Stop ProcessDump from hooking it's own processes NtProcessTermination

glmcdona / Process-Dump

Windows tool for dumping malware PE files from memory back to disk for analysis.

http://split-code.com/processdump.html

MIT License

1.65k stars 261 forks source link

Closed glmcdona closed 7 years ago

glmcdona commented 8 years ago

If another app tries to close it abnormally, it can create a state where process dump gets stuck at the closing state.

glmcdona commented 7 years ago

Resolved.