README

LsassDump

A portable utility for dumping LSASS memory using a kernel driver approach to bypass PPL (Protected Process Light) protection. This tool is implemented in Delphi and is capable of extracting LSASS memory, optionally encrypting it, and decrypting previously encrypted dumps.

Features

• Bypass PPL protection using the PROCEXP driver
• Dump LSASS process memory to a file
• Obfuscate dump files using XOR encryption
• Decrypt previously obfuscated dump files
• Validate minidump signatures
• Customizable service name and output files

Usage

Dumping LSASS Memory

LsassDump.exe --dump                          # Dump lsass with default settings
LsassDump.exe --dump --service MyService      # Use custom service name
LsassDump.exe --dump --dumpname lsass.dmp     # Output to specific path
LsassDump.exe --dump --obfuscate --key MyKey  # Obfuscate with custom key

Decrypting Dump Files

LsassDump.exe --decrypt dump.dmp              # Decrypt with default key
LsassDump.exe --decrypt dump.dmp --key MyKey  # Decrypt with custom key

Command-Line Options

• --dump: Dump LSASS process memory
• --service <name>: Set the service name for the driver (default: PPLDefault)
• --dumpname <file>: Specify the output dump filename (default: PPLDefault.dmp)
• --obfuscate: XOR obfuscate the dump file
• --key <key>: XOR obfuscation/decryption key (default: PPLDefault)
• --decrypt <file>: Decrypt the specified dump file
• --quiet: Suppress status messages

Technical Details

LsassDump works by:

1. Loading the PROCEXP152 driver
2. Creating a kernel service
3. Using the driver to open a handle to the LSASS process
4. Invoking MiniDumpWriteDump to capture the process memory
5. Optionally obfuscating the dump with XOR encryption
6. Cleaning up after itself

When decrypting, it:

1. Validates that the file is encrypted (not already a valid minidump)
2. Performs XOR decryption with the provided key
3. Validates the resulting file has a proper minidump signature

Requirements

• Administrative privileges (for driver installation)
• Tested on Windows 10/11
• 64-bit system

Windows 11

Microsoft Vulnerable Driver Blocklist is enabled by default on Windows 11. The vulnerable driver blocklist is designed to help harden systems against third party-developed drivers across the Windows ecosystem with any of the following attributes:

Known security vulnerabilities that can be exploited by attackers to elevate privileges in the Windows kernel Malicious behaviors (malware) or certificates used to sign malware Behaviors that aren't malicious but circumvent the Windows Security Model and can be exploited by attackers to elevate privileges in the Windows kernel.

To allow the driver to be installed the value of the parameter VulnerableDriverBlocklistEnable from the registry key bellow must be updated.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config]
"VulnerableDriverBlocklistEnable"=dword:00000000

Building

This project was built with Delphi. To compile:

1. Open the project in Delphi
2. Ensure the PROCEXP152.SYS driver is included as a resource
3. Compile for Win64 target

Disclaimer

This tool is intended for legitimate security testing, forensic analysis, and educational purposes only. Use responsibly and only on systems you have permission to access.

Made with ❤️ using Delphi RAD Studio