Source [Release] Rust Material Dumper — DLL with Automation Support

[byte_corvus]

If you are deep into building custom chams or just need to dump Rust materials for asset analysis, this dumper is a solid addition to the kit. It is a user-friendly DLL that provides progress feedback and supports custom output filenames, making it much easier to integrate into your own automation pipelines.

Core Features

1. Real-time progress tracking during the dump process.
2. Standard injection compatibility (works fine with Process Hacker or your own manual mapper).
3. Custom output path support via export parameters.
4. Clean material extraction from the RustClient process.

Automation & Injection Logic
While you can shove this into the game manually, the real value is in the automation support. The dumper expects a StartDump export that takes the output path as a parameter.

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Text;
 
namespace RustDumperNET
{
    static class Injector
    {
        const uint PROCESS_ALL_ACCESS = 0x001F_0FFF;
        const uint MEM_COMMIT = 0x0000_1000;
        const uint MEM_RESERVE = 0x0000_2000;
        const uint MEM_RELEASE = 0x0000_8000;
        const uint PAGE_READWRITE = 0x04;
        const uint INFINITE = 0xFFFF_FFFF;
 
        const uint DONT_RESOLVE_DLL_REFERENCES = 0x0000_0001;
 
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr OpenProcess(uint dwAccess, bool bInherit, int dwPid);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddr,
            IntPtr dwSize, uint flType, uint flProtect);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddr,
            IntPtr dwSize, uint dwFreeType);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddr,
            byte[] lpBuffer, IntPtr nSize, out IntPtr lpWritten);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpAttr,
            IntPtr dwStackSize, IntPtr lpStartAddr, IntPtr lpParam,
            uint dwFlags, out uint lpThreadId);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMs);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool CloseHandle(IntPtr hObject);
 
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
        static extern IntPtr LoadLibraryA(string lpFileName);
 
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
        static extern IntPtr LoadLibraryExA(string lpFileName, IntPtr hFile, uint dwFlags);
 
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
        static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        static extern bool FreeLibrary(IntPtr hModule);
 
        public static void InjectAndRun(Process target, string dllPath,
            string outputPath, bool waitForCompletion = true)
        {
            string fullDllPath = Path.GetFullPath(dllPath);
            if (!File.Exists(fullDllPath))
                throw new FileNotFoundException($"DLL not found: {fullDllPath}");
 
            IntPtr hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, target.Id);
            if (hProcess == IntPtr.Zero)
                throw new InvalidOperationException(
                    $"OpenProcess failed (error {Marshal.GetLastWin32Error()})");
            try
            {
                InjectDll(hProcess, fullDllPath);
 
                IntPtr remoteStartDump = ResolveRemoteExport(target, fullDllPath, "StartDump");
 
                byte[] pathBytes = Encoding.UTF8.GetBytes(outputPath + '\0');
                IntPtr remotePath = VirtualAllocEx(hProcess, IntPtr.Zero,
                    (IntPtr)pathBytes.Length, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
                if (remotePath == IntPtr.Zero)
                    throw new InvalidOperationException(
                        $"VirtualAllocEx (path) failed (error {Marshal.GetLastWin32Error()})");
 
                if (!WriteProcessMemory(hProcess, remotePath, pathBytes,
                        (IntPtr)pathBytes.Length, out _))
                    throw new InvalidOperationException(
                        $"WriteProcessMemory (path) failed (error {Marshal.GetLastWin32Error()})");
 
                IntPtr hDumpThread = CreateRemoteThread(hProcess, IntPtr.Zero, IntPtr.Zero,
                    remoteStartDump, remotePath, 0, out _);
                if (hDumpThread == IntPtr.Zero)
                    throw new InvalidOperationException(
                        $"CreateRemoteThread (StartDump) failed (error {Marshal.GetLastWin32Error()})");
 
                if (waitForCompletion)
                    WaitForSingleObject(hDumpThread, INFINITE);
 
                CloseHandle(hDumpThread);
            }
            finally
            {
                CloseHandle(hProcess);
            }
        }
 
        // -------------------------------------------------------------------------
 
        static void InjectDll(IntPtr hProcess, string fullDllPath)
        {
            byte[] pathBytes = Encoding.ASCII.GetBytes(fullDllPath + '\0');
 
            IntPtr remoteDllPath = VirtualAllocEx(hProcess, IntPtr.Zero,
                (IntPtr)pathBytes.Length, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
            if (remoteDllPath == IntPtr.Zero)
                throw new InvalidOperationException(
                    $"VirtualAllocEx (DLL path) failed (error {Marshal.GetLastWin32Error()})");
            try
            {
                if (!WriteProcessMemory(hProcess, remoteDllPath, pathBytes,
                        (IntPtr)pathBytes.Length, out _))
                    throw new InvalidOperationException(
                        $"WriteProcessMemory (DLL path) failed (error {Marshal.GetLastWin32Error()})");
 
                IntPtr hKernel32 = LoadLibraryA("kernel32.dll");
                IntPtr loadLibraryA = GetProcAddress(hKernel32, "LoadLibraryA");
                FreeLibrary(hKernel32);
 
                IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, IntPtr.Zero,
                    loadLibraryA, remoteDllPath, 0, out _);
                if (hThread == IntPtr.Zero)
                    throw new InvalidOperationException(
                        $"CreateRemoteThread (LoadLibraryA) failed (error {Marshal.GetLastWin32Error()})");
 
                WaitForSingleObject(hThread, INFINITE);
                CloseHandle(hThread);
            }
            finally
            {
                VirtualFreeEx(hProcess, remoteDllPath, IntPtr.Zero, MEM_RELEASE);
            }
        }
 
        static IntPtr ResolveRemoteExport(Process target, string fullDllPath, string exportName)
        {          
            IntPtr hLocal = LoadLibraryExA(fullDllPath, IntPtr.Zero, DONT_RESOLVE_DLL_REFERENCES);
            if (hLocal == IntPtr.Zero)
                throw new InvalidOperationException(
                    $"Local LoadLibraryEx failed (error {Marshal.GetLastWin32Error()})");
 
            IntPtr localExport = GetProcAddress(hLocal, exportName);
            if (localExport == IntPtr.Zero)
            {
                FreeLibrary(hLocal);
                throw new InvalidOperationException(
                    $"Export '{exportName}' not found in {Path.GetFileName(fullDllPath)}");
            }
 
            long exportRva = localExport.ToInt64() - hLocal.ToInt64();
            FreeLibrary(hLocal);
 
            IntPtr remoteBase = FindRemoteModuleBase(target, fullDllPath);
            return new IntPtr(remoteBase.ToInt64() + exportRva);
        }
 
        static IntPtr FindRemoteModuleBase(Process target, string fullDllPath,
            int retries = 15, int delayMs = 200)
        {
            string dllName = Path.GetFileName(fullDllPath);
            for (int i = 0; i < retries; i++)
            {
                try
                {
                    target.Refresh();
                    foreach (ProcessModule mod in target.Modules)
                    {
                        if (string.Equals(Path.GetFileName(mod.FileName), dllName,
                                StringComparison.OrdinalIgnoreCase))
                            return mod.BaseAddress;
                    }
                }
                catch (Exception) { }
 
                Thread.Sleep(delayMs);
            }
            throw new InvalidOperationException(
                $"Module '{dllName}' not found in target process after {retries} retries.");
        }
    }
}

Spoiler: Technical Implementation Details

The tool relies on standard WinAPI calls to handle the remote thread execution. If you are writing your own wrapper, ensure you are resolving the StartDump export correctly after the DLL is loaded into the RustClient.exe memory space.

The logic follows a classic injection pattern:
1. OpenProcess with PROCESS_ALL_ACCESS.
2. VirtualAllocEx for the DLL path and the output string.
3. WriteProcessMemory to seed the parameters.
4. CreateRemoteThread pointing to LoadLibraryA.
5. CreateRemoteThread pointing to the StartDump export address.

A Note on Safety
As with any public tool, using this on a live EAC-protected server is a one-way ticket to a HWID ban. This is intended for use in an offline environment or on servers with anti-cheat disabled. If you are planning to use this for a commercial project, I’d suggest stripping the logic and moving it to a more stealthy communication method than CreateRemoteThread.

Who else is currently mapping out the new material changes in the latest update?