forked from hugsy/windbg_js_scripts
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathEnvVars.js
More file actions
75 lines (62 loc) · 1.46 KB
/
Copy pathEnvVars.js
File metadata and controls
75 lines (62 loc) · 1.46 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
/**
*
* Get the environment variables
*
* 0:000> .scriptload \path\to\EnvVars.js
* 0:000> dx @$env().Where(e => e.Name == "USERNAME")
*
*/
"use strict";
const log = x => host.diagnostics.debugLog(x + "\n");
class EnvironmentVariable
{
constructor(addr, name, value)
{
this.Address = addr
this.Name = name;
this.Value = value;
}
toString()
{
return "(" + this.Address.toString(16) + ") " + this.Name + "=" + this.Value;
}
}
/**
* Generator to inspect the PEB looking for the Environment variables from PEB
*/
function *GetEnvironmentVariables()
{
var EnvironmentVariables = [];
var Peb = host.namespace.Debugger.Sessions[0].Processes.First().Environment.EnvironmentBlock;
var EnvVarBlockAddr = Peb.ProcessParameters.Environment.address;
var off = 0;
while (true)
{
var addr = EnvVarBlockAddr.add(off);
var env = host.memory.readWideString(addr);
if (env.length == 0)
{
break;
}
if (env.indexOf("="))
{
let p = env.split("=");
var Env = new EnvironmentVariable(addr, p[0], p[1]);
}
else
{
var Env = new EnvironmentVariable(addr, env, "");
}
yield (Env);
off += (env.length+1)*2;
}
}
/**
* Initialize the function alias.
*/
function initializeScript()
{
return [
new host.functionAlias(GetEnvironmentVariables, "env")
];
}