DynamoRIO / DynamoRIO/dynamorio
propagate env vars on NtResumeProcess of a new child process
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on July 12, 2013 00:03:23_
This syscall was added in XP but we have never seen it invoked: no known
library calls it. WINE doesn't support it. ReactOS doesn't show much for
it in terms of any library using it.
Apparently it's used by packed malware.
A default.0config file can be used to still follow children (or a named
config file of course if the child process name is known). We never did
publicy document default.0config, and decided that drconfiglib wouldn't
explicitly support it.
_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1209_
Contributor guide
Assessment
This issue has not been assessed yet.