ricardojoserf / nativedump Goto Github PK

Expected vs Actual Behavior

NativeDump successfully calls NtOpenProcess and completes operations.

Specifications

• Operating system: Windows 10 Pro 10.0.19045 N/A Build 19045
  

Steps to Reproduce the Problem

I'm trying to run NativeDump and experiencing this same issue across multiple test VMs. I'm running Powershell as SYSTEM via Psexec. I've enabled all privs.

I've disabled PPL via registry (RunAsPPL is set to 0) as well as removed the EFI variable using Microsoft's Local Security Authority (LSA) Protected Process Opt-out process. I've also run PPLKiller successfully yet the issue persists. When looking into the error I believe it's a permissions issue but I'm not sure where else to look. Could you please point me in the right direction? Thanks.