TrickDump - "c-flavour" branch

This branch implements the same functionality as the main branch but using C/C++.

Lock.exe [disk/knowndlls/debugproc]

Shock.exe [disk/knowndlls/debugproc]

Barrel.exe [disk/knowndlls/debugproc]

You can execute the programs directly without overwriting the ntdll.dll library:

Or use one of the three different overwrite techniques ("disk", "knowndlls" or "debugproc"):

Then use the create_dump.py script to generate the Minidump file in the attack system:

python3 create_dump.py [-l LOCK_JSON] [-s SHOCK_JSON] [-b BARREL_JSON] [-z BARREL_ZIP] [-o OUTPUT_FILE]

---

All in one

If you prefer to execute only one binary, Trick.exe generates a ZIP file containing the 3 JSON files and the ZIP file with the memory regions:

Trick.exe [disk/knowndlls/debugproc]

It creates the ZIP file locally, optionally using a ntdll.dll overwrite method:

With a ZIP file like this, unzip it and create the Minidump file using create_dump.py: