# outflanknl/Dumpert

LSASS memory dumper using direct system calls and API unhooking.

Repository: https://github.com/outflanknl/Dumpert
Canonical: https://ross.abutalabs.com/products/dumpert
Language: C
License Family: other
Last push: 2021-01-05T08:58:26+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 2634, "days_push": 2066, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1595, forks 247 (observed 2026-08-28T04:05:09.047789+00:00)

## What it is
Dumpert is a proof-of-concept LSASS memory dumper written in C and assembly that uses direct system calls and API unhooking to evade AV/EDR user-mode hooks. It ships as an executable, DLL, and sRDI shellcode version with a Cobalt Strike aggressor script for in-memory dumping without touching disk.

## Use cases
- dump lsass memory without getting caught by edr
- bypass av user-mode api hooks when dumping credentials
- red team credential dumping from lsass
- create lsass minidump via cobalt strike beacon
- demonstrate direct syscall techniques for evasion

## When to choose
- you need an LSASS dump that evades user-mode API hooking by security products
- you are running a red team engagement with Cobalt Strike and want in-memory dumping
- you want a reference implementation of direct syscalls combined with API unhooking

## When to avoid
- you need a maintained tool with active support or a license for production use
- you are doing defensive security research rather than offensive testing
- you need a general-purpose process memory dumper rather than LSASS-specific dumping

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, penetration-testing
- domain: security, penetration-testing, windows
- platform: windows, cli
- tags: red-team, lsass-dump, direct-syscalls, edr-evasion, cobalt-strike, offensive-security

## Member repositories
- outflanknl/Dumpert (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:09.047789+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:54:08.358145+00:00, confidence not recorded.
  - readme: https://github.com/outflanknl/Dumpert (fetched 2026-08-28T04:05:09.047789+00:00, sha 7202dbae3029)
- Data as of 2026-08-30T08:39:29.467469+00:00.