I was hoping for more, but maybe someone will find this interesting: Windows Error Reporting can create a dump of some process. And error reporting may be orchestrated with werapi calls: https://docs.microsoft.com/en-us/windows/win32/api/werapi/ … So I have tried, and the flow is: 1/5
-
Show this thread
-
1. Initialize WER_REPORT_INFORMATION 2. Call WerReportCreate() 3. Call WerReportAddDump() 4. Call WerReportSubmit() 5. Call WerReportCloseHandle() 2/5pic.twitter.com/n4LBmR06kB
1 reply 0 retweets 6 likesShow this thread -
The dump file is created under %ProgramData%\Microsoft\Windows\WER and is immediately picked up by the "wermgr.exe -upload" launched by a Scheduled Task. Disable the "QueueReporting" task if you want to keep it for analysis. 3/5pic.twitter.com/3qBkFc2xHi
1 reply 1 retweet 2 likesShow this thread -
And of course WinDBG opens it easily. 4/5pic.twitter.com/UYHBQw6mx0
1 reply 0 retweets 2 likesShow this thread -
The C code ready to pickup from my GitHub: https://github.com/gtworek/PSBits/blob/master/Misc/AskWERforDump.c … 5/5
1 reply 2 retweets 9 likesShow this thread -
error reporting service load not existing phoneinfo.dll as system, so i used it as arb file create -> code exec method
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.