apmx_injection_info
Extract injection chain details from an APMX capture: target process, shellcode size, start address, and injection technique for forensic analysis.
Instructions
Extract enriched injection chain details from an APMX capture. Returns target PID, target process name, shellcode size (requested vs aligned), start address, and injection technique label. Wraps handle correlation with parameter decoding for a forensic-friendly summary.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Path to .apmx64 or .apmx86 capture file | |
| process_index | No | Which process to analyze (0 = first/only process) |