Dark Mode | Light Mode
Source-available Windows ARK & kernel analysis suite
KSword is an ARK (Anti-Rootkit) and system analysis toolkit for Windows 10/11 x64. It ships a desktop app and a kernel driver together — the app enumerates processes, drivers, connections, etc. from user mode, the driver does the same from Ring 0, and then they compare. Discrepancies mean something is hiding.
On top of that, there is a full set of system tools: memory search & hex editing, PE/ELF/Mach-O scanning, packet capture, raw NTFS forensics, SSDT/callback/hook inspection, registry & startup auditing, device-stack tracing, and security policy checks — roughly what you'd otherwise piece together from ten different programs.
All audit pages are read-only by default. Anything that modifies the system (driver unload, disk write, protection-level change, etc.) is behind a separate button with a confirmation dialog and undo where possible. When a kernel offset or feature isn't available on the current build, the UI says so instead of guessing.
Source-available under the KSword Community Source License v1.6 (not OSI-approved — see License).
Extract the release archive, run Launcher.exe as admin. It reads the support manifest and starts the right edition.
KswordSetup.exe is an optional installer that does the same thing plus creates shortcuts.
Important
R0 features need the KswordARK driver loaded. Without it the app still works, but kernel-side pages will show "unavailable."
| Ksword5.1 | KswordARKLight | |
|---|---|---|
| Stack | Qt 6 / ADS dockable workspace | Native Win32, no runtime dependencies |
| Use case | Full workflow | Old machines, quick triage, minimal footprint |
Both use the same driver and the same shared/driver/ protocol. Launcher picks for you.
Process / Thread / Handle — tree & list views, R3/R0 cross-view to detect hidden objects, thread stacks, modules, tokens, PDB diagnostics. Gated actions for kill, suspend, R0 hide (recoverable), PPL patch.
Memory — region browser, pattern search, hex viewer, bookmarks, R0 reads, kernel executable-memory scan, PTE translation.
Scanner — structural PE / ELF / Mach-O analysis. Byte editor is length-preserving only, checks the source snapshot before writing, atomic replace, optional backup.
Network — capture & filter, connection management, per-process throttle, request builder, HTTPS inspection, WFP firewall, NIDS, segmented download. R0 inventories: TCP / UDP / AFD / NSI / NDIS / WFP.
Driver / Kernel — service management, DriverObject / DeviceObject / MajorFunction inspection, transactional dispatch-table editor, loader-list removal (reversible), integrity & cross-view checks, unloaded-driver / PiDDB evidence. Object namespace, SSDT/SSSDT, IAT/EAT/inline hooks, callbacks (notify, registry, object, filter, bugcheck, shutdown, FS, logon, NMI, …), IDT baselines, descriptor-table & IOCTL decoding, disassembly.
File / Storage — dual-pane manager, hashes, signatures, PE/strings/hex, unlocker, NTFS recovery, minifilter & Section evidence, raw filesystem browser with deleted-entry analysis (read-only by default, write requires unlock), device tree and R0 device-stack audit.
Monitor — per-process ETW, syscall capture, WinAPI agent, WMI subscriptions, ETW session management, risk center. Task-Manager-style live charts.
Window / Registry / Handle / Startup / Service / Privilege — what you'd expect, plus Win32k GUI audit, startup-item risk gating with recovery, and service TSV/JSON export.
Security — AppLocker, WDAC, Defender/ASR, VBS/Hyper-V, driver trust, event logs.
Kernel Knowledge — 71 bilingual searchable articles, each linked to live R3/R0 evidence pages.
HVM — VMX self-test, one-shot guest, guarded Intel VT-x/EPT resident monitor, multiprocessor-capable. EPT split views (execute-only shadow pages) served by an EPTP-switching backend, so hooks work on nested hypervisors that expose no monitor-trap flag. Guided EPT-hook wizard. Refuses on AMD or incompatible config. Lab use only.
Where the HVM layer sits (and what "resident" means)
KSword HVM does not boot a second Windows. It performs a late virtualization
transition on the OS that is already running: after VMLAUNCH the original
execution context continues unchanged in VMX non-root, while KSword HVM services
its VM exits from VMX root. Nothing restarts; nothing visibly happens.
CPU
└─ Intel VT-x / EPT
└─ Hyper-V (L0) ← owns the physical virtualization layer
├─ Root Partition
│ ├─ Windows Host
│ └─ VBS / HVCI ← may stay on; it belongs to L0
│
└─ Child Partition
└─ KSword HVM (L1, VMX root)
└─ the same guest Windows
(L2, VMX non-root)
On bare metal the Hyper-V (L0) layer is simply absent and KSword HVM is L0
itself. Either way it is the same OS above and below the transition.
Resident is the mode in which that layer exists at all. A one-shot guest only
proves VMX can be entered and left; residency puts the running Windows into
non-root and keeps it there. Stop residency and every EPT-based capability —
covert hooks, split views, execution domains, R-1 process dispositions — stops
existing at the same instant, because the hardware is no longer consulting our
EPT. That is also why installing any of them requires residency to be stopped
first, and why sc stop returns 1052 while it is running.
Full write-up: 嵌套虚拟化架构.
Full dock-by-dock table (17 main + 4 auxiliary)
See also docs/OpenArk功能对照与TODO.md for the OpenArk comparison.
| Dock | Contents |
|---|---|
| Welcome | Version, build info, project links. |
| Process | Tree/list with icons & diff highlighting. Kill/suspend/resume/priority. Thread stacks, modules, tokens. R3/R0 cross-view. Recoverable R0 hiding (gated). PPL/signature ops with risk prompts. |
| Network | Capture & filter. TCP/UDP management. Per-process throttle. Request builder. HTTPS. ARP/DNS. Live hosts. WFP events & rules. NIDS. Segmented download. R0 stack inventories. |
| Memory | Region browser & search. Hex viewer + bookmarks/breakpoints. R0 reads. Kernel exec scan. Memory evidence. PTE/VA translation. |
| File | Dual-pane manager. Hash/sig/PE/strings/hex. Unlocker. NTFS recovery. Minifilter/FileObject/Section evidence. Storage & BitLocker. |
| Scanner | PE/ELF/Mach-O structural scan. Guarded byte editor (length-preserving, atomic, optional backup). |
| Driver | Service CRUD. Loaded modules. DBWIN. DriverObj/DeviceObj/MajorFunction/FastIo. Transactional editors. Reversible loader-list removal. Integrity. Module cross-view. Unloaded/PiDDB evidence. |
| Kernel | Object namespace. Atom table. SSDT/SSSDT. Inline/IAT/EAT hooks. CID cross-view. ALPC/IPC. DynData. Capability matrix. Loaded-image & IDT baselines. Descriptor/IOCTL decode. Disassembly. Callback inventory. Kernel Knowledge (71 articles). HVM. |
| Monitor | Process ETW. Syscall capture. WinAPI agent. WMI subs. ETW provider/session mgmt. Risk center. |
| Hardware | CPU/GPU/mem/disk/net charts. Process I/O & ETW file activity. SetupAPI/CfgMgr tree. R0 device audit. |
| Privileges | Local accounts, groups, current process privileges. |
| Windows | Window enum/filter/preview/pick/control. Desktop mgmt. Message monitor. Win32k GUI/session audit. Hotkey/hook audit. |
| Registry | Tree browser. Key/value CRUD. .reg import/export. Async search. |
| Handles | PID/keyword/type filter. Named-object resolution. Type stats. HandleTable/ObjectHeader evidence. |
| Startup | Categorized across logon/service/driver/task/registry/WMI. Risk-gated changes with recovery. |
| Services | Filter/sort. Start/stop/pause. Startup type. Property editing. Dependencies. TSV/JSON export. |
| Miscellaneous | BCD/boot. Audio source attribution. System speed (with warnings). Shell association management. Read-only disk edit & raw FS forensics (write = unlock). AppLocker/WDAC/Defender/ASR diagnostics. |
Auxiliary: task progress panel, log output with GUID call-chain tracing, immediate window, real-time perf monitor.
Ksword5.1/ Full Qt app
KswordARKLight/ Lightweight Win32 edition
KswordARKDriver/ Kernel driver
Launcher/ Startup helper
KswordCLI/ CLI (docs: docs/CLI使用文档.md)
KswordSetup/ Optional installer
Taskbar/ Top AppBar (S O S Enter quick launch)
KswordHUD/ HUD overlay
APIMonitor_x64/ API monitoring helper
shared/driver/ Shared IOCTL protocol headers
tools/ PDB offset generator, build tools
docs/ Technical docs
Website: KSwordDEV/Website
Requirements: Windows 10/11, VS 2022 (MSVC), Qt 6.9.3 msvc2022_64 (not needed for Light/Launcher), WDK (driver only).
.\Setup-QtPaths.ps1 -QtDir 'C:\Qt\6.9.3\msvc2022_64'
$msbuild = 'C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\MSBuild.exe'
& $msbuild '.\Ksword5.1\Ksword5.1.sln' /t:Build /p:Configuration=Debug /p:Platform=x64 /mLight only: & $msbuild '.\KswordARKLight\KswordARKLight.vcxproj' /t:Build /p:Configuration=Release /p:Platform=x64 /m
No WDK? Build the user-mode projects and reuse an existing driver binary for the release.
Build troubleshooting
LNK1000 / IMAGE::BuildImage on the main app — do a one-off clean rebuild with WPO and LTCG off. Don't make it permanent. Check exit code and that Ksword5.1\x64\Release\Ksword5.1.exe exists and is non-zero.
WDK ApiValidator fails after the driver links — usually arch mismatch. Run standalone:
$solutionDir = (Resolve-Path '.\Ksword5.1').Path + '\'
$apiValidatorX64 = 'C:\Program Files (x86)\Windows Kits\10\bin\10.0.26100.0\x64'
& $msbuild '.\KswordARKDriver\KswordARKDriver.vcxproj' /t:ApiValidator `
/p:Configuration=Release /p:Platform=x64 /p:SolutionDir=$solutionDir `
/p:ApiValidator_ApiExtractorExePath=$apiValidatorX64 /m:1 /v:minimalProtocol headers in shared/driver/, UI talks to the driver through ArkDriverClient only, kernel offsets come from verified PDB/DynData profiles (never hardcoded), new files go in .vcxproj + .vcxproj.filters.
Details: CONTRIBUTING.md · AGENTS.md
Protocol reference
All headers under shared/driver/.
| Area | Header | Notes |
|---|---|---|
| Driver status / capabilities | KswordArkCapabilityIoctl.h |
Powers the Driver Status page. |
| Dynamic offsets | KswordArkDynDataIoctl.h |
Profile matching, field sources, capability gates. |
| Process extended info | KswordArkProcessIoctl.h (v2) |
Session, image path, protection level, field availability. |
| Process hiding | IOCTL_KSWORD_ARK_SET_PROCESS_VISIBILITY |
Unlinks from lists, keeps CID entry for restore. |
| PPL patch | KSW_CAP_PROCESS_PROTECTION_PATCH |
Gated; dialog shows impact + rollback risk. |
| Vendored offsets | third_party/systeminformer_dyn/ |
System Informer offset data only, no KPH comms. |
CLI使用文档 · 功能技术文档 · 内核知识中心 · IOCTL audit · OpenArk对照 · 动态偏移接入 · PDB/R0 audit prep · 插件系统 · 多语言规范
Virtualization (HVM): 嵌套虚拟化架构 · EPT切换后端设计 · 嵌套下的跨核TLB失效 · 隐蔽Hook安全边界决策 · 自动化测试 · VM测试机搭建
This project includes system-level debugging, auditing, and management capabilities. Use only in legally authorized environments.
KSword is source-available under the KSword Community Source License v1.6. "Open source" here means the code is visible — it is not an OSI-approved license. See LICENSE for redistribution and commercial-use terms.
The Community Covenant is about attribution and responsible use, not additional license restrictions. Contributions: CONTRIBUTING.md.
If this project helps you, consider supporting its development.
Hvm & Nested VM — the resident monitor runs multiprocessor under nested Hyper-V, with CLOAK split views verified end-to-end on 2 vCPU. Cross-core TLB invalidation, which a forwarded flush hypercall silently drops in that environment, is fixed and measured (writeup).
Two optimizations were evaluated and declined, with the readings kept so the decision can be revisited on different hardware rather than re-argued:
- Enlightened VMCS. A
VMREADcosts 0.14% of one exit here — measured by adding a known number of throwaway reads per exit and watching throughput, at three depths spanning 16x, agreeing to ±0.003. At ~10 field reads per exit that caps the win at 1.4%, against a ~150-entry mapping table and the loss of three fields the enlightened layout does not carry. The outer hypervisor turns out to run VMCS shadowing, so the premise this optimization rests on — that a nestedVMREADtraps — does not hold on this machine. The probe is kept (hvm_ctl resident-vmreadbench <n>); one command re-decides it elsewhere. - VPID. Enabling it would stop VM entry from flushing the linear mappings tagged VPID 0000H, which is precisely what makes the cross-core flush fix work — it would fail silently, back to the 97% figure above. The cost is concrete and the benefit is unmeasured, so it stays paired with that fix rather than taken alone.
Genuinely open: nested VMX. The vmcs12→vmcs02 merge path exists and runs on
every L2 entry attempt, but two-dimensional page-table composition does not, so
every attempt ends in VMfailValid (and is counted, not silently dropped).
Largest real exit cost is HLT at 62%, which the outer hypervisor forces through
the capability MSR and we cannot decline.
Anti BSOD