Skip to content

Add Windows environment block parsing and expose process environment variables #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
forensicxlab wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add Windows environment block parsing and expose process environment variables #14

forensicxlab wants to merge 1 commit into from
+377 −20

Conversation

@forensicxlab
Copy link

@forensicxlab forensicxlab commented Nov 14, 2025

This PR introduce environment variables listing for the Win32Kernel implementing the memflow Process trait. It is linked to these memflow PR and memflow-rawmem PR

  • Introduces Win32EnvListInfo, which locates the environment block via PEB->ProcessParameters->Environment (for both native and WOW64) and uses _RTL_USER_PROCESS_PARAMETERS::EnvironmentSize to bound parsing.

I hope this is the right way to contribute to this project as I'm still learning about the whole framework :)

Cheers.
k1nd0ne.
@forensicxlab forensicxlab mentioned this pull request Nov 14, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant

@forensicxlab