Get LSASS PID fails about nanodump HOT 3 CLOSED

Additional info: I was using the standalone binary and not the BOF via CS.

from nanodump.

Ok I fixed it now by myself by modifying

if (wcsstr(image->Buffer, L"\\windows\\system32\\lsass.exe"))

in util.c in the is_lsass function to

if (wcsstr(image->Buffer, L"lsass.exe"))

If that's a general bug you can solve it like that.

Greetings

from nanodump.

Hey there!
Thanks for reporting the issue.
Well very interesting, I imagined that would be the path for all Windows systems.
I will change the path to L"lsass.exe" so that it works everywhere.
Thanks again!

from nanodump.