omribaso/rtoolz

A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass, no dbghelp.lib calls.

rtoolz's Issues

Dump is not created

I'm trying to dump a PPL lsass process using the tools and I'm getting stuck at this point:

PS C:\Users\test\Downloads> .\OmriRToolZ.exe --write .\a.txt --valid -m 3 -p 864
got priv!
[+] Trying driver mode handle
HANDLE 000000000000009C
[+] omg got ppl to handle!
PS C:\Users\test\Downloads>

But the dump file is never created...
PROCEXP152.sys driver is loaded (Process Explorer is running)

What I'm missing? Thanks!

not work on win7 and winserver 2008

Problem signature:
  Problem Event Name:	APPCRASH
  Application Name:	OmriRToolZ.exe
  Application Version:	0.1.0.0
  Application Timestamp:	63fd7d59
  Fault Module Name:	OmriRToolZ.exe
  Fault Module Version:	0.1.0.0
  Fault Module Timestamp:	63fd7d59
  Exception Code:	c0000005
  Exception Offset:	0000000000001a8f
  OS Version:	6.1.7601.2.1.0.272.7
  Locale ID:	1033
  Additional Information 1:	1e4d
  Additional Information 2:	1e4df04d35200181ed834a12555bcd78
  Additional Information 3:	00c6
  Additional Information 4:	00c6ff427de73846656ac7702e05b448

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt

Will not work on windows Server 2012.

Tested on Windows 2012. Its not worked for some reason. Any idea?