_{Dark Mode　|　Light Mode}

A high-coverage open-source Windows ARK and kernel analysis suite

Ksword5.1 is an open-source Windows ARK, kernel-debugging, and system-forensics suite. It includes the full Qt/ADS desktop application, the lightweight native Win32 KswordARKLight, the KswordARKDriver kernel driver, a CLI, desktop helper components, and an optional installer.

The current codebase focuses on R3/R0 cross-view evidence, PDB/DynData-driven offsets, read-only audit pages, and explicit gates for destructive or mutation-oriented actions.

• Ksword5.1: full Qt application with ADS dock layout and the complete ARK workflow.
• KswordARKLight: lightweight native Win32 ARK for older systems and low-resource environments, with simpler dependencies, faster startup, and a focused feature set.
• Launcher: pure Win32 startup and compatibility assistant. It checks the readable support manifest before launching the Qt or Light target and can prepare an offline developer collection bundle when loaded kernel modules have missing offsets.
• KswordARKDriver: kernel driver that implements process, thread, handle, memory, network, kernel-object, device, and security audit protocols.
• KswordCLI: command-line interface for automation, validation, and troubleshooting.
• KswordSetup: optional installer that extracts the release payload and creates shortcuts or integration settings. Manually extracting the full Release\ directory is functionally equivalent.
• Taskbar, KswordHUD, and APIMonitor_x64: helper components for desktop integration, HUD, and API monitoring.

• Process, thread, CID, and handle cross-view; hidden-object evidence; thread-stack inspection; process details; PDB field diagnostics; and guarded R0 actions.
• Memory-region browsing, search, hex viewing, bookmarks and breakpoints, R0 memory paths, kernel executable-memory scanning, memory evidence, and PTE/VA translation.
• Packet monitoring, connection management, per-process throttling, request construction, HTTPS analysis, firewall/WFP views, NIDS, segmented downloads, and TCP/UDP/AFD/WFP/NDIS/NSI audit views.
• Driver services, loaded modules, DriverObject/DeviceObject/MajorFunction/FastIo diagnostics, Driver Integrity, Module Cross-View, Unloaded/PiDDB evidence, SSDT/SSSDT, hooks, callbacks, and object-namespace inspection.
• File management and recovery, hashes, signatures, PE/strings/hex views, file unlocker, minifilter/FileObject/Section/storage evidence, hardware utilization, disk monitoring, device trees, and R0 device-stack audits.
• AppLocker, WDAC/Code Integrity, Defender/ASR, VBS/Hyper-V, platform security, driver trust, and event-log diagnostics.
• ADS layout persistence and restoration, lazy initialization of visible docks, top-menu settings, UIAccess/always-on-top policies, log and task-progress panels, and the Taskbar top AppBar with the S O S Enter quick launch.

This inventory is based on recent code, comments, dock-initialization logic, and the R0/R3 protocols. See docs/OpenArk功能对照与TODO.md for the OpenArk coverage comparison and remaining TODOs.

Settings have moved from the primary docks to the top menu; the main workspace includes the Miscellaneous dock.

KswordARKLight is a lightweight ARK for earlier systems, low-resource environments, and rapid-response scenarios:

• It is implemented in native Win32/C++; its entry point, docks, controls, themes, and placeholder pages do not depend on Qt.
• Modules load on demand: inexpensive placeholder pages are created at startup, then real pages are materialized when a dock is activated to reduce startup stalls.
• Current modules cover processes, memory, registry, files, drivers, kernel, monitoring, hardware, windows, startup items, networking, handles, and miscellaneous security.
• It reuses the shared/driver/ protocols and ArkDriverClient-style wrappers, and is connected to real KswordARK driver calls.
• DriverService can restore KswordARK.sys from EXE resources when needed, then install, start, stop, and query the service through SCM.
• Recent updates include lightweight kernel-UI layering; monitoring, window, startup, file, and process icons; process-difference highlighting; driver-page details; and unload IOCTL support.

KswordSetup is a convenience installer for the release package, not a runtime requirement:

• The build script embeds the Release\ payload into the installer as RCDATA.
• During installation, it extracts files, can optionally write appearance/startup settings, and creates desktop and Start-menu shortcuts.
• It can trigger UAC when needed for system-level options such as Task Manager replacement and test signing.
• If a complete Release\ directory is already available, extracting it to a target directory and running the main program is functionally equivalent.

• Shared R0/R3 protocols live under shared/driver/; new IOCTL headers, structures, and version fields must not be scattered across UI or driver-private directories.
• Driver IOCTL handlers are registered through KswordARKDriver/src/dispatch/ioctl_registry.c. ioctl_dispatch.c is limited to lookup, validation, invocation, logging, and request completion.
• User-mode access to the KswordARK device goes through Ksword5.1/Ksword5.1/ArkDriverClient/ or the corresponding lightweight wrapper. Dock/UI code must not open the device or issue raw DeviceIoControl calls.
• PDB/DynData uses profile packs generated by tools/pdb_offset_generator/. Release packages should prioritize ark_dyndata_pack_v3.json; the driver also supports v4 typed-item apply/query and capability/missing-item diagnostics.
• R0 features that depend on undocumented fields must declare their required capability. The dispatch layer applies the gate before the handler; missing DynData or a mismatched profile must degrade safely or fail closed.
• Audit pages should be read-only by default. Unload, delete, patch, bypass, disk-write, and similar mutation actions require a separate entry point, risk notice, and rollback/audit strategy.
• The first DynData phase uses the vendored System Informer dynamic-offset data in third_party/systeminformer_dyn/. Ksword integrates only the KphDynConfig data and a lightweight parser, not the KPH communication layer, object system, or session tokens.
• The DynData R0/R3 protocol is centralized in shared/driver/KswordArkDynDataIoctl.h. KernelDock's Dynamic Offsets page uses ArkDriverClient to show profile matches, field sources, and capability gates; when the driver loads, the main window automatically refreshes and applies the DynData profile.
• Process extended information uses the v2 protocol in shared/driver/KswordArkProcessIoctl.h to provide session, full image path, Protection/SignatureLevel, ObjectTable/SectionObject availability, field source, and DynData capability. ProcessDock/ProcessDetail shows availability only and does not enumerate the handle table or Section directly when DynData is missing.
• Recoverable R0 process hiding uses IOCTL_KSWORD_ARK_SET_PROCESS_VISIBILITY. The driver changes _EPROCESS.UniqueProcessId and unlinks ActiveProcessLinks while retaining the PspCidTable record, allowing restoration by the original PID.
• The unified driver status/capability protocol is in shared/driver/KswordArkCapabilityIoctl.h. KernelDock's Driver Status page shows Driver Loaded/Missing, Protocol Mismatch, DynData Missing, Limited, security policy, the most recent R0 error, and the feature-capability matrix.
• R0 PPL changes require KSW_CAP_PROCESS_PROTECTION_PATCH. The user-mode confirmation dialog must show the current/target Protection, SignatureLevel impact, field source, and rollback risk.
• New source files must be added to the corresponding .vcxproj and .vcxproj.filters files. Third-party integrations must keep their upstream license text.

• Ksword5.1/: main solution and full Qt application.
• KswordARKLight/: lightweight native Win32 ARK.
• KswordARKDriver/: kernel driver.
• shared/driver/: shared IOCTL protocol headers.
• KswordCLI/: command-line tool.
• KswordSetup/: optional installer and payload-generation scripts.
• Taskbar/: top AppBar, status display, and S O S Enter quick launch of the main application.
• KswordHUD/: HUD helper application.
• APIMonitor_x64/: API Monitor injection and monitoring component.
• tools/pdb_offset_generator/: PDB offset/profile-pack generation and validation tools.
• docs/pdb_r0_audit_prep/: PDB/R0 audit-preparation and acceptance documents.
• third_party/systeminformer_dyn/: vendored System Informer DynData snapshot with LICENSE/NOTICE and Ksword wrapper headers.
• KSwordDEV/Website: independently maintained product website and module documentation.

• Windows 10/11 x64.
• Visual Studio 2022, MSVC, and MSBuild.
• Qt 6.9.3 msvc2022_64 for the full Qt application and helper UI projects. KswordARKLight does not require Qt.
• WDK is required for building the kernel driver.

Use the repository script first to discover and store the local Qt path, avoiding machine-specific paths in individual .vcxproj files:

# Run from the repository root; replace the path with the local Qt installation
.\Setup-QtPaths.ps1 -QtDir 'C:\Qt\6.9.3\msvc2022_64'

# Replace this MSBuild path for the local Visual Studio installation; a Developer PowerShell can use msbuild directly
$msbuild = 'C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\MSBuild.exe'

# Build the full solution, including the main application, Taskbar, HUD, driver, CLI, installer, and lightweight edition
& $msbuild '.\Ksword5.1\Ksword5.1.sln' /t:Build /p:Configuration=Debug /p:Platform=x64 /m

Build only the lightweight ARK:

& $msbuild '.\KswordARKLight\KswordARKLight.vcxproj' /t:Build /p:Configuration=Release /p:Platform=x64 /m

Build the native launcher and generate the readable release support manifest:

& $msbuild '.\Launcher\Launcher.vcxproj' /t:Build /p:Configuration=Release /p:Platform=x64 /m

If the current machine does not have a WDK or driver-signing environment, build the user-mode projects first. The release process can reuse an existing unsigned R0 release artifact.

• A release archive should contain a Release\ root with Launcher.exe, Ksword5.1.exe, KswordARKLight.exe, helper programs, driver, profiles\launcher_support_manifest.json, the DynData packs, Qt dependencies, and Qt plugin directories. Shortcuts and the installer post-install action launch Launcher.exe.
• KswordSetup.exe is optional. Extracting Release\ and running Launcher.exe is the supported entry point; it chooses Ksword5.1.exe or KswordARKLight.exe after checking compatibility.
• R0 features require administrator privileges, a running driver service, and compatible system security settings. Test-signing and driver-signing requirements depend on the target system.

The KSwordDEV/Website repository independently maintains the project website and module introductions.

This project includes system-level debugging, auditing, and management capabilities. Use it only in legally authorized and compliant environments.

Ksword is free software under GNU GPL version 3 only. Use it, study it, change it, share it, sell it, or build services around it—just follow GPLv3 and provide the matching source when you distribute binaries. Third-party components keep their own licenses.

Except where a file says otherwise, Ksword's own code is GPLv3-only. The Ksword Community Covenant is about honesty, attribution, responsible use, and not pretending an unofficial fork is official. It is a community promise, not another layer of license restrictions. Contributions follow CONTRIBUTING.md.