListViewItemSorter = new ProcessListView.ProcessListViewItemComparer(e.Column, base.Sorting); 133 | base.Sort(); 134 | } 135 | 136 | // Token: 0x0600006C RID: 108 RVA: 0x00004A7C File Offset: 0x00002C7C 137 | protected override void WndProc(ref Message m) 138 | { 139 | bool flag = m.Msg == 1; 140 | if (flag) 141 | { 142 | } 143 | base.WndProc(ref m); 144 | } 145 | 146 | // Token: 0x0600006D RID: 109 147 | [DllImport("uxtheme.dll", CharSet = CharSet.Unicode)] 148 | private static extern int SetWindowTheme(IntPtr hWnd, string pszSubAppName, string pszSubIdList); 149 | 150 | // Token: 0x0400003C RID: 60 151 | private int sortColumnIndex = 1; 152 | 153 | // Token: 0x0400003D RID: 61 154 | private ProcessSummary[] processCache; 155 | 156 | // Token: 0x02000025 RID: 37 157 | private class ProcessListViewItemComparer : IComparer 158 | { 159 | // Token: 0x060000F3 RID: 243 RVA: 0x000063F0 File Offset: 0x000045F0 160 | public ProcessListViewItemComparer(int columnIndex, SortOrder sortOrder) 161 | { 162 | this.columnIndex = columnIndex; 163 | this.sortOrder = sortOrder; 164 | } 165 | 166 | // Token: 0x060000F4 RID: 244 RVA: 0x00006408 File Offset: 0x00004608 167 | public int Compare(object x, object y) 168 | { 169 | bool flag = x is ListViewItem && y is ListViewItem; 170 | if (flag) 171 | { 172 | ProcessSummary p = ((ListViewItem)x).Tag as ProcessSummary; 173 | ProcessSummary p2 = ((ListViewItem)y).Tag as ProcessSummary; 174 | bool flag2 = p != null && p2 != null; 175 | if (flag2) 176 | { 177 | int result = 0; 178 | switch (this.columnIndex) 179 | { 180 | case 0: 181 | result = p.ProcessId.CompareTo(p2.ProcessId); 182 | break; 183 | case 1: 184 | result = p.ProcessName.CompareTo(p2.ProcessName); 185 | break; 186 | case 2: 187 | result = p.MainModuleFileName.CompareTo(p2.MainModuleFileName); 188 | break; 189 | case 3: 190 | result = p.MainModuleBase.CompareTo(p2.MainModuleBase); 191 | break; 192 | case 4: 193 | result = p.MainModuleEntryPoint.CompareTo(p2.MainModuleEntryPoint); 194 | break; 195 | case 5: 196 | result = p.MainModuleImageSize.CompareTo(p2.MainModuleImageSize); 197 | break; 198 | case 6: 199 | result = p.IsWOW64.CompareTo(p2.IsWOW64); 200 | break; 201 | } 202 | bool flag3 = this.sortOrder == SortOrder.Descending; 203 | if (flag3) 204 | { 205 | result = -result; 206 | } 207 | return result; 208 | } 209 | } 210 | return 0; 211 | } 212 | 213 | // Token: 0x040000B8 RID: 184 214 | private readonly int columnIndex; 215 | 216 | // Token: 0x040000B9 RID: 185 217 | private readonly SortOrder sortOrder; 218 | } 219 | } 220 | } 221 | -------------------------------------------------------------------------------- /DriverInterface/Utility/WinApi.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.IO; 3 | using System.Runtime.InteropServices; 4 | using System.Text; 5 | 6 | namespace KsDumper11.Utility 7 | { 8 | public static class WinApi 9 | { 10 | [DllImport("kernel32.dll")] 11 | public static extern int CloseHandle(IntPtr handle); 12 | 13 | [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)] 14 | public static extern IntPtr CreateFileA([MarshalAs(UnmanagedType.LPStr)] string filename, [MarshalAs(UnmanagedType.U4)] FileAccess access, [MarshalAs(UnmanagedType.U4)] FileShare share, IntPtr securityAttributes, [MarshalAs(UnmanagedType.U4)] FileMode creationDisposition, [MarshalAs(UnmanagedType.U4)] FileAttributes flagsAndAttributes, IntPtr templateFile); 15 | 16 | [DllImport("kernel32.dll", CharSet = CharSet.Auto, ExactSpelling = true, SetLastError = true)] 17 | public static extern bool DeviceIoControl(IntPtr hDevice, uint dwIoControlCode, IntPtr lpInBuffer, int nInBufferSize, IntPtr lpOutBuffer, int nOutBufferSize, IntPtr lpBytesReturned, IntPtr lpOverlapped); 18 | 19 | [DllImport("kernel32.dll")] 20 | public static extern int GetLongPathName(string path, StringBuilder pszPath, int cchPath); 21 | 22 | public static readonly int FILE_DEVICE_UNKNOWN = 34; 23 | 24 | public static readonly int METHOD_BUFFERED = 0; 25 | 26 | public static readonly int FILE_ANY_ACCESS = 0; 27 | 28 | public static readonly IntPtr INVALID_HANDLE_VALUE = new IntPtr(-1); 29 | 30 | 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /DriverInterface/packages.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /KsDumper11.sln: -------------------------------------------------------------------------------- 1 |  2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio Version 17 4 | VisualStudioVersion = 17.4.33205.214 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "KsDumper11", "KsDumper11\KsDumper11.csproj", "{7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}" 7 | EndProject 8 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DarkControls", "DarkControls\DarkControls.csproj", "{66C94ACB-63C7-42A3-9D83-A3801CED4F1C}" 9 | EndProject 10 | Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{79B0AE0A-4D49-4102-9971-04F5375BF272}" 11 | ProjectSection(SolutionItems) = preProject 12 | README.md = README.md 13 | EndProjectSection 14 | EndProject 15 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "KsDumperDriver", "KsDumperDriver\KsDumperDriver.vcxproj", "{8EADAB93-F111-43AF-9E10-2376AE515491}" 16 | EndProject 17 | Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DriverInterface", "DriverInterface\DriverInterface.csproj", "{6F8B2A35-060D-4EB1-A6BA-A3057179304B}" 18 | EndProject 19 | Global 20 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 21 | Debug|Any CPU = Debug|Any CPU 22 | Debug|x64 = Debug|x64 23 | Debug|x86 = Debug|x86 24 | Release|Any CPU = Release|Any CPU 25 | Release|x64 = Release|x64 26 | Release|x86 = Release|x86 27 | EndGlobalSection 28 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 29 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 30 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Debug|Any CPU.Build.0 = Debug|Any CPU 31 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Debug|x64.ActiveCfg = Debug|x64 32 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Debug|x64.Build.0 = Debug|x64 33 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Debug|x86.ActiveCfg = Debug|x86 34 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Debug|x86.Build.0 = Debug|x86 35 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Release|Any CPU.ActiveCfg = Release|Any CPU 36 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Release|Any CPU.Build.0 = Release|Any CPU 37 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Release|x64.ActiveCfg = Release|x64 38 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Release|x64.Build.0 = Release|x64 39 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Release|x86.ActiveCfg = Release|x86 40 | {7881B99D-0B5A-44E7-AF34-80A0ECFFD5DB}.Release|x86.Build.0 = Release|x86 41 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 42 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Debug|Any CPU.Build.0 = Debug|Any CPU 43 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Debug|x64.ActiveCfg = Debug|x64 44 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Debug|x64.Build.0 = Debug|x64 45 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Debug|x86.ActiveCfg = Debug|Any CPU 46 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Debug|x86.Build.0 = Debug|Any CPU 47 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Release|Any CPU.ActiveCfg = Release|Any CPU 48 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Release|Any CPU.Build.0 = Release|Any CPU 49 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Release|x64.ActiveCfg = Release|x64 50 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Release|x64.Build.0 = Release|x64 51 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Release|x86.ActiveCfg = Release|x86 52 | {66C94ACB-63C7-42A3-9D83-A3801CED4F1C}.Release|x86.Build.0 = Release|x86 53 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Debug|Any CPU.ActiveCfg = Debug|x64 54 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Debug|Any CPU.Build.0 = Debug|x64 55 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Debug|x64.ActiveCfg = Debug|x64 56 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Debug|x64.Build.0 = Debug|x64 57 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Debug|x86.ActiveCfg = Debug|x64 58 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Debug|x86.Build.0 = Debug|x64 59 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Release|Any CPU.ActiveCfg = Release|x64 60 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Release|Any CPU.Build.0 = Release|x64 61 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Release|x64.ActiveCfg = Release|x64 62 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Release|x64.Build.0 = Release|x64 63 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Release|x86.ActiveCfg = Release|x64 64 | {8EADAB93-F111-43AF-9E10-2376AE515491}.Release|x86.Build.0 = Release|x64 65 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU 66 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Debug|Any CPU.Build.0 = Debug|Any CPU 67 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Debug|x64.ActiveCfg = Debug|Any CPU 68 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Debug|x64.Build.0 = Debug|Any CPU 69 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Debug|x86.ActiveCfg = Debug|Any CPU 70 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Debug|x86.Build.0 = Debug|Any CPU 71 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Release|Any CPU.ActiveCfg = Release|Any CPU 72 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Release|Any CPU.Build.0 = Release|Any CPU 73 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Release|x64.ActiveCfg = Release|Any CPU 74 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Release|x64.Build.0 = Release|Any CPU 75 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Release|x86.ActiveCfg = Release|Any CPU 76 | {6F8B2A35-060D-4EB1-A6BA-A3057179304B}.Release|x86.Build.0 = Release|Any CPU 77 | EndGlobalSection 78 | GlobalSection(SolutionProperties) = preSolution 79 | HideSolutionNode = FALSE 80 | EndGlobalSection 81 | GlobalSection(ExtensibilityGlobals) = postSolution 82 | SolutionGuid = {EBFFF900-7478-45AA-95F6-F453BC9C3035} 83 | EndGlobalSection 84 | EndGlobal 85 | -------------------------------------------------------------------------------- /KsDumper11/Default.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/KsDumper11/Default.ico -------------------------------------------------------------------------------- /KsDumper11/Driver/KsDumperDriver.sys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/KsDumper11/Driver/KsDumperDriver.sys -------------------------------------------------------------------------------- /KsDumper11/Driver/ManualLoader.bat: -------------------------------------------------------------------------------- 1 | kdu.exe -prv 1 -map KsDumperDriver.sys 2 | pause -------------------------------------------------------------------------------- /KsDumper11/Driver/Taigei64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/KsDumper11/Driver/Taigei64.dll -------------------------------------------------------------------------------- /KsDumper11/Driver/drv64.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/KsDumper11/Driver/drv64.dll -------------------------------------------------------------------------------- /KsDumper11/Driver/kdu.exe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/KsDumper11/Driver/kdu.exe -------------------------------------------------------------------------------- /KsDumper11/JsonSettings.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | 7 | namespace KsDumper11 8 | { 9 | public class JsonSettings 10 | { 11 | public bool closeDriverOnExit { get; set; } 12 | 13 | public bool enableAntiAntiDebuggerTools { get; set; } 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /KsDumper11/JsonSettingsManager.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.IO; 4 | using System.Linq; 5 | using System.Reflection; 6 | using System.Text; 7 | using System.Threading.Tasks; 8 | using Newtonsoft.Json; 9 | using Newtonsoft.Json.Bson; 10 | 11 | namespace KsDumper11 12 | { 13 | public class JsonSettingsManager 14 | { 15 | public JsonSettings JsonSettings { get; set; } 16 | 17 | private string settingsFilePath; 18 | public JsonSettingsManager() 19 | { 20 | settingsFilePath = Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location) + @"\Settings.json"; 21 | CreateOrLoadSettingsJson(); 22 | } 23 | 24 | private void CreateOrLoadSettingsJson() 25 | { 26 | if (File.Exists(settingsFilePath)) 27 | { 28 | // Load settings json 29 | string settingsJsonText = File.ReadAllText(settingsFilePath); 30 | JsonSettings = JsonConvert.DeserializeObject(settingsJsonText); 31 | } 32 | else 33 | { 34 | // Populate and save default settings json 35 | JsonSettings = new JsonSettings(); 36 | JsonSettings.enableAntiAntiDebuggerTools = false; 37 | JsonSettings.closeDriverOnExit = false; 38 | 39 | string settingsJsonText = JsonConvert.SerializeObject(JsonSettings, Formatting.Indented); 40 | File.WriteAllText(settingsFilePath, settingsJsonText); 41 | } 42 | } 43 | 44 | public void Save() 45 | { 46 | string settingsJsonText = JsonConvert.SerializeObject(JsonSettings, Formatting.Indented); 47 | File.WriteAllText(settingsFilePath, settingsJsonText); 48 | } 49 | } 50 | } 51 | -------------------------------------------------------------------------------- /KsDumper11/LabelDrawer.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Drawing; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using System.Windows.Forms; 8 | using static System.Windows.Forms.VisualStyles.VisualStyleElement.Button; 9 | 10 | namespace KsDumper11 11 | { 12 | public struct LabelInfo 13 | { 14 | public Font Font; 15 | public Point Location; 16 | public string Text; 17 | public string Name; 18 | public bool Visible; 19 | } 20 | 21 | public class LabelDrawer 22 | { 23 | private Form ParentForm; 24 | public LabelInfo[] labelInfos; 25 | 26 | public LabelDrawer(Form parentFrm) 27 | { 28 | ParentForm = parentFrm; 29 | ParentForm.Paint += ParentForm_Paint; 30 | 31 | List labelsToRemove = new List(); 32 | List infos = new List(); 33 | 34 | foreach (Control ctrl in ParentForm.Controls) 35 | { 36 | if (ctrl is System.Windows.Forms.Label) 37 | { 38 | LabelInfo labelInfo = new LabelInfo(); 39 | labelInfo.Text = ctrl.Text; 40 | labelInfo.Font = ctrl.Font; 41 | labelInfo.Location = ctrl.Location; 42 | labelInfo.Name = ctrl.Name; 43 | labelInfo.Visible = ctrl.Visible; 44 | 45 | infos.Add(labelInfo); 46 | labelsToRemove.Add(ctrl); 47 | continue; 48 | } 49 | } 50 | 51 | labelInfos = infos.ToArray(); 52 | 53 | foreach (Control ctrl in labelsToRemove) 54 | { 55 | ParentForm.Controls.Remove(ctrl); 56 | ctrl.Dispose(); 57 | } 58 | } 59 | 60 | private void ParentForm_Paint(object sender, PaintEventArgs e) 61 | { 62 | foreach (LabelInfo labelInfo in labelInfos) 63 | { 64 | if (labelInfo.Visible) 65 | { 66 | PointF location = new PointF(labelInfo.Location.X, (labelInfo.Location.Y)); 67 | 68 | // Draw the text on the form 69 | e.Graphics.DrawString(labelInfo.Text, labelInfo.Font, Brushes.Silver, location); 70 | } 71 | } 72 | } 73 | } 74 | } 75 | -------------------------------------------------------------------------------- /KsDumper11/ProcessSummary.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Diagnostics; 3 | using System.IO; 4 | using System.Runtime.CompilerServices; 5 | using System.Text; 6 | using KsDumper11.Driver; 7 | using KsDumper11.Utility; 8 | 9 | namespace KsDumper11 10 | { 11 | // Token: 0x02000004 RID: 4 12 | public class ProcessSummary 13 | { 14 | // Token: 0x17000002 RID: 2 15 | // (get) Token: 0x06000039 RID: 57 RVA: 0x00004089 File Offset: 0x00002289 16 | // (set) Token: 0x0600003A RID: 58 RVA: 0x00004091 File Offset: 0x00002291 17 | public int ProcessId { get; set; } 18 | 19 | // Token: 0x17000003 RID: 3 20 | // (get) Token: 0x0600003B RID: 59 RVA: 0x0000409A File Offset: 0x0000229A 21 | // (set) Token: 0x0600003C RID: 60 RVA: 0x000040A2 File Offset: 0x000022A2 22 | public string ProcessName { get; set; } 23 | 24 | // Token: 0x17000004 RID: 4 25 | // (get) Token: 0x0600003D RID: 61 RVA: 0x000040AB File Offset: 0x000022AB 26 | // (set) Token: 0x0600003E RID: 62 RVA: 0x000040B3 File Offset: 0x000022B3 27 | public ulong MainModuleBase { get; set; } 28 | 29 | // Token: 0x17000005 RID: 5 30 | // (get) Token: 0x0600003F RID: 63 RVA: 0x000040BC File Offset: 0x000022BC 31 | // (set) Token: 0x06000040 RID: 64 RVA: 0x000040C4 File Offset: 0x000022C4 32 | public string MainModuleFileName { get; set; } 33 | 34 | // Token: 0x17000006 RID: 6 35 | // (get) Token: 0x06000041 RID: 65 RVA: 0x000040CD File Offset: 0x000022CD 36 | // (set) Token: 0x06000042 RID: 66 RVA: 0x000040D5 File Offset: 0x000022D5 37 | public uint MainModuleImageSize { get; set; } 38 | 39 | // Token: 0x17000007 RID: 7 40 | // (get) Token: 0x06000043 RID: 67 RVA: 0x000040DE File Offset: 0x000022DE 41 | // (set) Token: 0x06000044 RID: 68 RVA: 0x000040E6 File Offset: 0x000022E6 42 | public ulong MainModuleEntryPoint { get; set; } 43 | 44 | // Token: 0x17000008 RID: 8 45 | // (get) Token: 0x06000045 RID: 69 RVA: 0x000040EF File Offset: 0x000022EF 46 | // (set) Token: 0x06000046 RID: 70 RVA: 0x000040F7 File Offset: 0x000022F7 47 | public bool IsWOW64 { get; set; } 48 | 49 | // Token: 0x06000047 RID: 71 RVA: 0x00004100 File Offset: 0x00002300 50 | public static ProcessSummary ProcessSummaryFromID(DriverInterface driver, string processName) 51 | { 52 | ProcessSummary result = null; 53 | ProcessSummary[] processes; 54 | driver.GetProcessSummaryList(out processes); 55 | bool flag = processes != null; 56 | if (flag) 57 | { 58 | foreach (ProcessSummary process in processes) 59 | { 60 | bool flag2 = process.ProcessName.ToLower().Contains(processName.ToLower()); 61 | if (flag2) 62 | { 63 | Logger.Log(process.ProcessName + " " + processName, Array.Empty()); 64 | return process; 65 | } 66 | } 67 | } 68 | return result; 69 | } 70 | 71 | // Token: 0x06000048 RID: 72 RVA: 0x0000418C File Offset: 0x0000238C 72 | private ProcessSummary(int processId, ulong mainModuleBase, string mainModuleFileName, uint mainModuleImageSize, ulong mainModuleEntryPoint, bool isWOW64) 73 | { 74 | this.ProcessId = processId; 75 | this.MainModuleBase = mainModuleBase; 76 | this.MainModuleFileName = this.FixFileName(mainModuleFileName); 77 | this.MainModuleImageSize = mainModuleImageSize; 78 | this.MainModuleEntryPoint = mainModuleEntryPoint; 79 | this.ProcessName = Path.GetFileName(this.MainModuleFileName); 80 | this.IsWOW64 = isWOW64; 81 | } 82 | 83 | // Token: 0x06000049 RID: 73 RVA: 0x000041EC File Offset: 0x000023EC 84 | private string FixFileName(string fileName) 85 | { 86 | bool flag = fileName.StartsWith("\\"); 87 | string text; 88 | if (flag) 89 | { 90 | text = fileName; 91 | } 92 | else 93 | { 94 | StringBuilder sb = new StringBuilder(256); 95 | int length = WinApi.GetLongPathName(fileName, sb, sb.Capacity); 96 | bool flag2 = length > sb.Capacity; 97 | if (flag2) 98 | { 99 | sb.Capacity = length; 100 | length = WinApi.GetLongPathName(fileName, sb, sb.Capacity); 101 | } 102 | text = sb.ToString(); 103 | } 104 | return text; 105 | } 106 | 107 | // Token: 0x0600004A RID: 74 RVA: 0x00004258 File Offset: 0x00002458 108 | public static ProcessSummary FromStream(BinaryReader reader) 109 | { 110 | return new ProcessSummary(reader.ReadInt32(), reader.ReadUInt64(), Encoding.Unicode.GetString(reader.ReadBytes(512)).Split(new char[1])[0], reader.ReadUInt32(), reader.ReadUInt64(), reader.ReadBoolean()); 111 | } 112 | } 113 | } 114 | -------------------------------------------------------------------------------- /KsDumper11/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Diagnostics; 3 | using System.IO; 4 | using System.Reflection; 5 | using System.Runtime.CompilerServices; 6 | using System.Windows.Forms; 7 | using KsDumper11.Driver; 8 | 9 | namespace KsDumper11 10 | { 11 | public class Program 12 | { 13 | static string exeName = "KsDumper11.exe"; 14 | 15 | public static bool ProviderIsClosing = false; 16 | 17 | static JsonSettingsManager settingsManager; 18 | 19 | static void runSnifferBypass() 20 | { 21 | string asmPath = Assembly.GetExecutingAssembly().Location; 22 | string directory = Path.GetDirectoryName(asmPath); 23 | 24 | string fileName = Path.GetFileName(asmPath); 25 | string newFile = SnifferBypass.GenerateRandomString(12) + ".exe"; 26 | string newFileName = Path.Combine(directory, newFile); 27 | //Debugger.Break(); 28 | if (fileName == exeName) 29 | { 30 | // Rename the current file to the specified new file name and execute it 31 | ProcessStartInfo renameAndExecuteProcessInfo = new ProcessStartInfo(); 32 | renameAndExecuteProcessInfo.FileName = "cmd.exe"; 33 | renameAndExecuteProcessInfo.Arguments = $"/c timeout 3 > NUL && ren \"{asmPath}\" \"{newFile}\" && \"{newFileName}\""; 34 | renameAndExecuteProcessInfo.UseShellExecute = true; 35 | renameAndExecuteProcessInfo.CreateNoWindow = true; 36 | renameAndExecuteProcessInfo.WindowStyle = ProcessWindowStyle.Hidden; 37 | 38 | Process renameAndExecuteProcess = new Process(); 39 | renameAndExecuteProcess.StartInfo = renameAndExecuteProcessInfo; 40 | renameAndExecuteProcess.Start(); 41 | 42 | Environment.Exit(0); 43 | } 44 | else 45 | { 46 | Application.ApplicationExit += Application_ApplicationExit; 47 | } 48 | } 49 | 50 | private static void Application_ApplicationExit(object sender, EventArgs e) 51 | { 52 | if (!ProviderIsClosing) 53 | { 54 | string asmPath = Assembly.GetExecutingAssembly().Location; 55 | string directory = Path.GetDirectoryName(asmPath); 56 | 57 | string fileName = Path.GetFileName(asmPath); 58 | string newFile = SnifferBypass.GenerateRandomString(12) + ".exe"; 59 | string newFileName = Path.Combine(directory, exeName); 60 | 61 | if (fileName != exeName) 62 | { 63 | ProcessStartInfo renameAndExecuteProcessInfo = new ProcessStartInfo(); 64 | renameAndExecuteProcessInfo.FileName = "cmd.exe"; 65 | renameAndExecuteProcessInfo.Arguments = $"/c timeout 2 > NUL && ren \"{asmPath}\" \"{exeName}\""; 66 | renameAndExecuteProcessInfo.UseShellExecute = false; 67 | renameAndExecuteProcessInfo.CreateNoWindow = true; 68 | renameAndExecuteProcessInfo.WindowStyle = ProcessWindowStyle.Hidden; 69 | 70 | Process renameAndExecuteProcess = new Process(); 71 | renameAndExecuteProcess.StartInfo = renameAndExecuteProcessInfo; 72 | renameAndExecuteProcess.Start(); 73 | } 74 | } 75 | else 76 | { 77 | ProviderIsClosing = false; 78 | } 79 | } 80 | 81 | [STAThread] 82 | private static void Main() 83 | { 84 | settingsManager = new JsonSettingsManager(); 85 | 86 | if (settingsManager.JsonSettings.enableAntiAntiDebuggerTools) 87 | { 88 | runSnifferBypass(); 89 | } 90 | 91 | KduSelfExtract.DisableDriverBlockList(); 92 | 93 | KduSelfExtract.Extract(); 94 | 95 | Application.EnableVisualStyles(); 96 | Application.SetCompatibleTextRenderingDefault(false); 97 | 98 | bool driverOpen = KsDumperDriverInterface.IsDriverOpen("\\\\.\\KsDumper"); 99 | //Debugger.Break(); 100 | if (!driverOpen) 101 | { 102 | if (!File.Exists(KduSelfExtract.AssemblyDirectory + @"\\Providers.json")) 103 | { 104 | // Run the selector here to populate the providers and set a default provider. 105 | Application.Run(new ProviderSelector()); 106 | Application.Run(new DumperForm()); 107 | } 108 | else 109 | { 110 | KduWrapper wr = new KduWrapper(KduSelfExtract.AssemblyDirectory + @"\Driver\kdu.exe"); 111 | wr.LoadProviders(); 112 | 113 | if (wr.DefaultProvider != -1) 114 | { 115 | wr.Start(); 116 | 117 | if (KsDumperDriverInterface.IsDriverOpen("\\\\.\\KsDumper")) 118 | { 119 | Application.Run(new DumperForm()); 120 | } 121 | else 122 | { 123 | Environment.Exit(0); 124 | } 125 | } 126 | else 127 | { 128 | // Run the selector here to populate the providers and set a default provider. 129 | Application.Run(new ProviderSelector()); 130 | 131 | if (KsDumperDriverInterface.IsDriverOpen("\\\\.\\KsDumper")) 132 | { 133 | Application.Run(new DumperForm()); 134 | } 135 | else 136 | { 137 | Environment.Exit(0); 138 | } 139 | } 140 | } 141 | } 142 | else 143 | { 144 | Application.Run(new DumperForm()); 145 | Environment.Exit(0); 146 | } 147 | } 148 | } 149 | } 150 | -------------------------------------------------------------------------------- /KsDumper11/Properties/AssemblyInfo.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Diagnostics; 3 | using System.Reflection; 4 | using System.Runtime.CompilerServices; 5 | using System.Runtime.InteropServices; 6 | using System.Runtime.Versioning; 7 | 8 | [assembly: AssemblyVersion("1.3.4")] 9 | [assembly: AssemblyTitle("KsDumper 11")] 10 | [assembly: AssemblyDescription("Dump processes from kernel space!")] 11 | [assembly: AssemblyConfiguration("")] 12 | [assembly: AssemblyCompany("Codeon Inc")] 13 | [assembly: AssemblyProduct("KsDumper")] 14 | [assembly: AssemblyCopyright("")] 15 | [assembly: AssemblyTrademark("")] 16 | [assembly: ComVisible(false)] 17 | [assembly: Guid("7881b99d-0b5a-44e7-af34-80a0ecffd5db")] 18 | [assembly: AssemblyFileVersion("1.3.4")] 19 | -------------------------------------------------------------------------------- /KsDumper11/Properties/Resources.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // This code was generated by a tool. 4 | // Runtime Version:4.0.30319.42000 5 | // 6 | // Changes to this file may cause incorrect behavior and will be lost if 7 | // the code is regenerated. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace KsDumper11.Properties { 12 | using System; 13 | 14 | 15 | /// 16 | /// A strongly-typed resource class, for looking up localized strings, etc. 17 | /// 18 | // This class was auto-generated by the StronglyTypedResourceBuilder 19 | // class via a tool like ResGen or Visual Studio. 20 | // To add or remove a member, edit your .ResX file then rerun ResGen 21 | // with the /str option, or rebuild your VS project. 22 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("System.Resources.Tools.StronglyTypedResourceBuilder", "17.0.0.0")] 23 | [global::System.Diagnostics.DebuggerNonUserCodeAttribute()] 24 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 25 | internal class Resources { 26 | 27 | private static global::System.Resources.ResourceManager resourceMan; 28 | 29 | private static global::System.Globalization.CultureInfo resourceCulture; 30 | 31 | [global::System.Diagnostics.CodeAnalysis.SuppressMessageAttribute("Microsoft.Performance", "CA1811:AvoidUncalledPrivateCode")] 32 | internal Resources() { 33 | } 34 | 35 | /// 36 | /// Returns the cached ResourceManager instance used by this class. 37 | /// 38 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 39 | internal static global::System.Resources.ResourceManager ResourceManager { 40 | get { 41 | if (object.ReferenceEquals(resourceMan, null)) { 42 | global::System.Resources.ResourceManager temp = new global::System.Resources.ResourceManager("KsDumper11.Properties.Resources", typeof(Resources).Assembly); 43 | resourceMan = temp; 44 | } 45 | return resourceMan; 46 | } 47 | } 48 | 49 | /// 50 | /// Overrides the current thread's CurrentUICulture property for all 51 | /// resource lookups using this strongly typed resource class. 52 | /// 53 | [global::System.ComponentModel.EditorBrowsableAttribute(global::System.ComponentModel.EditorBrowsableState.Advanced)] 54 | internal static global::System.Globalization.CultureInfo Culture { 55 | get { 56 | return resourceCulture; 57 | } 58 | set { 59 | resourceCulture = value; 60 | } 61 | } 62 | 63 | /// 64 | /// Looks up a localized resource of type System.Drawing.Bitmap. 65 | /// 66 | internal static System.Drawing.Bitmap icons8_crossed_axes_100 { 67 | get { 68 | object obj = ResourceManager.GetObject("icons8_crossed_axes_100", resourceCulture); 69 | return ((System.Drawing.Bitmap)(obj)); 70 | } 71 | } 72 | } 73 | } 74 | -------------------------------------------------------------------------------- /KsDumper11/Properties/Resources.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.CodeDom.Compiler; 3 | using System.ComponentModel; 4 | using System.Diagnostics; 5 | using System.Drawing; 6 | using System.Globalization; 7 | using System.Resources; 8 | using System.Runtime.CompilerServices; 9 | 10 | namespace KsDumperClient.Properties 11 | { 12 | // Token: 0x02000006 RID: 6 13 | [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "17.0.0.0")] 14 | [DebuggerNonUserCode] 15 | [CompilerGenerated] 16 | internal class Resources 17 | { 18 | // Token: 0x0600004D RID: 77 RVA: 0x00004406 File Offset: 0x00002606 19 | internal Resources() 20 | { 21 | } 22 | 23 | // Token: 0x17000009 RID: 9 24 | // (get) Token: 0x0600004E RID: 78 RVA: 0x00004410 File Offset: 0x00002610 25 | [EditorBrowsable(EditorBrowsableState.Advanced)] 26 | internal static ResourceManager ResourceManager 27 | { 28 | get 29 | { 30 | bool flag = Resources.resourceMan == null; 31 | if (flag) 32 | { 33 | ResourceManager temp = new ResourceManager("KsDumperClient.Properties.Resources", typeof(Resources).Assembly); 34 | Resources.resourceMan = temp; 35 | } 36 | return Resources.resourceMan; 37 | } 38 | } 39 | 40 | // Token: 0x1700000A RID: 10 41 | // (get) Token: 0x0600004F RID: 79 RVA: 0x00004458 File Offset: 0x00002658 42 | // (set) Token: 0x06000050 RID: 80 RVA: 0x0000446F File Offset: 0x0000266F 43 | [EditorBrowsable(EditorBrowsableState.Advanced)] 44 | internal static CultureInfo Culture 45 | { 46 | get 47 | { 48 | return Resources.resourceCulture; 49 | } 50 | set 51 | { 52 | Resources.resourceCulture = value; 53 | } 54 | } 55 | 56 | // Token: 0x1700000B RID: 11 57 | // (get) Token: 0x06000051 RID: 81 RVA: 0x00004478 File Offset: 0x00002678 58 | internal static Bitmap icons8_crossed_axes_100 59 | { 60 | get 61 | { 62 | object obj = Resources.ResourceManager.GetObject("icons8_crossed_axes_100", Resources.resourceCulture); 63 | return (Bitmap)obj; 64 | } 65 | } 66 | 67 | // Token: 0x04000033 RID: 51 68 | private static ResourceManager resourceMan; 69 | 70 | // Token: 0x04000034 RID: 52 71 | private static CultureInfo resourceCulture; 72 | } 73 | } 74 | -------------------------------------------------------------------------------- /KsDumper11/Properties/Resources.resources: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/KsDumper11/Properties/Resources.resources -------------------------------------------------------------------------------- /KsDumper11/Properties/Resources.resx: -------------------------------------------------------------------------------- 1 |  2 | 3 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | text/microsoft-resx 110 | 111 | 112 | 2.0 113 | 114 | 115 | System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 116 | 117 | 118 | System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 119 | 120 | 121 | 122 | ..\icons8-crossed-axes-100.png;System.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a 123 | 124 | -------------------------------------------------------------------------------- /KsDumper11/Properties/Settings.Designer.cs: -------------------------------------------------------------------------------- 1 | //------------------------------------------------------------------------------ 2 | // 3 | // This code was generated by a tool. 4 | // Runtime Version:4.0.30319.42000 5 | // 6 | // Changes to this file may cause incorrect behavior and will be lost if 7 | // the code is regenerated. 8 | // 9 | //------------------------------------------------------------------------------ 10 | 11 | namespace KsDumper11.Properties { 12 | 13 | 14 | [global::System.Runtime.CompilerServices.CompilerGeneratedAttribute()] 15 | [global::System.CodeDom.Compiler.GeneratedCodeAttribute("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "17.8.0.0")] 16 | internal sealed partial class Settings : global::System.Configuration.ApplicationSettingsBase { 17 | 18 | private static Settings defaultInstance = ((Settings)(global::System.Configuration.ApplicationSettingsBase.Synchronized(new Settings()))); 19 | 20 | public static Settings Default { 21 | get { 22 | return defaultInstance; 23 | } 24 | } 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /KsDumper11/Properties/Settings.settings: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | -------------------------------------------------------------------------------- /KsDumper11/SnifferBypass.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Diagnostics; 4 | using System.IO; 5 | using System.Linq; 6 | using System.Runtime.InteropServices; 7 | using System.Text; 8 | using System.Threading.Tasks; 9 | 10 | namespace KsDumper11 11 | { 12 | public class SnifferBypass 13 | { 14 | [DllImport("user32.dll", SetLastError = true, CharSet = CharSet.Unicode)] 15 | private static extern bool SetWindowText(IntPtr hWnd, string lpString); 16 | 17 | [DllImport("user32.dll", SetLastError = true)] 18 | private static extern IntPtr FindWindow(string lpClassName, string lpWindowName); 19 | 20 | public string FilePath { get; set; } 21 | private string renamedPath = ""; 22 | 23 | public static void SelfTitle(IntPtr hWnd) 24 | { 25 | bool result = SetWindowText(hWnd, GenerateRandomString(12)); 26 | } 27 | 28 | public SnifferBypass(string filePath) 29 | { 30 | FilePath = filePath; 31 | } 32 | 33 | public static string GenerateRandomString(int length) 34 | { 35 | const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; 36 | Random random = new Random(); 37 | return new string(Enumerable.Repeat(chars, length).Select(s => s[random.Next(s.Length)]).ToArray()); 38 | } 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /KsDumper11/StartDriver.cs: -------------------------------------------------------------------------------- 1 | using KsDumper11.Driver; 2 | using System; 3 | using System.Collections.Generic; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading.Tasks; 7 | using System.IO; 8 | 9 | namespace KsDumper11 10 | { 11 | public class StartDriver 12 | { 13 | public static void Start() 14 | { 15 | bool driverOpen = KsDumperDriverInterface.IsDriverOpen("\\\\.\\KsDumper"); 16 | 17 | if (!driverOpen) 18 | { 19 | if (File.Exists(KduSelfExtract.AssemblyDirectory + @"\\Providers.json")) 20 | { 21 | KduWrapper wr = new KduWrapper(KduSelfExtract.AssemblyDirectory + @"\Driver\kdu.exe"); 22 | wr.LoadProviders(); 23 | wr.Start(); 24 | } 25 | } 26 | } 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /KsDumper11/Trigger.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace KsDumper11 2 | { 3 | partial class Trigger 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Component Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | this.SuspendLayout(); 32 | // 33 | // Trigger 34 | // 35 | this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); 36 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 37 | this.BackColor = System.Drawing.Color.FromArgb(((int)(((byte)(192)))), ((int)(((byte)(0)))), ((int)(((byte)(0))))); 38 | this.Name = "Trigger"; 39 | this.Size = new System.Drawing.Size(35, 24); 40 | this.ResumeLayout(false); 41 | 42 | } 43 | 44 | #endregion 45 | } 46 | } 47 | -------------------------------------------------------------------------------- /KsDumper11/Trigger.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.ComponentModel; 4 | using System.Data; 5 | using System.Drawing; 6 | using System.Linq; 7 | using System.Text; 8 | using System.Threading.Tasks; 9 | using System.Windows.Forms; 10 | 11 | namespace KsDumper11 12 | { 13 | public partial class Trigger : UserControl 14 | { 15 | TriggerForm triggerFrm; 16 | public Trigger() 17 | { 18 | InitializeComponent(); 19 | triggerFrm = new TriggerForm(); 20 | this.Click += Trigger_Click; 21 | } 22 | 23 | private void Trigger_Click(object sender, EventArgs e) 24 | { 25 | if (triggerFrm == null) 26 | { 27 | triggerFrm = new TriggerForm(); 28 | } 29 | else 30 | { 31 | if (triggerFrm.IsDisposed) 32 | { 33 | triggerFrm = new TriggerForm(); 34 | } 35 | } 36 | 37 | if (!triggerFrm.Visible) 38 | { 39 | triggerFrm.ShowDialog(); 40 | } 41 | } 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /KsDumper11/Trigger.resx: -------------------------------------------------------------------------------- 1 |  2 | 3 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | text/microsoft-resx 110 | 111 | 112 | 2.0 113 | 114 | 115 | System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 116 | 117 | 118 | System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 119 | 120 | -------------------------------------------------------------------------------- /KsDumper11/TriggerForm.Designer.cs: -------------------------------------------------------------------------------- 1 | namespace KsDumper11 2 | { 3 | partial class TriggerForm 4 | { 5 | /// 6 | /// Required designer variable. 7 | /// 8 | private System.ComponentModel.IContainer components = null; 9 | 10 | /// 11 | /// Clean up any resources being used. 12 | /// 13 | /// true if managed resources should be disposed; otherwise, false. 14 | protected override void Dispose(bool disposing) 15 | { 16 | if (disposing && (components != null)) 17 | { 18 | components.Dispose(); 19 | } 20 | base.Dispose(disposing); 21 | } 22 | 23 | #region Windows Form Designer generated code 24 | 25 | /// 26 | /// Required method for Designer support - do not modify 27 | /// the contents of this method with the code editor. 28 | /// 29 | private void InitializeComponent() 30 | { 31 | System.ComponentModel.ComponentResourceManager resources = new System.ComponentModel.ComponentResourceManager(typeof(TriggerForm)); 32 | this.textBox1 = new System.Windows.Forms.TextBox(); 33 | this.appIcon1 = new DarkControls.Controls.AppIcon(); 34 | this.transparentLabel1 = new DarkControls.Controls.TransparentLabel(); 35 | this.closeBtn = new DarkControls.Controls.WindowsDefaultTitleBarButton(); 36 | ((System.ComponentModel.ISupportInitialize)(this.appIcon1)).BeginInit(); 37 | this.SuspendLayout(); 38 | // 39 | // textBox1 40 | // 41 | this.textBox1.BackColor = System.Drawing.Color.FromArgb(((int)(((byte)(33)))), ((int)(((byte)(33)))), ((int)(((byte)(33))))); 42 | this.textBox1.BorderStyle = System.Windows.Forms.BorderStyle.FixedSingle; 43 | this.textBox1.ForeColor = System.Drawing.Color.Silver; 44 | this.textBox1.Location = new System.Drawing.Point(12, 47); 45 | this.textBox1.Multiline = true; 46 | this.textBox1.Name = "textBox1"; 47 | this.textBox1.Size = new System.Drawing.Size(405, 139); 48 | this.textBox1.TabIndex = 10; 49 | this.textBox1.Text = resources.GetString("textBox1.Text"); 50 | // 51 | // appIcon1 52 | // 53 | this.appIcon1.AppIconImage = ((System.Drawing.Image)(resources.GetObject("appIcon1.AppIconImage"))); 54 | this.appIcon1.BackColor = System.Drawing.Color.FromArgb(((int)(((byte)(33)))), ((int)(((byte)(33)))), ((int)(((byte)(33))))); 55 | this.appIcon1.DragForm = null; 56 | this.appIcon1.Image = ((System.Drawing.Image)(resources.GetObject("appIcon1.Image"))); 57 | this.appIcon1.Location = new System.Drawing.Point(0, 1); 58 | this.appIcon1.Name = "appIcon1"; 59 | this.appIcon1.Scale = 3.5F; 60 | this.appIcon1.Size = new System.Drawing.Size(28, 28); 61 | this.appIcon1.TabIndex = 9; 62 | this.appIcon1.TabStop = false; 63 | // 64 | // transparentLabel1 65 | // 66 | this.transparentLabel1.Font = new System.Drawing.Font("Microsoft Sans Serif", 12F, System.Drawing.FontStyle.Regular, System.Drawing.GraphicsUnit.Point, ((byte)(0))); 67 | this.transparentLabel1.Location = new System.Drawing.Point(32, 4); 68 | this.transparentLabel1.Name = "transparentLabel1"; 69 | this.transparentLabel1.Size = new System.Drawing.Size(108, 20); 70 | this.transparentLabel1.TabIndex = 8; 71 | this.transparentLabel1.Text = "Easter egg"; 72 | // 73 | // closeBtn 74 | // 75 | this.closeBtn.ButtonType = DarkControls.Controls.WindowsDefaultTitleBarButton.Type.Close; 76 | this.closeBtn.ClickColor = System.Drawing.Color.Red; 77 | this.closeBtn.ClickIconColor = System.Drawing.Color.Black; 78 | this.closeBtn.HoverColor = System.Drawing.Color.OrangeRed; 79 | this.closeBtn.HoverIconColor = System.Drawing.Color.Black; 80 | this.closeBtn.IconColor = System.Drawing.Color.Black; 81 | this.closeBtn.IconLineThickness = 2; 82 | this.closeBtn.Location = new System.Drawing.Point(389, 1); 83 | this.closeBtn.Name = "closeBtn"; 84 | this.closeBtn.Size = new System.Drawing.Size(40, 40); 85 | this.closeBtn.TabIndex = 7; 86 | this.closeBtn.Text = "windowsDefaultTitleBarButton1"; 87 | this.closeBtn.UseVisualStyleBackColor = true; 88 | this.closeBtn.Click += new System.EventHandler(this.closeBtn_Click); 89 | // 90 | // TriggerForm 91 | // 92 | this.AllowDrop = true; 93 | this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); 94 | this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font; 95 | this.BackColor = System.Drawing.Color.FromArgb(((int)(((byte)(33)))), ((int)(((byte)(33)))), ((int)(((byte)(33))))); 96 | this.ClientSize = new System.Drawing.Size(429, 198); 97 | this.Controls.Add(this.textBox1); 98 | this.Controls.Add(this.appIcon1); 99 | this.Controls.Add(this.transparentLabel1); 100 | this.Controls.Add(this.closeBtn); 101 | this.DoubleBuffered = true; 102 | this.ForeColor = System.Drawing.Color.Silver; 103 | this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.None; 104 | this.Name = "TriggerForm"; 105 | this.StartPosition = System.Windows.Forms.FormStartPosition.CenterParent; 106 | this.Load += new System.EventHandler(this.TriggerForm_Load); 107 | ((System.ComponentModel.ISupportInitialize)(this.appIcon1)).EndInit(); 108 | this.ResumeLayout(false); 109 | this.PerformLayout(); 110 | 111 | } 112 | 113 | #endregion 114 | private DarkControls.Controls.WindowsDefaultTitleBarButton closeBtn; 115 | private DarkControls.Controls.TransparentLabel transparentLabel1; 116 | private DarkControls.Controls.AppIcon appIcon1; 117 | private System.Windows.Forms.TextBox textBox1; 118 | } 119 | } 120 | 121 | -------------------------------------------------------------------------------- /KsDumper11/TriggerForm.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.IO; 3 | using System.Collections.Generic; 4 | using System.ComponentModel; 5 | using System.Data; 6 | using System.Drawing; 7 | using System.Drawing.Drawing2D; 8 | using System.Linq; 9 | using System.Text; 10 | using System.Threading.Tasks; 11 | using System.Windows.Forms; 12 | using System.Runtime.InteropServices; 13 | using System.Diagnostics; 14 | using DarkControls; 15 | using static System.Windows.Forms.VisualStyles.VisualStyleElement.Button; 16 | 17 | namespace KsDumper11 18 | { 19 | public partial class TriggerForm : Form 20 | { 21 | protected override CreateParams CreateParams 22 | { 23 | get 24 | { 25 | // Activate double buffering at the form level. All child controls will be double buffered as well. 26 | CreateParams cp = base.CreateParams; 27 | cp.ExStyle |= 0x02000000; // Turn on WS_EX_COMPOSITED 28 | return cp; 29 | } 30 | } 31 | 32 | JsonSettingsManager settingsManager; 33 | LabelDrawer labelDrawer; 34 | 35 | public TriggerForm() 36 | { 37 | InitializeComponent(); 38 | 39 | settingsManager = new JsonSettingsManager(); 40 | 41 | this.appIcon1.DragForm = this; 42 | this.FormBorderStyle = FormBorderStyle.None; 43 | this.Region = Region.FromHrgn(Utils.CreateRoundRectRgn(0, 0, Width, Height, 10, 10)); 44 | this.closeBtn.Region = Region.FromHrgn(Utils.CreateRoundRectRgn(0, 0, closeBtn.Width, closeBtn.Height, 10, 10)); 45 | } 46 | 47 | protected override void WndProc(ref Message m) 48 | { 49 | base.WndProc(ref m); 50 | if (m.Msg == Utils.WM_NCHITTEST) 51 | m.Result = (IntPtr)(Utils.HT_CAPTION); 52 | } 53 | 54 | private void closeBtn_Click(object sender, EventArgs e) 55 | { 56 | this.DialogResult = DialogResult.OK; 57 | this.Close(); 58 | } 59 | 60 | private void TriggerForm_Load(object sender, EventArgs e) 61 | { 62 | if (settingsManager.JsonSettings.enableAntiAntiDebuggerTools) 63 | { 64 | labelDrawer = new LabelDrawer(this); 65 | 66 | SnifferBypass.SelfTitle(this.Handle); 67 | 68 | foreach (Control ctrl in this.Controls) 69 | { 70 | if (ctrl is System.Windows.Forms.TextBox) continue; 71 | SnifferBypass.SelfTitle(ctrl.Handle); 72 | } 73 | 74 | this.Text = SnifferBypass.GenerateRandomString(this.Text.Length); 75 | } 76 | } 77 | } 78 | } 79 | -------------------------------------------------------------------------------- /KsDumper11/Turn_OFF_Microsoft_Vulnerable_Driver_Blocklist.reg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/KsDumper11/Turn_OFF_Microsoft_Vulnerable_Driver_Blocklist.reg -------------------------------------------------------------------------------- /KsDumper11/Turn_ON_Microsoft_Vulnerable_Driver_Blocklist.reg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/KsDumper11/Turn_ON_Microsoft_Vulnerable_Driver_Blocklist.reg -------------------------------------------------------------------------------- /KsDumper11/app.manifest: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /KsDumper11/icons8-crossed-axes-100.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/mastercodeon314/KsDumper-11/00a760faac5132606d0d0e01b9f29748894c2167/KsDumper11/icons8-crossed-axes-100.png -------------------------------------------------------------------------------- /KsDumper11/packages.config: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | -------------------------------------------------------------------------------- /KsDumperDriver/Driver.c: -------------------------------------------------------------------------------- 1 | #include "NTUndocumented.h" 2 | #include "ProcessLister.h" 3 | #include "UserModeBridge.h" 4 | #include 5 | 6 | DRIVER_INITIALIZE DriverEntry; 7 | #pragma alloc_text(INIT, DriverEntry) 8 | 9 | UNICODE_STRING deviceName, symLink; 10 | PDEVICE_OBJECT deviceObject; 11 | 12 | NTSTATUS CopyVirtualMemory(PEPROCESS targetProcess, PVOID sourceAddress, PVOID targetAddress, SIZE_T size) 13 | { 14 | PSIZE_T readBytes; 15 | return MmCopyVirtualMemory(targetProcess, sourceAddress, PsGetCurrentProcess(), targetAddress, size, UserMode, &readBytes); 16 | } 17 | 18 | NTSTATUS UnsupportedDispatch(_In_ PDEVICE_OBJECT DeviceObject, _Inout_ PIRP Irp) 19 | { 20 | UNREFERENCED_PARAMETER(DeviceObject); 21 | 22 | Irp->IoStatus.Status = STATUS_NOT_SUPPORTED; 23 | IoCompleteRequest(Irp, IO_NO_INCREMENT); 24 | return Irp->IoStatus.Status; 25 | } 26 | 27 | NTSTATUS CreateDispatch(_In_ PDEVICE_OBJECT DeviceObject, _Inout_ PIRP Irp) 28 | { 29 | UNREFERENCED_PARAMETER(DeviceObject); 30 | 31 | IoCompleteRequest(Irp, IO_NO_INCREMENT); 32 | return Irp->IoStatus.Status; 33 | } 34 | 35 | NTSTATUS CloseDispatch(_In_ PDEVICE_OBJECT DeviceObject, _Inout_ PIRP Irp) 36 | { 37 | UNREFERENCED_PARAMETER(DeviceObject); 38 | 39 | IoCompleteRequest(Irp, IO_NO_INCREMENT); 40 | return Irp->IoStatus.Status; 41 | } 42 | 43 | //NTSTATUS Unload(IN PDRIVER_OBJECT DriverObject) 44 | //{ 45 | // IoDeleteSymbolicLink(&symLink); 46 | // IoDeleteDevice(DriverObject->DeviceObject); 47 | //} 48 | 49 | NTSTATUS Unload(IN PDRIVER_OBJECT DriverObject) 50 | { 51 | IoDeleteSymbolicLink(&symLink); 52 | IoDeleteSymbolicLink(&deviceName); 53 | IoDeleteDevice(deviceObject); 54 | return ZwUnloadDriver(&deviceName); 55 | } 56 | 57 | NTSTATUS IoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) 58 | { 59 | NTSTATUS status; 60 | ULONG bytesIO = 0; 61 | PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp); 62 | ULONG controlCode = stack->Parameters.DeviceIoControl.IoControlCode; 63 | 64 | if (controlCode == IO_COPY_MEMORY) 65 | { 66 | if (stack->Parameters.DeviceIoControl.InputBufferLength == sizeof(KERNEL_COPY_MEMORY_OPERATION)) 67 | { 68 | PKERNEL_COPY_MEMORY_OPERATION request = (PKERNEL_COPY_MEMORY_OPERATION)Irp->AssociatedIrp.SystemBuffer; 69 | PEPROCESS targetProcess; 70 | 71 | if (NT_SUCCESS(PsLookupProcessByProcessId(request->targetProcessId, &targetProcess))) 72 | { 73 | CopyVirtualMemory(targetProcess, request->targetAddress, request->bufferAddress, request->bufferSize); 74 | ObDereferenceObject(targetProcess); 75 | } 76 | 77 | status = STATUS_SUCCESS; 78 | bytesIO = sizeof(KERNEL_COPY_MEMORY_OPERATION); 79 | } 80 | else 81 | { 82 | status = STATUS_INFO_LENGTH_MISMATCH; 83 | bytesIO = 0; 84 | } 85 | } 86 | else if (controlCode == IO_GET_PROCESS_LIST) 87 | { 88 | if (stack->Parameters.DeviceIoControl.InputBufferLength == sizeof(KERNEL_PROCESS_LIST_OPERATION) && 89 | stack->Parameters.DeviceIoControl.OutputBufferLength == sizeof(KERNEL_PROCESS_LIST_OPERATION)) 90 | { 91 | PKERNEL_PROCESS_LIST_OPERATION request = (PKERNEL_PROCESS_LIST_OPERATION)Irp->AssociatedIrp.SystemBuffer; 92 | 93 | GetProcessList(request->bufferAddress, request->bufferSize, &request->bufferSize, &request->processCount); 94 | 95 | status = STATUS_SUCCESS; 96 | bytesIO = sizeof(KERNEL_PROCESS_LIST_OPERATION); 97 | } 98 | else 99 | { 100 | status = STATUS_INFO_LENGTH_MISMATCH; 101 | bytesIO = 0; 102 | } 103 | } 104 | else if (controlCode == IO_UNLOAD_DRIVER) 105 | { 106 | Unload(NULL); 107 | bytesIO = 0; 108 | status = STATUS_SUCCESS; 109 | } 110 | else 111 | { 112 | status = STATUS_INVALID_PARAMETER; 113 | bytesIO = 0; 114 | } 115 | 116 | Irp->IoStatus.Status = status; 117 | Irp->IoStatus.Information = bytesIO; 118 | IoCompleteRequest(Irp, IO_NO_INCREMENT); 119 | 120 | return status; 121 | } 122 | 123 | NTSTATUS DriverInitialize(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) 124 | { 125 | NTSTATUS status; 126 | 127 | 128 | UNREFERENCED_PARAMETER(RegistryPath); 129 | 130 | RtlInitUnicodeString(&deviceName, L"\\Device\\KsDumper"); 131 | RtlInitUnicodeString(&symLink, L"\\DosDevices\\KsDumper"); 132 | 133 | status = IoCreateDevice(DriverObject, 0, &deviceName, FILE_DEVICE_UNKNOWN, FILE_DEVICE_SECURE_OPEN, FALSE, &deviceObject); 134 | 135 | if (!NT_SUCCESS(status)) 136 | { 137 | return status; 138 | } 139 | status = IoCreateSymbolicLink(&symLink, &deviceName); 140 | 141 | if (!NT_SUCCESS(status)) 142 | { 143 | IoDeleteDevice(deviceObject); 144 | return status; 145 | } 146 | deviceObject->Flags |= DO_BUFFERED_IO; 147 | 148 | for (ULONG t = 0; t <= IRP_MJ_MAXIMUM_FUNCTION; t++) 149 | DriverObject->MajorFunction[t] = &UnsupportedDispatch; 150 | 151 | DriverObject->MajorFunction[IRP_MJ_CREATE] = &CreateDispatch; 152 | DriverObject->MajorFunction[IRP_MJ_CLOSE] = &CloseDispatch; 153 | DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = &IoControl; 154 | DriverObject->DriverUnload = &Unload; 155 | deviceObject->Flags &= ~DO_DEVICE_INITIALIZING; 156 | 157 | return status; 158 | } 159 | 160 | 161 | 162 | NTSTATUS DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) 163 | { 164 | UNREFERENCED_PARAMETER(DriverObject); 165 | UNREFERENCED_PARAMETER(RegistryPath); 166 | 167 | return IoCreateDriver(NULL, &DriverInitialize); 168 | } 169 | -------------------------------------------------------------------------------- /KsDumperDriver/KsDumperDriver.vcxproj: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | Debug 6 | x64 7 | 8 | 9 | Release 10 | x64 11 | 12 | 13 | 14 | {8EADAB93-F111-43AF-9E10-2376AE515491} 15 | {1bc93793-694f-48fe-9372-81e2b05556fd} 16 | v4.5 17 | 12.0 18 | Debug 19 | Win32 20 | TestDriver 21 | KsDumperDriver 22 | 23 | 24 | 25 | Windows10 26 | true 27 | WindowsKernelModeDriver10.0 28 | Driver 29 | KMDF 30 | Universal 31 | 32 | 33 | Windows10 34 | false 35 | WindowsKernelModeDriver10.0 36 | Driver 37 | KMDF 38 | Universal 39 | false 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | DbgengKernelDebugger 51 | 52 | 53 | DbgengKernelDebugger 54 | 55 | 56 | 57 | 58 | false 59 | true 60 | Speed 61 | false 62 | true 63 | All 64 | true 65 | CompileAsC 66 | false 67 | false 68 | 69 | 70 | false 71 | true 72 | DriverEntry 73 | true 74 | true 75 | false 76 | 77 | 78 | 79 | 80 | false 81 | true 82 | Speed 83 | false 84 | true 85 | All 86 | true 87 | CompileAsC 88 | false 89 | false 90 | 91 | 92 | false 93 | true 94 | DriverEntry 95 | true 96 | true 97 | false 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | -------------------------------------------------------------------------------- /KsDumperDriver/KsDumperDriver.vcxproj.filters: -------------------------------------------------------------------------------- 1 |  2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Source Files 20 | 21 | 22 | Source Files 23 | 24 | 25 | Source Files 26 | 27 | 28 | 29 | 30 | Header Files 31 | 32 | 33 | Header Files 34 | 35 | 36 | Header Files 37 | 38 | 39 | Header Files 40 | 41 | 42 | -------------------------------------------------------------------------------- /KsDumperDriver/NTUndocumented.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | 4 | typedef struct _KAPC_STATE { 5 | LIST_ENTRY ApcListHead[MaximumMode]; 6 | struct _KPROCESS *Process; 7 | BOOLEAN KernelApcInProgress; 8 | BOOLEAN KernelApcPending; 9 | BOOLEAN UserApcPending; 10 | } KAPC_STATE, *PKAPC_STATE, *PRKAPC_STATE; 11 | 12 | typedef enum _SYSTEM_INFORMATION_CLASS 13 | { 14 | SystemProcessInformation = 5 15 | } SYSTEM_INFORMATION_CLASS; 16 | 17 | typedef enum _MEMORY_INFORMATION_CLASS 18 | { 19 | MemoryBasicInformation, 20 | MemoryWorkingSetInformation, 21 | MemoryMappedFilenameInformation, 22 | MemoryRegionInformation, 23 | MemoryWorkingSetExInformation 24 | 25 | } MEMORY_INFORMATION_CLASS; 26 | 27 | 28 | typedef struct _MEMORY_BASIC_INFORMATION { 29 | PVOID BaseAddress; 30 | PVOID AllocationBase; 31 | INT32 AllocationProtect; 32 | SIZE_T RegionSize; 33 | INT32 State; 34 | INT32 Protect; 35 | INT32 Type; 36 | } MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION; 37 | 38 | NTKERNELAPI NTSTATUS IoCreateDriver(IN PUNICODE_STRING DriverName, OPTIONAL IN PDRIVER_INITIALIZE InitializationFunction); 39 | 40 | NTKERNELAPI VOID KeStackAttachProcess(__inout struct _KPROCESS * PROCESS, __out PRKAPC_STATE ApcState); 41 | NTKERNELAPI VOID KeUnstackDetachProcess(__in PRKAPC_STATE ApcState); 42 | 43 | NTKERNELAPI NTSTATUS NTAPI MmCopyVirtualMemory(IN PEPROCESS FromProcess, IN PVOID FromAddress, IN PEPROCESS ToProcess, OUT PVOID ToAddress, IN SIZE_T BufferSize, IN KPROCESSOR_MODE PreviousMode, OUT PSIZE_T NumberOfBytesCopied); 44 | 45 | NTSYSAPI NTSTATUS NTAPI ZwQuerySystemInformation(IN SYSTEM_INFORMATION_CLASS SystemInformationClass, OUT PVOID SystemInformation, IN ULONG SystemInformationLength, OUT PULONG ReturnLength OPTIONAL); 46 | NTSYSAPI NTSTATUS NTAPI ZwQueryVirtualMemory(IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN MEMORY_INFORMATION_CLASS MemoryInformationClass, OUT PVOID MemoryInformation, IN SIZE_T MemoryInformationLength, OUT PSIZE_T ReturnLength OPTIONAL); 47 | 48 | NTKERNELAPI NTSTATUS PsLookupProcessByProcessId(IN HANDLE ProcessId, OUT PEPROCESS *Process); 49 | NTKERNELAPI PVOID PsGetProcessSectionBaseAddress(__in PEPROCESS Process); 50 | NTKERNELAPI PPEB NTAPI PsGetProcessPeb(IN PEPROCESS Process); -------------------------------------------------------------------------------- /KsDumperDriver/ProcessLister.c: -------------------------------------------------------------------------------- 1 | #include "NTUndocumented.h" 2 | #include "ProcessLister.h" 3 | #include "Utility.h" 4 | 5 | static PSYSTEM_PROCESS_INFORMATION GetRawProcessList() 6 | { 7 | ULONG bufferSize = 0; 8 | PVOID bufferPtr = NULL; 9 | 10 | if (ZwQuerySystemInformation(SystemProcessInformation, 0, bufferSize, &bufferSize) == STATUS_INFO_LENGTH_MISMATCH) 11 | { 12 | bufferPtr = ExAllocatePool(NonPagedPool, bufferSize); 13 | 14 | if (bufferPtr != NULL) 15 | { 16 | ZwQuerySystemInformation(SystemProcessInformation, bufferPtr, bufferSize, &bufferSize); 17 | } 18 | } 19 | return (PSYSTEM_PROCESS_INFORMATION)bufferPtr; 20 | } 21 | 22 | static ULONG CalculateProcessListOutputSize(PSYSTEM_PROCESS_INFORMATION rawProcessList) 23 | { 24 | int size = 0; 25 | 26 | while (rawProcessList->NextEntryOffset) 27 | { 28 | size += sizeof(PROCESS_SUMMARY); 29 | rawProcessList = (PSYSTEM_PROCESS_INFORMATION)(((CHAR*)rawProcessList) + rawProcessList->NextEntryOffset); 30 | } 31 | return size; 32 | } 33 | 34 | static PLDR_DATA_TABLE_ENTRY GetMainModuleDataTableEntry(PPEB64 peb) 35 | { 36 | if (SanitizeUserPointer(peb, sizeof(PEB64))) 37 | { 38 | if (peb->Ldr) 39 | { 40 | if (SanitizeUserPointer(peb->Ldr, sizeof(PEB_LDR_DATA))) 41 | { 42 | if (!peb->Ldr->Initialized) 43 | { 44 | int initLoadCount = 0; 45 | 46 | while (!peb->Ldr->Initialized && initLoadCount++ < 4) 47 | { 48 | DriverSleep(250); 49 | } 50 | } 51 | 52 | if (peb->Ldr->Initialized) 53 | { 54 | return CONTAINING_RECORD(peb->Ldr->InLoadOrderModuleList.Flink, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks); 55 | } 56 | } 57 | } 58 | } 59 | return NULL; 60 | } 61 | 62 | NTSTATUS GetProcessList(PVOID listedProcessBuffer, INT32 bufferSize, PINT32 requiredBufferSize, PINT32 processCount) 63 | { 64 | PPROCESS_SUMMARY processSummary = (PPROCESS_SUMMARY)listedProcessBuffer; 65 | PSYSTEM_PROCESS_INFORMATION rawProcessList = GetRawProcessList(); 66 | PVOID listHeadPointer = rawProcessList; 67 | *processCount = 0; 68 | 69 | if (rawProcessList) 70 | { 71 | int expectedBufferSize = CalculateProcessListOutputSize(rawProcessList); 72 | 73 | if (!listedProcessBuffer || bufferSize < expectedBufferSize) 74 | { 75 | *requiredBufferSize = expectedBufferSize; 76 | return STATUS_INFO_LENGTH_MISMATCH; 77 | } 78 | 79 | while (rawProcessList->NextEntryOffset) 80 | { 81 | PEPROCESS targetProcess; 82 | PKAPC_STATE state = NULL; 83 | 84 | if (NT_SUCCESS(PsLookupProcessByProcessId(rawProcessList->UniqueProcessId, &targetProcess))) 85 | { 86 | PVOID mainModuleBase = NULL; 87 | PVOID mainModuleEntryPoint = NULL; 88 | UINT32 mainModuleImageSize = 0; 89 | PWCHAR mainModuleFileName = NULL; 90 | BOOLEAN isWow64 = 0; 91 | 92 | __try 93 | { 94 | KeStackAttachProcess(targetProcess, &state); 95 | 96 | __try 97 | { 98 | mainModuleBase = PsGetProcessSectionBaseAddress(targetProcess); 99 | 100 | if (mainModuleBase) 101 | { 102 | PPEB64 peb = (PPEB64)PsGetProcessPeb(targetProcess); 103 | 104 | if (peb) 105 | { 106 | PLDR_DATA_TABLE_ENTRY mainModuleEntry = GetMainModuleDataTableEntry(peb); 107 | mainModuleEntry = SanitizeUserPointer(mainModuleEntry, sizeof(LDR_DATA_TABLE_ENTRY)); 108 | 109 | if (mainModuleEntry) 110 | { 111 | mainModuleEntryPoint = mainModuleEntry->EntryPoint; 112 | mainModuleImageSize = mainModuleEntry->SizeOfImage; 113 | isWow64 = IS_WOW64_PE(mainModuleBase); 114 | 115 | mainModuleFileName = ExAllocatePool(NonPagedPool, 256 * sizeof(WCHAR)); 116 | RtlZeroMemory(mainModuleFileName, 256 * sizeof(WCHAR)); 117 | RtlCopyMemory(mainModuleFileName, mainModuleEntry->FullDllName.Buffer, 256 * sizeof(WCHAR)); 118 | } 119 | } 120 | } 121 | } 122 | __except (GetExceptionCode()) 123 | { 124 | DbgPrintEx(0, 0, "Peb Interaction Failed.\n"); 125 | } 126 | } 127 | __finally 128 | { 129 | KeUnstackDetachProcess(&state); 130 | } 131 | 132 | if (mainModuleFileName) 133 | { 134 | RtlCopyMemory(processSummary->MainModuleFileName, mainModuleFileName, 256 * sizeof(WCHAR)); 135 | ExFreePool(mainModuleFileName); 136 | 137 | processSummary->ProcessId = rawProcessList->UniqueProcessId; 138 | processSummary->MainModuleBase = mainModuleBase; 139 | processSummary->MainModuleEntryPoint = mainModuleEntryPoint; 140 | processSummary->MainModuleImageSize = mainModuleImageSize; 141 | processSummary->WOW64 = isWow64; 142 | 143 | processSummary++; 144 | (*processCount)++; 145 | } 146 | 147 | ObDereferenceObject(targetProcess); 148 | } 149 | 150 | rawProcessList = (PSYSTEM_PROCESS_INFORMATION)(((CHAR*)rawProcessList) + rawProcessList->NextEntryOffset); 151 | } 152 | 153 | ExFreePool(listHeadPointer); 154 | return STATUS_SUCCESS; 155 | } 156 | } -------------------------------------------------------------------------------- /KsDumperDriver/ProcessLister.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | 4 | #pragma pack(push, 1) 5 | typedef struct _PROCESS_SUMMARY 6 | { 7 | INT32 ProcessId; 8 | PVOID MainModuleBase; 9 | WCHAR MainModuleFileName[256]; 10 | UINT32 MainModuleImageSize; 11 | PVOID MainModuleEntryPoint; 12 | BOOLEAN WOW64; 13 | } PROCESS_SUMMARY, *PPROCESS_SUMMARY; 14 | #pragma pack(pop) 15 | 16 | typedef struct _SYSTEM_PROCESS_INFORMATION 17 | { 18 | ULONG NextEntryOffset; 19 | ULONG NumberOfThreads; 20 | LARGE_INTEGER SpareLi1; 21 | LARGE_INTEGER SpareLi2; 22 | LARGE_INTEGER SpareLi3; 23 | LARGE_INTEGER CreateTime; 24 | LARGE_INTEGER UserTime; 25 | LARGE_INTEGER KernelTime; 26 | UNICODE_STRING ImageName; 27 | KPRIORITY BasePriority; 28 | HANDLE UniqueProcessId; 29 | HANDLE InheritedFromUniqueProcessId; 30 | ULONG HandleCount; 31 | ULONG SessionId; 32 | ULONG_PTR PageDirectoryBase; 33 | SIZE_T PeakVirtualSize; 34 | SIZE_T VirtualSize; 35 | ULONG PageFaultCount; 36 | SIZE_T PeakWorkingSetSize; 37 | SIZE_T WorkingSetSize; 38 | SIZE_T QuotaPeakPagedPoolUsage; 39 | SIZE_T QuotaPagedPoolUsage; 40 | SIZE_T QuotaPeakNonPagedPoolUsage; 41 | SIZE_T QuotaNonPagedPoolUsage; 42 | SIZE_T PagefileUsage; 43 | SIZE_T PeakPagefileUsage; 44 | SIZE_T PrivatePageCount; 45 | LARGE_INTEGER ReadOperationCount; 46 | LARGE_INTEGER WriteOperationCount; 47 | LARGE_INTEGER OtherOperationCount; 48 | LARGE_INTEGER ReadTransferCount; 49 | LARGE_INTEGER WriteTransferCount; 50 | LARGE_INTEGER OtherTransferCount; 51 | } SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION; 52 | 53 | typedef struct _LDR_DATA_TABLE_ENTRY 54 | { 55 | LIST_ENTRY InLoadOrderLinks; 56 | LIST_ENTRY InMemoryOrderLinks; 57 | CHAR Reserved0[0x10]; 58 | PVOID DllBase; 59 | PVOID EntryPoint; 60 | ULONG SizeOfImage; 61 | UNICODE_STRING FullDllName; 62 | UNICODE_STRING BaseDllName; 63 | } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; 64 | 65 | typedef struct _PEB_LDR_DATA 66 | { 67 | ULONG Length; 68 | BOOLEAN Initialized; 69 | PVOID SsHandler; 70 | LIST_ENTRY InLoadOrderModuleList; 71 | LIST_ENTRY InMemoryOrderModuleList; 72 | LIST_ENTRY InInitializationOrderModuleList; 73 | PVOID EntryInProgress; 74 | } PEB_LDR_DATA, *PPEB_LDR_DATA; 75 | 76 | typedef struct _PEB64 { 77 | CHAR Reserved[0x10]; 78 | PVOID ImageBaseAddress; 79 | PPEB_LDR_DATA Ldr; 80 | } PEB64, *PPEB64; 81 | 82 | typedef struct _IMAGE_DOS_HEADER { 83 | USHORT e_magic; 84 | USHORT e_cblp; 85 | USHORT e_cp; 86 | USHORT e_crlc; 87 | USHORT e_cparhdr; 88 | USHORT e_minalloc; 89 | USHORT e_maxalloc; 90 | USHORT e_ss; 91 | USHORT e_sp; 92 | USHORT e_csum; 93 | USHORT e_ip; 94 | USHORT e_cs; 95 | USHORT e_lfarlc; 96 | USHORT e_ovno; 97 | USHORT e_res[4]; 98 | USHORT e_oemid; 99 | USHORT e_oeminfo; 100 | USHORT e_res2[10]; 101 | LONG e_lfanew; 102 | } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER; 103 | 104 | typedef struct _PE_HEADER { 105 | CHAR Signature[4]; 106 | USHORT Machine; 107 | USHORT NumberOfSections; 108 | UINT32 TimeDateStamp; 109 | UINT32 PointerToSymbolTable; 110 | UINT32 NumberOfSymbols; 111 | USHORT SizeOfOptionalHeader; 112 | USHORT Characteristics; 113 | USHORT Magic; 114 | } PE_HEADER, *PPE_HEADER; 115 | 116 | #define PE_HEADER_MAGIC_OFFSET 0x18 117 | #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b 118 | 119 | #define IS_WOW64_PE( baseAddress ) (*((USHORT*)((CHAR *)baseAddress + \ 120 | ((PIMAGE_DOS_HEADER)baseAddress)->e_lfanew + PE_HEADER_MAGIC_OFFSET)) \ 121 | == IMAGE_NT_OPTIONAL_HDR32_MAGIC) 122 | 123 | NTSTATUS GetProcessList(PVOID listedProcessBuffer, INT32 bufferSize, PINT32 requiredBufferSize, PINT32 processCount); -------------------------------------------------------------------------------- /KsDumperDriver/UserModeBridge.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | 4 | #define IO_GET_PROCESS_LIST CTL_CODE(FILE_DEVICE_UNKNOWN, 0x1724, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) 5 | 6 | #define IO_COPY_MEMORY CTL_CODE(FILE_DEVICE_UNKNOWN, 0x1725, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) 7 | 8 | #define IO_UNLOAD_DRIVER CTL_CODE(FILE_DEVICE_UNKNOWN, 0x1726, METHOD_BUFFERED, FILE_SPECIAL_ACCESS) 9 | 10 | typedef struct _KERNEL_PROCESS_LIST_OPERATION 11 | { 12 | PVOID bufferAddress; 13 | INT32 bufferSize; 14 | INT32 processCount; 15 | } KERNEL_PROCESS_LIST_OPERATION, *PKERNEL_PROCESS_LIST_OPERATION; 16 | 17 | typedef struct _KERNEL_COPY_MEMORY_OPERATION 18 | { 19 | INT32 targetProcessId; 20 | PVOID targetAddress; 21 | PVOID bufferAddress; 22 | INT32 bufferSize; 23 | } KERNEL_COPY_MEMORY_OPERATION, *PKERNEL_COPY_MEMORY_OPERATION; -------------------------------------------------------------------------------- /KsDumperDriver/Utility.c: -------------------------------------------------------------------------------- 1 | #include "NTUndocumented.h" 2 | #include "Utility.h" 3 | 4 | NTSTATUS DriverSleep(int ms) 5 | { 6 | LARGE_INTEGER li; 7 | li.QuadPart = -10000; 8 | 9 | for (int i = 0; i < ms; i++) 10 | { 11 | KeDelayExecutionThread(KernelMode, FALSE, &li); 12 | return STATUS_SUCCESS; 13 | } 14 | return STATUS_UNSUCCESSFUL; 15 | } 16 | 17 | PVOID SanitizeUserPointer(PVOID pointer, SIZE_T size) 18 | { 19 | MEMORY_BASIC_INFORMATION memInfo; 20 | 21 | if (NT_SUCCESS(ZwQueryVirtualMemory(ZwCurrentProcess(), pointer, MemoryBasicInformation, &memInfo, sizeof(MEMORY_BASIC_INFORMATION), NULL))) 22 | { 23 | if (!(((uintptr_t)memInfo.BaseAddress + memInfo.RegionSize) < (((uintptr_t)pointer + size)))) 24 | { 25 | if (memInfo.State & MEM_COMMIT || !(memInfo.Protect & (PAGE_GUARD | PAGE_NOACCESS))) 26 | { 27 | if (memInfo.Protect & PAGE_EXECUTE_READWRITE || memInfo.Protect & PAGE_EXECUTE_WRITECOPY || memInfo.Protect & PAGE_READWRITE || memInfo.Protect & PAGE_WRITECOPY) 28 | { 29 | return pointer; 30 | } 31 | } 32 | } 33 | } 34 | return NULL; 35 | } 36 | -------------------------------------------------------------------------------- /KsDumperDriver/Utility.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | #include 3 | 4 | NTSTATUS DriverSleep(int ms); 5 | 6 | PVOID SanitizeUserPointer(PVOID pointer, SIZE_T size); -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # KsDumper-11 2 | https://github.com/mastercodeon314/KsDumper-11/assets/78676320/9452970c-27cf-44df-b091-0d18a07937e5 3 | 4 | ## Whats new v1.3.4 5 | + Added new feature Anti Anti Debugging Tools Detection 6 | + Randomized MainWindow Title, most Control Titles, and the exe file name during runtime 7 | + The process name is reverted to KsDumper11.exe upon program closing 8 | + Enable Anti Anti Debugging Tools Detection check box setting added 9 | + This feature was added in hopes to make KsDumper 11 more stealthy when trying to dump programs that have more rudimentary Anti Debugging techniques implemented 10 | + Lots of source code cleanup 11 | + Fixed Easter Egg window that would not close upon clicking of the close button 12 | + Changed all labels in every form to be manually drawn to get around label text being changed when Anti Anti Debugging Tools Detection feature is enabled 13 | + Migrated from Application Settings to custom Settings.json for saving and loading of settings 14 | 15 | ## Whats new v1.3.3 16 | + Updated KDU to v1.4.1 17 | New providers were added, see KDU patch notes on latest release. 18 | 19 | ## Whats new v1.3.2 20 | + Provider selction window now has a button to reset or wipe provider settings. 21 | This means that all the providers will be reset to needing to be tested, and the default provider will be reset. 22 | + Fixed a bug in the provider selection window that would prevent it from being closed when opened from the main Dumper window. 23 | ![image](https://github.com/mastercodeon314/KsDumper-11/assets/78676320/9ffeb3a7-86c6-40ef-95f7-cd140b20143d) 24 | 25 | ## Whats new v1.3.1 26 | + Updated KDU to v1.4.0! Provider count is now 44 27 | 28 | ## Whats new v1.3 29 | + Updated KDU to KDU V1.3.4! Over 40 different providers are now available! 30 | + Removed the old auto detection of working providers and replaced it with a new provider selector. Users can now select which provider they want to use to load the driver. As well as test providers to see if they work on your system! 31 | + Testing some Providers may BSOD crash the system, KsDumper now has support for being ran again after a crash and will mark the last checked provider as non-working! 32 | + Anytime kdu loads and it detects a saved providers list, it will try to load the KsDumper driver using the default provider 33 | + Providers list and selected default provider are now saved as JSON files! 34 | + Updated to .NET Framework v4.8 35 | 36 | ![KsDumper v1.3 Provider Selector window](https://github.com/mastercodeon314/KsDumper-11/assets/78676320/c683b753-774b-49f0-81ca-76ed2f4dd09b) 37 | 38 | ## Whats new v1.2 39 | + KsDumper will now try and start the driver using the default kdu exploit provider #1 (RTCore64.sys) 40 | + If the default provider does not work, KsDumper will scan all kdu providers and save each one that works into a list. 41 | + Anytime kdu loads and it detects a saved providers list, it will try to load the KsDumper driver using each saved provider until one works. 42 | + This technique should increase the amount of systems that the driver will be able to be loaded on. 43 | 44 | ## Support 45 | You can join the official KsDumper 11 discord server where I will be managing ongoing issues. 46 | For those of you who find that ksDumper won't start on their system, please join the server and post your logs in the support channel. 47 | Please keep in mind that until others volunteer to help in development of this tool, I am only one person with a finite amount of knowledge. 48 | https://discord.gg/6kfWU3Ckya 49 | 50 | ## Features 51 | - Selection of working kdu exploit providers. 52 | - Auto dumping of selected exe. 53 | - Unloading the KsDumper kernel driver is now supported! An option was added to unload on program exit, or system shutdown/restart. 54 | - Splash screen for when driver is being loaded 55 | - Auto Refresh (every 100ms) 56 | - Suspend, resume, kill process 57 | - Dump any process main module using a kernel driver (both x86 and x64) 58 | - Rebuild PE32/PE64 header and sections 59 | - ^ This can be defeated by stripping pe headers. Once pe headers are stripped, it cant dump. 60 | - Works on protected system processes & processes with stripped handles (anti-cheats) 61 | - Works on Windows 11, it doesnt crash anymore! 62 | ![Canary Channel Insider Build Win 11 Ksdumper](https://github.com/mastercodeon314/KsDumper-11/assets/78676320/12b05290-8856-48c6-ae03-90733c8db392) 63 | 64 | **Note**: Import table isn't rebuilt. 65 | 66 | ## Usage 67 | The old way of loading the unsigned ksDumper.sys kernel driver was to use the capcom exploit to map it, this got patched in windows 11. 68 | This one loads the driver with Kernel Driver Utility, or KDU for short. 69 | 70 | Loading of the driver is handled by the Provider Selector now. Simply select a provider from the list, click Test Driver, and if it works, then you can click Set Default provider and it will use the selected provider to load the KsDumper driver with. 71 | 72 | **Note2**: Even though it can dump both x86 & x64 processes, this has to run on x64 Windows. 73 | 74 | ## Disclaimer 75 | The new kdu provider selector can and WILL crash windows if a bad provider is tested. As such, I have implimented functionality to allow KsDumper to be ran again after a crash, and it will mark the last tested provider as non-working. This way, users will be prevented from testing that provider again and less crashes should result from general usage of KsDumper 11. 76 | Please do beware that it can sometimes crash the OS even still. I do not take any responsibility for any damage that may occur to your system from using this tool. 77 | 78 | Due to the nature of how KDU works to map the kernel driver, it is unknown if the system you run this on 79 | will have a exploitable driver according to kdu providers. 80 | If you try to boot KsDumper 11 and it fails to start the driver, trying again as administrator. 81 | If it still fails post the log. There is a manualloader.bat you can try as well to see the output directly. 82 | You MUST run KsDumper at least once for the kdu.exe file and its dlls to be self extracted for the ManualLoader.bat to work. 83 | 84 | This project has been made available for informational and educational purposes only. 85 | Considering the nature of this project, it is highly recommended to run it in a `Virtual Environment`. I am not responsible for any crash or damage that could happen to your system. 86 | 87 | **Important**: This tool makes no attempt at hiding itself. If you target protected games, the anti-cheat might flag this as a cheat and ban you after a while. Use a `Virtual Environment` ! 88 | 89 | ## Donation links 90 | Anything is super helpful! Anything donated helps me keep developing this program and others! 91 | - https://www.paypal.com/paypalme/lifeline42 92 | - https://cash.app/$Mastercodeon3142 93 | 94 | ## References 95 | - https://github.com/EquiFox/KsDumper 96 | - https://github.com/hfiref0x/KDU 97 | - https://github.com/not-wlan/drvmap 98 | - https://github.com/Zer0Mem0ry/KernelBhop 99 | - https://github.com/NtQuery/Scylla/ 100 | - http://terminus.rewolf.pl/terminus/ 101 | - https://www.unknowncheats.me/ 102 | 103 | ## Compile Yourself 104 | - Requires Visual Studio 2022 (must use 2019 for compiling the driver, and 2019 wdk) 105 | - Requires .NET 4.8 106 | - Window Driver Framework (WDK) -------------------------------------------------------------------------------- /Version.json: -------------------------------------------------------------------------------- 1 | { 2 | "version": "1.3.5", 3 | "url": "https://github.com/mastercodeon314/KsDumper-11/releases/download/1.3.4/KsDumper11.v1.3.4.zip", 4 | "changelog": "https://github.com/mastercodeon314/KsDumper-11/releases/tag/1.3.4" 5 | } 6 | --------------------------------------------------------------------------------