DuplicateDump is a fork of MirrorDump with following modifications: DInovke implementation LSA plugin DLL written in C++ which could be clean up after dumping LSASS. MirrorDump compile LSA plugin as .NET assembly which would not be unloaded by LSASS process. That’s why MirrorDump failed to delete the plugin. PID of dump process (i.e., DuplicateDump) is shared to …
Continue reading “DuplicateDump : Dumping LSASS With A Duplicated Handle From Custom LSA Plugin”