5

Program 1 uses SetEnvironment and calls ShellExecute to launch Program 2. Program 2 calls GetEnvironment and retrieves value from it. Surprisingly this is working as i have read in MSDN, SetEnvironment is process specific (at least in my case). Whether ShellExecute internally calls CreateProcess (as child process) which in turn allows Program 2 access ENV variable created and set in Program 1....I use SetEnvironment to create and use a altogether different ENV var than windows user and system vars.

Macke
  • 24,812
  • 7
  • 82
  • 118
Vikas
  • 51
  • 3

1 Answers1

4

It will share the environment, but not when running elevated (verb="runas").

Then you need to create an intermediate wrapper app (that is elevated) that set environment before re-launching using CreateProcess() or similar.

This is because a non-priviliged user may change the PATH to point to something bad (dir with malicious DLLs) and the elevated app would then be at risk, so one must work around this explicitly.

Macke
  • 24,812
  • 7
  • 82
  • 118
  • Not sure to understand this restriction, could a malicious program not do the same ? (use an intermediate wrapper to load malicious DLLs) – glatapoui May 07 '18 at 20:34
  • 2
    The malicious program woudn't run as admin. Or if it does, it could do it's thing right away. IT's about protecting what you let across that border. – Macke May 24 '18 at 14:21