This tool will use WerFaultSecure.exe (outdated version) to dump protected processes. This is a reimplementation of https://github.com/TwoSevenOneT/WSASS . The original author of this technique is Alex Ionescu, so check out his presentation: https://nosuchcon.org/talks/2014/D3\_05\_Alex\_ionescu\_Breaking\_protected\_processes.pdf .

# Copyright

All credits go to Alex Ionescu. I am just implementing different techniques.