Kernel_WSK_RMA is a Windows kernel WSK RMA driver for controlled DMA and memory research test environments.

English | 中文

Kernel_WSK_RMA is a Windows kernel driver that provides remote memory access over TCP/IP by using Windows Sockets Kernel (WSK). It is designed to work with LeechCore for remote DMA-style memory acquisition in controlled DMA, game security, and cheat research test environments.

Keywords: Windows Kernel, WSK, RMA, DMA, CHEAT, LeechCore, Memory Acquisition, Driver Research.

• Physical Memory Read/Write: Direct physical memory access.
• Virtual Memory Read/Write: Process virtual memory operations.
• Scatter Read: Batch physical memory reading.
• Process Enumeration: List running processes with basic details.
• Module Enumeration: List loaded kernel modules.
• Kernel Information: Query kernel base, DTB, and related addresses.
• UDP Discovery: Auto-discovery on UDP port 53.
• LeechCore Compatible: Provides an RMA device backend for LeechCore.

+-------------------------------+
|        LeechCore Client       |
|          User Mode            |
+---------------+---------------+
                |
              TCP/IP
                |
+---------------+---------------+
|         WSK_RMA Driver        |
|          Kernel Mode          |
|                               |
|  wsk_utils.c        WSK I/O   |
|  rma_server.c       Protocol  |
|  memory_ops.c       Memory    |
|  stealth_protocol.h Packets   |
+-------------------------------+

Requirements:

• Visual Studio 2022
• Windows Driver Kit (WDK) 10

msbuild 驱动\WSKRMA.sln /p:Configuration=Release /p:Platform=x64

You can also open 驱动\WSKRMA.sln in Visual Studio 2022 and build Release|x64.

leechcore -device rma://192.168.1.100

The driver exposes its TCP service port through UDP discovery.

WSK_RMA/
|-- 驱动/                         Driver source code
|   |-- driver.c                  Entry point
|   |-- wsk_utils.c/.h            WSK helpers
|   |-- rma_server.c/.h           RMA server
|   |-- memory_ops.c/.h           Memory operations
|   `-- stealth_protocol.h        Protocol definitions
`-- LeechCore部分/                LeechCore integration
    |-- leechcore/                LeechCore source
    `-- includes/                 Public headers

Kernel_WSK_RMA 是一个 Windows 内核驱动，通过 WSK（Windows Sockets Kernel）在 TCP/IP 上提供远程内存访问能力。项目用于受控 DMA、游戏安全和 CHEAT 研究测试环境，并配合 LeechCore 的 RMA 设备后端进行远程 DMA 风格的内存采集。

关键词：Windows Kernel、WSK、RMA、DMA、CHEAT、LeechCore、Memory Acquisition、Driver Research。

• 物理内存读写：直接访问物理内存。
• 虚拟内存读写：对指定进程执行虚拟内存操作。
• 批量读取：支持 scatter read 批量读取物理内存。
• 进程枚举：列出运行中的进程及基础信息。
• 模块枚举：列出内核模块信息。
• 内核信息：获取内核基址、DTB 以及相关地址。
• UDP 发现：通过 UDP 53 端口自动发现 TCP 服务端口。
• LeechCore 兼容：为 LeechCore 提供 RMA 设备后端。

+-------------------------------+
|        LeechCore 客户端       |
|          用户态               |
+---------------+---------------+
                |
              TCP/IP
                |
+---------------+---------------+
|        WSK_RMA 驱动           |
|          内核态               |
|                               |
|  wsk_utils.c        WSK 网络  |
|  rma_server.c       RMA 协议  |
|  memory_ops.c       内存操作  |
|  stealth_protocol.h 协议定义  |
+-------------------------------+

环境要求：

• Visual Studio 2022
• Windows Driver Kit (WDK) 10

msbuild 驱动\WSKRMA.sln /p:Configuration=Release /p:Platform=x64

也可以在 Visual Studio 2022 中打开 驱动\WSKRMA.sln，选择 Release|x64 编译。

leechcore -device rma://192.168.1.100

驱动会通过 UDP 发现响应告知实际 TCP 服务端口。

WSK_RMA/
|-- 驱动/                         驱动源码
|   |-- driver.c                  入口点
|   |-- wsk_utils.c/.h            WSK 网络封装
|   |-- rma_server.c/.h           RMA 服务
|   |-- memory_ops.c/.h           内存操作
|   `-- stealth_protocol.h        协议定义
`-- LeechCore部分/                LeechCore 集成
    |-- leechcore/                LeechCore 源码
    `-- includes/                 公共头文件

MIT License - See individual components for their respective licenses.

• LeechCore - Physical Memory Acquisition Library
• MemProcFS - Memory Process File System