😈 POSTDump

This is the C# / .NET implementation of the ReactOS minidump function (like nanodump), thus avoiding call to the Windows API MiniDumpWriteDump function.

🚀 Key Features:

— Usage of indirect syscall along with halo's gate technic to retrieve syscalls IDs
— No memory Allocation/Protection call is performed for indirect syscall, instead, free RWX codecave found in the current process are used
— ETW patching
— No call to MiniDumpWriteDump

🌐 Source:
https://github.com/YOLOP0wn/POSTDump

#windows #lsass #dump #syscall #reactos