OPERATOR DOCUMENTATION

Operator Documentation

This manual focuses on prerequisites, execution order, safe degradation paths, rollback requirements, and fault isolation that can change the result of an operation.

Decide whether this operation requires R0

No driver required first

Browsing ordinary process lists, viewing basic file information, reading most system configuration, viewing logs, and using read-only R3 pages.

Driver required first

Cheat Engine bridging, R3/R0 cross-view, kernel memory and page tables, driver-object evidence, callback operations, protected-process operations, and any feature explicitly marked R0.

Do not treat an enabled button as proof that a feature is actually using R0.

The real requirements are that the client can open \\.\KswordARKLog, the current driver supports the target IOCTL, and the required DynData and Capability are ready.

The application, driver, profiles, and plugins must come from the same release package

Do not replace only the EXE and do not keep an old SYS.

The client classifies some ERROR_INVALID_FUNCTION, ERROR_NOT_SUPPORTED, and ERROR_INVALID_PARAMETER results as an old driver or a missing IOCTL. Mixed versions commonly produce blank pages, Unsupported states, or partial fields instead of a complete startup failure.

1
Exit KSword, Cheat Engine, and all plugin processes.
A process that still owns a device handle can make you misjudge whether the new driver is active.
2
Unload the old service before replacing the entire directory.
Do not leave the service ImagePath pointing to a SYS in an old directory.
3
Start the application from the same directory.
Use the language files, profiles, plugins, and driver from that package.

Basis: old-IOCTL classification and the unified device path in ArkDriverClient.cpp.

“Service started” does not mean the driver is usable

Service layer

The service exists
StartService succeeds
ImagePath points to the correct SYS

Communication layer

\\.\KswordARKLog opens
Protocol and IOCTL versions match
The required Capability is available

After loading the driver, check Driver Status first and DynData second. Do not begin by repeatedly clicking feature buttons.

The device cannot be opened

Check elevation, service state, signature, SYS path, and device creation. DynData is not yet the issue.

The device opens but the old driver does not support the operation

Communication exists, but the SYS lacks the control code. Restore the driver from the same release.

The IOCTL returns a failing NTSTATUS

The request reached the driver. Continue with R0 logs, target state, and parameters instead of reinstalling the service.

Basis: DriverClient::open() and deviceIoControl().

DynData determines which R0 features can run safely

Loaded means only that the channel exists. Features that depend on kernel structure offsets, global RVAs, function RVAs, or type sizes also require a profile that matches the current kernel identity and is accepted by the driver.

Matched

The local profile matches the current module identity; still verify Accepted items and Capability.

Missing items

Disable only features that depend on those fields. Do not interpret one missing item as total R0 failure.

The old driver does not support V4 queries

The application is newer than the driver. Copying a JSON file cannot repair a protocol mismatch.

Profile mismatch

Do not reuse offsets from a “similar” Windows version. Incorrect offsets may be more dangerous than a safe feature downgrade.

After a Windows update, check DynData before making kernel changes.

Even the same Windows major version may use a different kernel build and PDB identity.

Basis: matched, accepted, missing, and capability states in KernelDock.DynData.cpp.

Cheat Engine must be launched from KSword

Load R0 first, select the process, and launch CE from the KSword action.

The integrated launcher checks the device, configures the bridge DLL, state file, and target PID, and then starts the bundled CE. The Lua bootstrap loads the bridge before opening the target so the first OpenProcess goes through KSword.

Handled by the bridge

OpenProcess
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory

Not handled by the bridge

Debugger operations
Remote threads
Remote memory allocation
Page-protection changes

If the plugin cannot open \\.\KswordARKLog during initialization, it refuses to install hooks instead of silently falling back to normal Win32 memory access.
Reads are split into chunks of at most 1 MiB; writes use chunks of at most 256 KiB.
Writes include UI_CONFIRMED only and never enable FORCE automatically.
If CE was opened before the driver was loaded, close it and relaunch it from KSword so early handles and enumeration state are rebuilt.

r0_required

Cancel the launch and load the driver in KSword.

bridge_not_ready

CE was created but the bridge did not confirm Ready. Close that CE instance and do not continue scanning.

launch_failed

The bundled CE, bridge DLL, or directory structure is incomplete. Re-extract the complete plugin payload.

Basis: CheatEngineExecutablePlugin/LauncherMain.cpp, 10_ksword_bridge.lua, and KswordCeBridge.cpp.

Process operations cannot rely on PID alone

Refresh before terminating, suspending, changing protection, hiding, or applying batch operations.

KSword identifies processes with PID + creationTime100ns because exited PIDs are reused. A row that has remained on screen for a long time may no longer represent the original process.

Context-menu and batch actions on an application-group row apply to every real member in the group.
The friendly application view and parent-child tree show different relationships. Switch back to the parent-child tree before reasoning about process ancestry.
Do not use PID 0, PID 4, the current KSword process, or critical system processes as write-operation test targets.
Before hiding a process, record its path, creation time, and original PID. Recovery depends on records maintained by the driver, so do not unload the driver before recovery completes.
A difference between R3 and R0 enumeration is evidence. Do not delete or hide objects merely to make the lists match.

Basis: process identity, application-group batch actions, and R0 visibility records.

A successful read does not mean write requirements are satisfied

Read succeeds, write fails

Page protection, driver write policy, or target state rejected the write. The CE bridge does not take over VirtualProtectEx and does not enable FORCE automatically.

Partial Copy

A chunk was not returned in full. Confirm that the process did not exit or change, then reduce the address range. Do not treat partial data as a complete scan result.

Memory-region enumeration stalls

The bridge rejects zero-length, out-of-range, or non-covering regions to prevent an infinite CE loop. Check for mixed driver and client versions first.

PTE or kernel-memory pages are unavailable

Check the corresponding DynData item and Capability instead of only checking Loaded.

When the target process restarts, old addresses, handles, and scan results are invalid.
Save the original bytes before making a change.
For large operations spanning multiple regions, check the actual completed byte count rather than only the function return value.

Unlocker does not automatically close every holder

You must manually confirm the exact process and handle.

The automatic no-selection unlock path was intentionally removed to avoid closing the wrong process or a related handle. Closing a remote handle can crash the owner, discard unwritten data, or leave it in an abnormal state.

1
Inspect the file-holder list first.
Verify the process path, PID, creation time, and handle type.
2
Prefer a normal application exit.
Close a handle only when the owner cannot release it normally.
3
Handle one confirmed owner at a time.
Refresh the holder list after each action.
4
Then move, delete, or replace the file.
An empty holder list does not prove that file contents have been safely flushed.

If mapped-file lookup shows Unsupported, the current driver lacks the interface; it does not prove that no process maps the file.
Before recovery, deletion, integrity-label changes, or forced operations, copy the original file or record its metadata.

Basis: the manual process-selection safety change in Unlocker and R0 mapped-file queries.

Collect evidence before modifying kernel state

Callback removal, hook modification, and driver unloading all change the investigated system.

Export the current address, owning module, signature, source view, and timestamp first. Refresh after the change instead of reasoning from the old table.

Callback and module states change. Refresh immediately before the operation and confirm that the target still belongs to the same module.
Removing callbacks from third-party security drivers can break their internal state. Test only in a rollback-capable virtual machine.
The driver-debug-output page shows only messages allowed by the active kernel filter. No visible log does not prove that code did not run.
Preserve Partial and Unsupported states instead of filling missing fields with “normal.”
Before unloading KswordARK, close CE, stop continuous monitoring, and restore temporary state maintained by the driver.

Some network features change system state

Packet capture and NIDS

Primarily observational. A NIDS alert is not an automatic blocking conclusion; correlate it with connections, processes, and the timeline.

Connection termination and rate limiting

Directly affect active traffic. Record PID, endpoints, and protocol first.

HTTPS analysis

May involve a local proxy, system proxy configuration, and certificate state, so it is not purely read-only.

Record the current Windows proxy settings before enabling HTTPS analysis.
When finished, stop the proxy in KSword and verify that the system proxy was restored.
If browsers lose network access after an abnormal KSword exit, check the system proxy and local listening port first.
Do not run multiple tools that modify the system proxy at the same time.

“Installed successfully” and “runtime protocol works” are different states

A marketplace package must be downloaded, verified, and extracted completely. The runtime entry is defined by runtime and entrypoint in plugin.json; a source file is not automatically executable.
Executable plugins report ready, progress, results, and completion through JSON Lines. Raw text or invalid JSON is not converted into structured scan results.
If the scan page remains in a waiting state, inspect the plugin process, exit code, stderr, and protocol events before repeatedly reopening the UI.
Cancellation guarantees only that the host starts its terminate or cancel flow. Child processes and external state created by the plugin still require inspection.
Close running instances before updating a plugin so old DLLs or EXEs are not still locked.

The CE plugin is a hybrid executable, not a normal scanner plugin.

It has independent driver-check, launch, tab, and info commands and maintains a persistent driver session.

Basis: PluginHost.cpp, plugin manifests, and the scan-table protocol.

Prepare rollback material before editing the registry, startup entries, services, or disks

Registry

Export the target key before editing it. Preserve value type, data, and permissions, not only a screenshot.

Startup entries and services

Record the original start type, ImagePath, account, and dependencies. Confirm that a service is not a shared driver service before deleting it.

Disk editing

Save the target range or a complete image before any raw-sector write. Do not test writes on the system disk.

“Optimization” does not mean safe for every machine. Apply changes individually and reboot-test before continuing.
A successful service stop does not prove that its driver object, device, or filters were cleaned up safely.
Undoing a disk write depends on saved original bytes, not UI history.

R0 changes require a controlled shutdown order

1
Stop new scans, monitors, and plugin tasks.
Wait for Current Operations to clear or explicitly cancel them.
2
Close CE and plugins that own KswordARK device handles.
Prevent an old session from calling a driver that is being unloaded.
3
Restore temporary changes.
This includes hidden processes, proxy settings, test state, and other recoverable system changes.
4
Export logs and evidence.
Keep the refreshed post-change result together with the pre-change snapshot.
5
Unload the driver or exit KSword last.
Do not treat driver unload as an automatic rollback for every kernel modification.

Map each symptom to the correct layer

Every R0 page is unavailable

Check the device handle, elevation, service, and signature before changing profiles.

Only some R0 pages are unavailable

Check the feature IOCTL, Missing items, and Capability. The whole driver usually has not failed.

CE starts but does not open the target automatically

Bridge initialization or delayed openProcess(pid) failed. Close CE and relaunch it from KSword.

CE reads but cannot write

The write policy or page conditions are not satisfied. The bridge does not FORCE and does not change page protection.

The file still appears locked

Refresh the holder list and check for mappings, a second handle, or a newly created process instance.

Network access fails after leaving the network tools

Check the system proxy, certificate state, and local proxy process before resetting the network stack.

A plugin installs but produces no result

Inspect the manifest entry, exit code, stderr, and JSONL events.

Many features show Unsupported after an update

Confirm that the EXE, SYS, profiles, and plugins came from the same release.

Include at least the following in an Issue

Version combination

The source release for KSword, SYS, plugins, and profiles.

Target identity

PID, path, creation time, and Windows build.

R0 state

Device-open result, protocol error, Missing items, and Capability.

Exact error

Win32 Error, NTSTATUS, event code, and timestamp.

Execution order

The startup order for the driver, KSword, plugins, and CE, including whether files were replaced during the session.

Open a GitHub Issue ↗