DynamoRIO / DynamoRIO/dynamorio

propagate env vars on NtResumeProcess of a new child process

Open
#1,209 0 comments 0 reactions 0 assignees View on GitHub
Migrated OpSys-Windows Priority-Medium
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on July 12, 2013 00:03:23_

This syscall was added in XP but we have never seen it invoked: no known
library calls it. WINE doesn't support it. ReactOS doesn't show much for
it in terms of any library using it.

Apparently it's used by packed malware.

A default.0config file can be used to still follow children (or a named
config file of course if the child process name is known). We never did
publicy document default.0config, and decided that drconfiglib wouldn't
explicitly support it.

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1209_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.