apmx_injection_info
Extract enriched injection chain details from an APMX capture, including target PID, shellcode size, start address, and injection technique.
Instructions
Extract enriched injection chain details from an APMX capture. Returns target PID, target process name, shellcode size (requested vs aligned), start address, and injection technique label. Wraps handle correlation with parameter decoding for a forensic-friendly summary.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Path to .apmx64 or .apmx86 capture file | |
| process_index | No | Which process to analyze (0 = first/only process) |