From 081806196c0adb0a23ab404ea835b71b2ccf2ce2 Mon Sep 17 00:00:00 2001
From: iMHLv2 <michael.ligh@mnin.org>
Date: Tue, 5 Jun 2012 19:34:47 +0000
Subject: [PATCH] add a plugin to print environment variables for x86 and x64
 windows processes

---
 volatility/plugins/malware/malfind.py | 54 +++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/volatility/plugins/malware/malfind.py b/volatility/plugins/malware/malfind.py
index 60d460e6..e3d5ffd9 100644
--- a/volatility/plugins/malware/malfind.py
+++ b/volatility/plugins/malware/malfind.py
@@ -172,6 +172,36 @@ class MalwareEPROCESS(windows._EPROCESS):
 
         return vad.u.VadFlags.PrivateMemory == 0 and vad.FileObject.FileName
 
+    def environment_variables(self):
+        """Generator for environment variables. 
+
+        The PEB points to our env block - a series of null-terminated
+        unicode strings. Each string cannot be more than 0x7FFF chars. 
+        End of the list is a quad-null. 
+        """
+
+        # Address of the environment block
+        if not self.Peb.ProcessParameters.Environment.is_valid():
+            return 
+
+        process_space = self.get_process_address_space()
+        if not process_space:
+            return
+
+        block = self.Peb.ProcessParameters.Environment
+
+        s = obj.Object("String", offset = block, vm = process_space, 
+            encoding = 'utf16', length = 0x7FFF)
+
+        # The terminator is a quad null 
+        while len(s):
+            if s.count(u"=") == 1:
+                yield s.split(u"=")
+            # Scan forward the length of this string plus the null
+            next_offset = s.obj_offset + ((len(s) + 1) * 2)
+            s = obj.Object("String", offset = next_offset, 
+                vm = process_space, encoding = 'utf16', length = 0x7FFF)
+
 #--------------------------------------------------------------------------------
 # profile modifications  
 #--------------------------------------------------------------------------------
@@ -450,5 +480,29 @@ class LdrModules(taskmods.DllList):
                     if mem_mod:
                         outfd.write("  Mem Path:  {0} : {1}\n".format(mem_mod.FullDllName, mem_mod.BaseDllName))
 
+#--------------------------------------------------------------------------------
+# envvars plugin
+#--------------------------------------------------------------------------------
 
+class Envars(taskmods.DllList):
+    "Display process environment variables"
+
+    def render_text(self, outfd, data):
+
+        self.table_header(outfd,
+            [("Pid", "8"),
+             ("Process", "20"),
+             ("Block", "[addrpad]"),
+             ("Variable", "30"),
+             ("Value", ""),
+            ])
+
+        for task in data:
+            for var, val in task.environment_variables():
+                self.table_row(outfd,
+                    task.UniqueProcessId,
+                    task.ImageFileName,
+                    task.Peb.ProcessParameters.Environment, 
+                    var, val
+                    )