Werfault technique returns empty lsass dump about nanodump HOT 6 CLOSED

I love that you used the debug release and the -p param, not that many people are aware of their existence 😄
Very weird indeed, the debug output seems ok and the Wer process obviously tried to created the dump.
Is there any AV/EDR installed? maybe defender?
It kinda looks like some security product deleted the dump (given that is the Wer process the one making the dump and not nanodump, it is not exactly the most opsec method when it comes to userland hooking and other methods of evasion)

from nanodump.

I'm a big fan of your work btw 😛

from nanodump.

eheh glad about that :D

I was running tests on machines without AV or EDR installed...

I tried it on a Windows Server 2019, Win10 1909, Win10 1809. I think there is some bogus code somewhere because on a Win10 1809 i saw the dump generated with few bytes:

Which Windows version have you been able to test successfully?

from nanodump.

Wow that is very weird, I will do some testing.
I developed and tested in a Windows 10 Home version 21H2 OS Build 19044.1766

from nanodump.

The version 1809 build 17763 seems to work

It worked with and without defender, I guess it is a problem with some very specific versions then?

from nanodump.

Ok , i found the bug. Your code is enabling the SeDebugPrivilege after executing the "werfault" technique, while it's indeed required before.
Also NtGetNextProcess requires that privilege and for that reason it failed also in retrieving the PID of lsass automatically.

Your tests were succesfully highly likely because you were running from a SYSTEM shell or a shell with SeDebugPrivilege already enabled (default is disabled) ;)

Now works :) Sending a PR soon.

from nanodump.