Finished
Process dump tool with WinAPI
Windows command-line tool, written in C with the WinAPI, that dumps process memory. You can pick the process by PID or by name, use a process snapshot, or send the dump over the network.
What I did and how it works
- Four modes: dump by PID, by name, from a snapshot (PssCaptureSnapshot) and over the network.
- Enables the SeDebugPrivilege privilege (it must run as administrator) to reach system processes.
- In network mode the dump is sent over a socket to another machine without being written to disk.
Tech stack
Limits and responsible use
- Use it only on systems you own or have explicit permission to test.
Usage details
- MIT license.