v1.2 Merge

KsDumper11/Driver/DriverInterface.cs

@@ -8,6 +8,10 @@ namespace KsDumper11.Driver
 	// Token: 0x02000014 RID: 20
 	public class DriverInterface
 	{
+		public static DriverInterface OpenKsDumperDriver()
+		{
+			return new DriverInterface("\\\\.\\KsDumper");
+		}
         public static bool IsDriverOpen(string registryPath)
         {
             IntPtr handle = WinApi.CreateFileA(registryPath, FileAccess.ReadWrite, FileShare.ReadWrite, IntPtr.Zero, FileMode.Open, (FileAttributes)0, IntPtr.Zero);

KsDumper11/Properties/AssemblyInfo.cs

@@ -5,7 +5,7 @@ using System.Runtime.CompilerServices;
 using System.Runtime.InteropServices;
 using System.Runtime.Versioning;
 
-[assembly: AssemblyVersion("1.1.0.0")]
+[assembly: AssemblyVersion("1.2")]
 [assembly: AssemblyTitle("KsDumper 11")]
 [assembly: AssemblyDescription("Dump processes from kernel space !")]
 [assembly: AssemblyConfiguration("")]
@@ -15,4 +15,4 @@ using System.Runtime.Versioning;
 [assembly: AssemblyTrademark("")]
 [assembly: ComVisible(false)]
 [assembly: Guid("7881b99d-0b5a-44e7-af34-80a0ecffd5db")]
-[assembly: AssemblyFileVersion("1.1.0.0")]
+[assembly: AssemblyFileVersion("1.2")]

KsDumper11/SplashForm.cs

@@ -51,9 +51,36 @@ namespace KsDumper11
             }
         }
 
+        List<int> workingProviders = new List<int>();
+
+        string logFolder = Environment.CurrentDirectory + "\\Logs";
+        string workingProvidersPath = Environment.CurrentDirectory + "\\Providers.txt";
+        Random rnd = new Random();
+        void saveProviders()
+        {
+            StringBuilder b = new StringBuilder();
+            for (int i = 0; i < workingProviders.Count; i++)
+            {
+                if (i == workingProviders.Count - 1)
+                {
+                    b.Append(workingProviders[i]);
+                }
+                else
+                {
+                    b.Append(workingProviders[i].ToString() + "|");
+                }
+            }
+            Debugger.Break();
+            File.WriteAllText(workingProvidersPath, b.ToString());
+        }
 
         private void StartDriver()
         {
+            if (!Directory.Exists(logFolder))
+            {
+                Directory.CreateDirectory(logFolder);
+            }
+
             int timeout = 5;
             int retryCountDown = 5;
             if (IsAfterburnerRunning)
@@ -83,11 +110,61 @@ namespace KsDumper11
                 }
             }
 
+            int idx = 0;
+            int providerID = 0;
+
+            if (File.Exists(workingProvidersPath))
+            {
+                UpdateStatus($"Saved providers found, trying each provider until one works...", 50);
+                Thread.Sleep(1000);
+                string provsStr = File.ReadAllText(workingProvidersPath);
+                string[] parts = provsStr.Split('|');
+                foreach (string provider in parts)
+                {
+                    workingProviders.Add(int.Parse(provider));
+                }
+
+                while (!DriverInterface.IsDriverOpen("\\\\.\\KsDumper"))
+                {
+                    if (idx == workingProviders.Count)
+                    {
+                        retryCountDown = 3;
+                        while (retryCountDown != 0)
+                        {
+                            UpdateStatus($"Driver failed to start, no saved providers worked! Exiting in {retryCountDown}s", 50);
+                            Thread.Sleep(1000);
+                            retryCountDown -= 1;
+                        }
+
+                        Environment.Exit(0);
+                        break;
+                    }
+
+                    providerID = workingProviders[idx];
+                    tryLoad(providerID);
+
+                    if (!DriverInterface.IsDriverOpen("\\\\.\\KsDumper"))
+                    {
+                        UpdateStatus($"Saved Provider: {providerID} failed!", 50);
+                        Thread.Sleep(1000);
+                        idx++;
+                        continue;
+                    }
+                    else
+                    {
+                        UpdateStatus($"Saved Provider: {providerID} worked!", 100);
+                        Thread.Sleep(1000);
+                        LoadedDriver();
+                        return;
+                    }
+                }
+            }
+
             string logPath = Environment.CurrentDirectory + "\\driverLoading.log";
 
             Thread.Sleep(750);
 
-            UpdateStatus("Starting driver...", 50);
+            UpdateStatus("Starting driver with default provider #1", 50);
 
             string args = " /c " + Environment.CurrentDirectory + "\\Driver\\kdu.exe -prv 1 -map .\\Driver\\KsDumperDriver.sys > " + "\"" + logPath + "\"";
 
@@ -99,26 +176,144 @@ namespace KsDumper11
             };
             Process proc = Process.Start(inf);
             proc.WaitForExit();
+
             if (!DriverInterface.IsDriverOpen("\\\\.\\KsDumper"))
             {
                 retryCountDown = 3;
 
-                while (retryCountDown != 0)
+                UpdateStatus("Scanning for working providers...", 50);
+                while (!DriverInterface.IsDriverOpen("\\\\.\\KsDumper"))
                 {
-                    UpdateStatus($"Driver failed to start! Exiting in {retryCountDown}s", 0);
+                    if (providerID == 31)
-                    Thread.Sleep(1000);
+                    {
-                    retryCountDown -= 1;
+                        if (workingProviders.Count > 0)
+                        {
+                            providerID = workingProviders[rnd.Next(0, workingProviders.Count - 1)];
+                            UpdateStatus("Saving working providers!", 50);
+                            Thread.Sleep(500);
+                            saveProviders();
+
+                            tryLoad(providerID);
+
+                            if (DriverInterface.IsDriverOpen("\\\\.\\KsDumper"))
+                            {
+                                LoadedDriver();
+                                return;
+                            }
+                            else
+                            {
+                                retryCountDown = 3;
+                                while (retryCountDown != 0)
+                                {
+                                    UpdateStatus($"No working providers found! Exiting in {retryCountDown}s", 50);
+                                    Thread.Sleep(1000);
+                                    retryCountDown -= 1;
+                                }
+
+                                Environment.Exit(0);
+                            }
+                        }
+                        else
+                        {
+                            retryCountDown = 3;
+                            while (retryCountDown != 0)
+                            {
+                                UpdateStatus($"No working providers found! Exiting in {retryCountDown}s", 50);
+                                Thread.Sleep(1000);
+                                retryCountDown -= 1;
+                            }
+
+                            Environment.Exit(0);
+                        }
+                    }
+                    if (providerID == 1 || providerID == 7 || providerID == 29 || providerID == 28)
+                    {
+                        providerID++;
+                        continue;
+                    }
+
+                    tryLoad(providerID);
+
+                    if (!DriverInterface.IsDriverOpen("\\\\.\\KsDumper"))
+                    {
+                        UpdateStatus($"Provider: {providerID} failed!", 50);
+                        Thread.Sleep(1000);
+                        providerID++;
+                        continue;
+                    }
+                    else
+                    {
+                        UpdateStatus($"Provider: {providerID} works", 50);
+                        workingProviders.Add(providerID);
+                        DriverInterface.OpenKsDumperDriver().UnloadDriver();
+                        Thread.Sleep(1000);
+                        providerID++;
+                        continue;
+                    }
                 }
 
-                Environment.Exit(0);
+                if (!DriverInterface.IsDriverOpen("\\\\.\\KsDumper"))
+                {
+                    while (retryCountDown != 0)
+                    {
+                        UpdateStatus($"Driver failed to start! Exiting in {retryCountDown}s", 0);
+                        Thread.Sleep(1000);
+                        retryCountDown -= 1;
+                    }
+
+                    Environment.Exit(0);
+                }
             }
 
-            UpdateStatus("Driver Started!...", 100);
+            UpdateStatus("Driver Started!", 100);
             Thread.Sleep(750);
 
             LoadedDriver();
         }
 
+        void tryLoad(int providerID)
+        {
+            UpdateStatus($"Starting driver with provider: {providerID}", 50);
+            int timeout = 5;
+            int retryCountDown = 5;
+
+            string logPath = logFolder + $"\\driverLoading_ProviderID_{providerID}.log";
+
+            string args = " /c " + Environment.CurrentDirectory + $"\\Driver\\kdu.exe -prv {providerID} -map .\\Driver\\KsDumperDriver.sys > " + "\"" + logPath + "\"";
+
+            ProcessStartInfo inf = new ProcessStartInfo("cmd")
+            {
+                Arguments = args,
+                CreateNoWindow = true,
+                UseShellExecute = false,
+            };
+            Process proc = Process.Start(inf);
+            if (!proc.WaitForExit(10000))
+            {
+                proc.Kill();
+            }
+
+            if (proc.ExitCode == 1)
+            {
+                Thread.Sleep(750);
+            }
+            //if (!DriverInterface.IsDriverOpen("\\\\.\\KsDumper"))
+            //{
+            //    retryCountDown = 3;
+
+            //    while (retryCountDown != 0)
+            //    {
+            //        UpdateStatus($"Driver failed to start! Exiting in {retryCountDown}s", 0);
+            //        Thread.Sleep(1000);
+            //        retryCountDown -= 1;
+            //    }
+
+            //    Environment.Exit(0);
+            //}
+
+            //UpdateStatus("Driver Started!...", 100);
+        }
+
         public SplashForm()
         {
             InitializeComponent();
@@ -132,7 +327,14 @@ namespace KsDumper11
             //StartProgressBar();
             Task.Run(() =>
             {
-                StartDriver();
+                try
+                {
+                    StartDriver();
+                }
+                catch (Exception ex)
+                {
+                    return;
+                }
             });
         }
 

README.md

@@ -1,6 +1,12 @@
 # KsDumper-11
 https://user-images.githubusercontent.com/78676320/213967527-ba0d435d-9d92-467d-bd9f-4e85f947dfa0.mp4
 
+## Whats new v1.2
+- KsDumper will now try and start the driver using the default kdu exploit provider #1 (RTCore64.sys)
+- If the default provider does not work, KsDumper will scan all kdu providers and save each one that works into a list.
+- Anytime kdu loads and it detects a saved providers list, it will try to load the KsDumper driver using each saved provider until one works.
+- This technique should increase the amount of systems that the driver will be able to be loaded on. 
+
 ## Support
 You can join the official KsDumper 11 discord server where I will be managing ongoing issues. 
 I am starting to see multiple people who's system the Rtcore64 exploit fails to work on.
@@ -9,6 +15,7 @@ Please keep in mind that until others volunteer to help in development of this t
 https://discord.gg/6kfWU3Ckya
 
 ## Features
+- Auto detection of working kdu exploit providers.
 - Auto dumping of selected exe.
 - Unloading the KsDumper kernel driver is now supported! An option was added to unload on program exit, or system shutdown/restart.
 - Splash screen for when driver is being loaded