Skip to content

Conversation

@forensicxlab
Copy link

This PR introduce environment variables listing for the Win32Kernel implementing the memflow Process trait. It is linked to these memflow PR and memflow-rawmem PR

  • Introduces Win32EnvListInfo, which locates the environment block via PEB->ProcessParameters->Environment (for both native and WOW64) and uses _RTL_USER_PROCESS_PARAMETERS::EnvironmentSize to bound parsing.

I hope this is the right way to contribute to this project as I'm still learning about the whole framework :)

Cheers.
k1nd0ne.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant