TrickDump stealthily dumps the LSASS process memory using only NTAPI functions, producing JSON and ZIP files instead of traditional Minidump files to evade detection.
Dump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!
This tool is designed for security researchers, red teamers, and forensic analysts who need to extract LSASS memory dumps from Windows endpoints without triggering common detection mechanisms. It is especially useful in scenarios requiring stealthy credential dumping or memory forensics where traditional minidump files are easily flagged by AV/EDR solutions.
TrickDump will not work if Protected Process Light (PPL) is enabled on LSASS or if the binaries are not compiled as 64-bit. Stealthiness depends on the chosen language 'flavour' and customization of binaries; using uncommon languages and overwrite methods can improve evasion. The tool avoids creating any Minidump files on disk or memory during dumping, reducing forensic footprints. It is recommended to test in controlled environments before deployment and verify compatibility with target Windows versions and security products.
Clone the repository from GitHub: git clone https://github.com/ricardojoserf/TrickDump.git
Choose your preferred language branch (e.g., main for .NET, python-flavour for Python, golang-flavour for Go)
Build or compile the binaries according to the language-specific instructions in the chosen branch
Ensure the target system is 64-bit and PPL (Protected Process Light) is not enabled
Optionally, use the peb-unreadable branch if PEB reading is restricted on the target systemLock.exe [disk/knowndlls/debugproc]
Executes the first step to gather OS information and prepare for dumping, optionally overwriting ntdll.dll using one of three methods
Shock.exe [disk/knowndlls/debugproc]
Executes the second step to obtain SeDebugPrivilege, open LSASS handle, and collect module information
Barrel.exe [disk/knowndlls/debugproc]
Executes the final step to dump LSASS memory regions into JSON and ZIP files
python3 create_dump.py [-l LOCK_JSON] [-s SHOCK_JSON] [-b BARREL_JSON] [-z BARREL_ZIP] [-o OUTPUT_FILE]
Generates a Minidump file from the JSON and ZIP files produced by the three-step dumping process