refactor: minidump 实现降级链凭据提取

不再检测到杀软就直接退出,改为三级降级:
1. 直接 MiniDumpWriteDump(无杀软时尝试,15秒超时)
2. comsvcs.dll(系统签名DLL,部分杀软不拦截)
3. reg save SAM/SECURITY/SYSTEM(离线方式,不碰 LSASS)
全部失败才退出,0.2 秒完成不会卡死系统
This commit is contained in:
ZacharyZcR
2026-05-16 06:51:42 +08:00
parent cb1079598d
commit bf210dd94d
3 changed files with 101 additions and 90 deletions
+3
View File
@@ -648,6 +648,9 @@ systemdservice_success:
other: "Systemd service persistence completed: {{.Arg1}} methods succeeded"
# System info
minidump_regsave_success:
other: "Registry hive export completed (SAM/SECURITY/SYSTEM)"
systeminfo_start:
other: "Starting system information collection"
systeminfo_os:
+3
View File
@@ -647,6 +647,9 @@ systemdservice_success:
other: "系统服务持久化完成: {{.Arg1}}个方法成功"
# 系统信息
minidump_regsave_success:
other: "注册表 hive 导出完成 (SAM/SECURITY/SYSTEM)"
systeminfo_start:
other: "开始系统信息收集"
systeminfo_os: