nanodump

Stealthy LSASS minidump tool — syscalls + fork-based techniques to bypass modern EDR solutions.

Concept

nanodump creates a minidump of the LSASS process using:

• Direct syscalls (avoids hooked ntdll APIs)
• Fork + minidump (dumping LSASS fork, not LSASS itself)
• Handle duplication (uses existing handles)
• Elevated handles from another process
• Silent process exit technique

The resulting .dmp can be parsed with Mimikatz offline.

Quick Start