Key Points for _RTL_PROCESS_PARAMETERS:

Question 1

_RTL_PROCESS_PARAMETERS -

StandardInput

Answer 1

The process’ standard input handle

Question 2

_RTL_PROCESS_PARAMETERS - StandardOutput

Answer 2

The process’ standard output handle.

Question 3

_RTL_PROCESS_PARAMETERS - StandardError

Answer 3

The process’ standard error handle.

Question 4

_RTL_PROCESS_PARAMETERS - CurrentDirectory

Answer 4

The current working directory for the application.

Question 5

_RTL_PROCESS_PARAMETERS - ImagePathName

Answer 5

The unicode full path on disk to the process executable(.exe). You often need to consult this value because the _EPROCESS.ImageFileName (printed by the pslist plugin) contains only the first 16 characters and it does not include Unicode.

Question 6

_RTL_PROCESS_PARAMETERS - CommandLine

Answer 6

The full command line, including all arguments, used to invoke the process.

Question 7

_RTL_PROCESS_PARAMETERS - Environment

Answer 7

A pointer to the process’ environmental variables.