KsDumper 11 v1.3.5

Whats new v1.3.5

• Updated KDU to v1.5.0
  • Provider Selector now displays the new KDU v1.5.0 provider metadata: Advisory, Image Size, File Hash (SHA1), Authenticode Hash (SHA1), Page Hash (SHA1), and Page Hash (SHA256)
  • Improved KDU provider parsing to handle the v1.5.0 provider list format, including provider names that contain extra commas/CVE IDs
  • KDU self-extraction now compares embedded binary lengths against the on-disk files, forcing re-extraction when bundled KDU binaries are updated
• Added module enumeration and module dumping
  • New "View Modules" context-menu option on the process list
  • Added new ModuleForm window for browsing loaded modules of a target process
  • View loaded modules for a target process (name, base address, size, path)
  • Dump a selected module to a DLL/EXE file via the kernel driver
  • Module enumeration is supported by the driver, including WoW64 processes
• Added IAT reconstruction / import table rebuilding
  • The dumper now enumerates loaded modules and scans for import pointers
  • A new .idata section is synthesized with reconstructed import descriptors, lookup tables, hint/name entries, and IAT
  • Import directory and IAT data directories are updated so dumped executables can resolve imports more reliably
• Added kernel driver support for module enumeration
  • New IOCTL: IO_GET_PROCESS_MODULES
  • Kernel module info structure and user-mode bridge structures added
  • ProcessLister now walks PEB/LDR module lists for both 64-bit and WoW64 processes
• ProcessSummary constructor is now public to support synthetic module dumping
• Updated project version to 1.3.5