Exploring Rustivedump. Lsass Dumping Using Ntapis In Rust 2026

Posted on Jan 2

• Originally published at cyberpath-hq.com

In the ever-evolving field of cybersecurity, memory dumping tools are a key component in incident response and adversary simulations, allowing analysts to capture and investigate the memory state of critical processes like lsass.exe (Local Security Authority Subsystem Service). The extraction of sensitive credentials stored in LSASS is a well-known attack vector, making memory-dumping tools both powerful and controversial.

In this article, we'll explore RustiveDump, a minimalist, highly efficient LSASS memory-dumping tool written in Rust. RustiveDump leverages NT system calls exclusively, bypassing the need for standard APIs and libraries. Its unique combination of being built with no_std, using indirect NT syscalls, and supporting features like XOR encryption and remote file transmission makes it a standout tool. We'll break down its core features, show how to use it in different scenarios, and provide an in-depth technical walkthrough of its behavior.

** !! Update !!: RustiveDump now also has shellcode generation capabilities thanks to Rustic64! Check out the article here!

RustiveDump is a Rust-based LSASS memory dumper that directly interacts with the Windows kernel using NT system calls. The goal behind RustiveDump is to create an efficient and lightweight memory dump tool without relying on the Rust standard library (no_std) or the C runtime (CRT). This results in a binary as small as 18KB, making it suitable for restricted environments.

RustiveDump offers several build options via cargo make, enabling different features like XOR encryption, remote transmission, and debug logging. The tool can be built with various combinations of flags to adjust its behavior to different operational needs.

To compile RustiveDump without any special features simply run:

For specific features, the build command can be extended with feature flags:

This allows you to tailor the tool for different use cases, such as encrypting the dump file, transmitting it remotely, or logging more verbose output for detailed monitoring.

In this section, we'll walk through five different scenarios where RustiveDump is compiled and executed with various feature combinations.

Source: Dev.to