|go ahead... be a heretic|
Can you retrieve cwd/pwd from pid?
Maybe using GetCurrentDirectoryFromPid?
There is Win32::EnvProcess but it doesn't quite work for me, and I'm only interested in read only access
volatility looks interesting, but i'd consider GUITest-ing procexp before resorting to python :)
The author of Win32::Process::Info decided to not use Native API Win32::Process::Info::NT leaving only WMI as the alternative according to what I've been told.
Well, Win32::Process::Info::NT "works" but the amount of info is less
In reply to Re: NtQuerySystemInformation/Task Manger processes tab with Win32::API (win32 cwd/pwd from pid)
by Anonymous Monk