MCPcopy Create free account
hub / github.com/BeneficialCode/WinArk / GetEnvironment

Method GetEnvironment

WinSysCore/Processes.cpp:351–391  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

349}
350
351std::vector<std::pair<std::wstring, std::wstring>> Process::GetEnvironment(HANDLE hProcess) {
352 std::vector<std::pair<std::wstring, std::wstring>> env;
353
354 PEB peb;
355 if (!GetProcessPeb(hProcess, &peb))
356 return env;
357
358 RTL_USER_PROCESS_PARAMETERS processParams;
359 if (!::ReadProcessMemory(hProcess, peb.ProcessParameters, &processParams, sizeof(processParams), nullptr))
360 return env;
361
362 BYTE* buffer = nullptr;
363 int size = 1 << 16;
364 buffer = (BYTE*)malloc(size);
365 if (!buffer) {
366 return env;
367 }
368 for (;;) {
369 if (::ReadProcessMemory(hProcess, processParams.Environment, buffer, size, nullptr))
370 break;
371 size -= 1 << 12;
372 }
373
374 env.reserve(64);
375
376 for (auto p = (PWSTR)buffer; *p;) {
377 std::pair<std::wstring, std::wstring> var;
378 auto equal = wcschr(p, L'=');
379 assert(equal);
380 if (!equal)
381 break;
382 *equal = L'\0';
383 var.first = p;
384 p += ::wcslen(p) + 1;
385 var.second = p;
386 p += ::wcslen(p) + 1;
387 env.push_back(std::move(var));
388 }
389
390 return env;
391}

Callers

nothing calls this directly

Calls 3

reserveMethod · 0.80
push_backMethod · 0.80
GetProcessPebFunction · 0.70

Tested by

no test coverage detected