search

skelsec / minidump

Python library to parse and read Microsoft minidump file format
MIT License
270 stars 55 forks source link

PEB Parsing #41

Closed Danking555 closed 1 month ago

Danking555 commented 1 month ago

Added PEB parsing capabilities (extracting Command Line, Window Title, Current Directory, Environment Variables and much more) The _PEB and _RTL_USER_PROCESS_PARAMETERS offsets are pretty consistent across Windows OS versions, differ only between x64 and x86 processes

skelsec commented 1 month ago

Cool! Thank you! I'll probably modify this a bit before release.