You must never write to the PEB, you can only read it. I had assumed
throughout this discussion that you simply wanted to peek at a process’s
environment variables from user mode, but if you want to update them too,
then I agree with all the other contributors thus far: go back to the
drawing board and redesign.
-----Original Message-----
From: xxxxx@hotmail.com [SMTP:xxxxx@hotmail.com]
Sent: Wednesday, November 21, 2001 7:00 PM
To: NT Developers Interest List
Subject: [ntdev] Re: How to access environment variables from
KernelMo- de??- ?Hi,
Excellent! And how PEB formatted? Can I add own entries to it? What kind
on
synchronization have I use while accesing PEB? (I think I’m not the only
one who uses it).Thanks,
Anton> If you know the PID of the process whose environment variables you want
to
> read, you can call PsLookupProcessByProcessId (undocumented routine
exported
> by NTOSKRNL.EXE) to get a pointer to that process’s EPROCESS block. Then
you
> can get a pointer to the PEB and use Charles’s technique.
You are currently subscribed to ntdev as: xxxxx@fmr.com
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com
You are currently subscribed to ntdev as: $subst(‘Recip.EmailAddr’)
To unsubscribe send a blank email to leave-ntdev-$subst(‘Recip.MemberIDChar’)@lists.osr.com