title: Reading the environment variables of another process
body: <p>I'm trying to get a process environment strings, the code below is what I already wrote.</p>
  
  <pre><code>#include &lt;windows.h&gt;
  #include &lt;tchar.h&gt;
  
  #define ProcessBasicInformation 0
  
  typedef struct _PROCESS_BASIC_INFORMATION {
      NTSTATUS  ExitStatus;
      PVOID     PebBaseAddress;
      ULONG_PTR AffinityMask;
      LONG      BasePriority;
      HANDLE    UniqueProcessId;
      HANDLE    InheritedFromUniqueProcessId;
  } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
  
  int _tmain(int argc, TCHAR* argv[]) {
    TCHAR   *app;
    DWORD    pid;
    HANDLE  proc;
    NTSTATUS nts;
    PVOID   rupp; // RTL_USER_PROCESS_PARAMETERS, offset 0x10
    PVOID    env; // Environment, offset 0x48
    TCHAR   *buf;
    PROCESS_BASIC_INFORMATION pbi;
    MEMORY_BASIC_INFORMATION  mbi;
  
    if (argc != 2) {
      app = _tcsrchr(argv[0], '\\');
      _tprintf(TEXT("Usage: %s [PID]\n"), app ? ++app : argv[0]);
      return -1;
    }
  
    _stscanf_s(argv[1], TEXT("%lu"), &amp;pid);
    if (!(proc = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid))) {
      return -1;
    }
  
    if (!(nts = NtQueryInformationProcess(
      proc, ProcessBasicInformation, &amp;pbi, sizeof(pbi), NULL
        ))) {
    if (ReadProcessMemory(
      proc, (PCHAR)pbi.PebBaseAddress + 0x10, &amp;rupp, sizeof(rupp), NULL
        )) {
    if (ReadProcessMemory(proc, (PCHAR)rupp + 0x48, &amp;env, sizeof(env), NULL)) {
       //what I need to do to get enironment strings?
    }
  }
    }
  
    CloseHandle(proc);
  
    return 0;
  }
  </code></pre>
  
  <p>Can somebody explain what I need to do to get environment strings of a process?</p>