NativeDump : A Cutting-Edge Approach For Secure Minidump Creation

NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz (SystemInfo, ModuleList and Memory64List Streams).

• NTOpenProcessToken and NtAdjustPrivilegeToken to get the “SeDebugPrivilege” privilege
• RtlGetVersion to get the Operating System version details (Major version, minor version and build number). This is necessary for the SystemInfo Stream
• NtQueryInformationProcess and NtReadVirtualMemory to get the lsasrv.dll address. This is the only module necessary for the ModuleList Stream
• NtOpenProcess to get a handle for the lsass process
• NtQueryVirtualMemory and NtReadVirtualMemory to loop through the memory regions and dump all possible ones. At the same time it populates the Memory64List Stream

Usage:

NativeDump.exe [DUMP_FILE]

The Default File Name Is “proc_.dmp”:

The tool has been tested against Windows 10 and 11 devices with the most common security solutions (Microsoft Defender for Endpoints, Crowdstrike…) and is for now undetected.

However, it does not work if PPL is enabled in the system.

Some benefits of this technique are:

• It does not use the well-known dbghelp!MinidumpWriteDump function
• It only uses functions from Ntdll.dll, so it is possible to bypass API hooking by remapping the library
• The Minidump file does not have to be written to disk, you can transfer its bytes (encoded or encrypted) to a remote machine

The project has three branches at the moment (apart from the main branch with the basic technique):

• ntdlloverwrite – Overwrite ntdll.dll’s “.text” section using a clean version from the DLL file already on disk
• delegates – Overwrite ntdll.dll + Dynamic function resolution + String encryption with AES + XOR-encoding
• remote – Overwrite ntdll.dll + Dynamic function resolution + String encryption with AES + Send file to remote machine + XOR-encoding

Technique In Detail : Creating A Minimal Minidump File

After reading Minidump undocumented structures, its structure can be summed up to:

• Header: Information like the Signature (“MDMP”), the location of the Stream Directory and the number of streams
• Stream Directory: One entry for each stream, containing the type, total size and location in the file of each one
• Streams: Every stream contains different information related to the process and has its own format
• Regions: The actual bytes from the process from each memory region which can be read

For more information here.