'How do you force a dump of an ELAM protected service process on Windows 10?
I have a Windows Service running in protected launch mode (using a registered ELAM driver) on Windows 10. For debugging purposes, once it gets into a particular state, I want to force a dump of the service process, for example, using Task Manager, Details tab, then right-click on the process name and selecting "Create dump file".
However, this is failing with Access Denied (error code 5) due to the process being protected by ELAM. But it's my process and I have access to the signing certificate whose hash is listed in the ELAM driver resources. Is there a way to do this with a signed process, or is it simply not possible? The MS documentation on ELAM seems to be lacking in general, but definitely does not mention anything related to creating dumps of ELAM protected processes, from my searching at least.
Any help or hints would be greatly appreciated. Thank you !
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|