A flexible kernel-assisted process dumper.
At the moment, the project supports dumping user-mode processes only. Support for dumping drivers/kernel modules may be added in the future.
-
Dumps user-mode processes.
-
Kernel driver can read memory using two different methods:
- Virtual memory
- Physical memory
-
If the driver cannot obtain the process
DTB/UserDTB(for example, when it has been intentionally hidden or removed), it automatically falls back to virtual memory reading. -
Designed to be flexible, allowing anyone to build their own client implementation on top of the driver.
To reduce static detection, the driver generates random names for:
- Driver name
- Device name
- Symbolic link
These values are stored in a temporary file located in:
DiskChar:\Windows\Temp
The file has a random name with the .f11 extension and contains the generated names in wchar_t format.
The client reads this file to obtain the generated names.
Currently, the client only requires a process ID (PID).
After dumping, it creates the output file (dmp.exe) in the same directory as the client.
By default, the client deletes the temporary .f11 file after reading it, which makes the current implementation effectively single-use.
If you want to reuse the same driver instance multiple times, simply comment out the deletion code here:
https://github.com/e9oq/kernel_dumper/blob/master/client/src/interface/driver/driver.cxx#L216
This will prevent the temporary file from being removed, allowing the driver to be reused without restarting it.
Possible future improvements include:
- Support for dumping kernel drivers/modules.
- Waiting until protected memory pages become accessible instead of immediately copying them. This can improve compatibility with anti-dump protections used by some anti-cheat systems.
The main goal of this project is flexibility.
I intentionally tried to keep the driver generic so that everyone can implement their own client according to their own needs.
Contributions, suggestions, and improvements are welcome.