RToolZ

RToolZ A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass. What Is So Special About It? No calls to MiniDump or any dbghelp.lib methods, all of the dumping process is done MANUALLY by the dumper while reducing the dump size to minimal by removing unessacery DLLs. Methods ...

LetMeowIn

LetMeowIn Un sofisticado y encubierto volcador de LSASS que utiliza C++ y MASM x64. Como se ve en Binary Defense y Cyber Security News Aviso legal No seas malvado con esto. Creé esta herramienta para aprender. No soy responsable si los federales llaman a tu puerta. Históricamente ha podido y pued...

HandleKatz - PIC Lsass Dumper Using Cloned Handles

This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same. It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of the PE file ...