EquiFox/KsDumper

Health v2 · maintenance only

Adoption not part of the score

1055 stars · 219 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

KsDumper is a Windows tool that dumps process memory (including protected processes with stripped handles) using a kernel driver, rebuilding PE32/PE64 headers and sections. It was designed for reverse engineering packed or anti-cheat-protected executables.

Use cases

• dump a process protected by anti-cheat from kernel space
• rebuild PE headers and sections from a dumped process
• inspect game internals for reverse engineering
• dump x86 and x64 process main modules on Windows
• copy process memory without OpenProcess

When to choose

• you need to dump a process whose handles are stripped by anti-cheat on Windows 10 x64
• you want to learn about Windows kernel and PE file structure
• you are working in a virtual machine for educational reverse engineering

When to avoid

• you are on Windows 11 - the Capcom driver is patched and this repo is outdated (use KsDumper-11 fork instead)
• you need import table reconstruction - it is not rebuilt
• you need a maintained or stealthy tool - it makes no attempt to hide and may trigger anti-cheat bans
• you are on 32-bit Windows - it requires x64 Windows

Facets

cli-tool · maturity abandoned

reverse-engineering security security reverse-engineering windows windows dotnet process-dumping kernel-driver pe-reconstruction anti-cheat-bypass capcom-driver portable-executable

Member repositories

For agents

markdown · JSON · MCP: product_card(name="EquiFox/KsDumper")