wierd environmental variable ---

[Molecule]

Has anyone seen a 20 char "unequaled" environmental variable like the one right next to the red line (I'll try to upload a png)?

Where's the equals sign!

If I open a ram memory editor like HxD, what address would I start at to inspect my environmental memory area, to see what's on either side of those 20"x"'s?

My "autoexec.bat" is clean (just the path statement), the "config.sys" is empty, and both "mydos.sys" and "msdos.---" seem to have standard calls in them (from sp21a with md5 ok)

Possibly unrelated, but I also have problems with visual c++ runtime error R6025 ("pure virtual function call") when loading a svg into mozilla with javascript on.

If the png is unreadable, typing "set" at the command prompt produces this result, which shows the 20 "x"'s right after the TMP=

C:\WINDOWS>set
TMP=C:\WINDOWS\TEMP
xxxxxxxxxxxxxxxxxxxx
PROMPT=$p$g
winbootdir=C:\WINDOWS
COMSPEC=C:\WINDOWS\COMMAND.COM
PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
windir=C:\WINDOWS
BLASTER+A220 I5 D1 T4 P330

C:\WINDOWS>

[LLXX]

Environment variables don't need to have equals signs in them. They're just a series of null-terminated strings, followed by another null string.

what address would I start at to inspect my environmental memory area, to see what's on either side of those 20"x"'s?

Here's one way...

run DEBUG and then do d 0 command, this shows PSP and looks like this (addresses may vary):

-d 0
129E:0000  CD 20 00 A0 00 9A EE FE-1D F0 4F 03 23 0C 8A 03   . ........O.#...
129E:0010  23 0C 17 03 23 0C 17 0B-01 01 01 00 02 FF FF FF   #...#...........
129E:0020  FF FF FF FF FF FF FF FF-FF FF FF FF*01*0C*4E 01   ..............N.
129E:0030  2A 10 14 00 18 00 9E 12-FF FF FF FF 00 00 00 00   *...............
129E:0040  07 0A 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
129E:0050  CD 21 CB 00 00 00 00 00-00 00 00 00 00 20 20 20   .!...........
129E:0060  20 20 20 20 20 20 20 20-00 00 00 00 00 20 20 20		   .....
129E:0070  20 20 20 20 20 20 20 20-00 00 00 00 00 00 00 00		   ........

Now find the word at 2c - third line, fourth and third bytes from the end, I've highlighted that area with asterisks above (01 0C); in this case it's 0C01 - and display the start of that segment, you can use d command without address to continue displaying:

-d c01:0
0C01:0000  54 4D 50 3D 43 3A 5C 57-49 4E 44 4F 57 53 5C 54   TMP=C:\WINDOWS\T
0C01:0010  45 4D 50*00*54 45 4D 50-3D 43 3A 5C 57 49 4E 44   EMP.TEMP=C:\WIND
0C01:0020  4F 57 53 5C 54 45 4D 50*00*50 52 4F 4D 50 54 3D   OWS\TEMP.PROMPT=
0C01:0030  24 70 24 67*00*77 69 6E-62 6F 6F 74 64 69 72 3D   $p$g.winbootdir=
0C01:0040  43 3A 5C 57 49 4E 44 4F-57 53*00*43 4F 4D 53 50   C:\WINDOWS.COMSP
0C01:0050  45 43 3D 43 3A 5C 57 49-4E 44 4F 57 53 5C 43 4F   EC=C:\WINDOWS\CO
0C01:0060  4D 4D 41 4E 44 2E 43 4F-4D*00*50 41 54 48 3D 43   MMAND.COM.PATH=C
0C01:0070  3A 5C 57 49 4E 44 4F 57-53 3B 43 3A 5C 57 49 4E   :\WINDOWS;C:\WIN
-d
0C01:0080  44 4F 57 53 5C 43 4F 4D-4D 41 4E 44 3B 43 3A 5C   DOWS\COMMAND;C:\
0C01:0090  57 49 4E 44 4F 57 53 5C-53 59 53 54 45 4D*00*43   WINDOWS\SYSTEM.C
0C01:00A0  4D 44 4C 49 4E 45 3D 77-69 6E*00*77 69 6E 64 69   MDLINE=win.windi
0C01:00B0  72 3D 43 3A 5C 57 49 4E-44 4F 57 53*00 00*4C 41   r=C:\WINDOWS..LA

The highlighted zeroes indicate the end of each string in the environment block. Two zeroes in a row indicate the end of the environment block.

My suspicion is that this behavior is caused by a Virus, if you have already checked to see if any environment variables are being set on startup.

Edited February 11, 2006 by LLXX

[barneyrubble]

Check the folder c:\windows\temp and see if it actually exists. I ran into the same problem when I set my TMP variable to point to a non-existent folder.