[pull] capemon from kevoreilly:capemon - #150
Open
pull[bot] wants to merge 417 commits into
Open
Conversation
…r" for shell: monitor=<pid/"explorer">
…r calls to named functions
…irst, complete scan on canary detection
…) with non-allocating get_module_name()
…han ntdll (ntdll-protect) - off by default
…king() from NtReadFile hook
Couple new thread hooks
Introduce `_pipe_sprintf` for formatted string output and `InteractiveBreakpointCallback` for handling interactive breakpoints. Update `SetConfigBP` and `SetInitialBreakpoints` to conditionally use the new callback based on configuration, enhancing breakpoint functionality for interactive debugging.
…feguard) Surgically safeguards both LdrGetProcedureAddress and LdrGetProcedureAddressForCaller inside hook_misc.c. Adds validation to ensure FunctionName->Buffer is non-NULL before executing strncmp on DLL imports. This prevents instant null-pointer dereference crashes and Fault Tolerant Heap (FTH) shims from triggering during early bootstraps when monitored applications query exports by ordinal with uninitialized/empty function name strings.
Introduces a strict systems-engineering rule to .gemini/skills/capemon-developer/SKILL.md forcing all future development sessions to automatically update docs/configuration.md when new configurable options are introduced.
Optimize, safeguard, and resolve WMI/Trace ETW Hooks (PR-78 Fix)
Add engineering mandate to capemon developer skill note
…R-2) Surgically implements the second PR of our .NET modernization roadmap inside hook_clr.c: 1. Implements a crash-safe, SEH-protected SafeGetMethodName helper function that accesses the getMethodName virtual method (index 0) from the ICorJitInfo/ICorMethodInfo vtable. 2. Incorporates robust pointer-read validation probe checks to guarantee absolute crash-protection across all .NET Framework and .NET Core versions. 3. Automatically translates and logs the exact fully qualified Class and Method names (e.g. System.Net.WebClient.DownloadData) being JITcompiled inside compileMethod to the behavioral log under the "dotnet" category, providing a powerful, high-level API execution trace.
Overview of Evasion Timing Fixes (Issue #141)
Resolve early-stage DllMain loader crashes (LdrGetProcedureAddress Safeguard)
Resolve VS2022 detonation failures via compiler safety mitigations bypass (Issue-61)
Surgically hooks the GetSystemFirmwareTable and EnumSystemFirmwareTables APIs exported by kernel32.dll to hide virtualization environments in-memory with 100% fidelity:
1. Intercepts ACPI table enumerations in EnumSystemFirmwareTables and deletes the virtual-guest-specific WAET (Windows ACPI Emulated devices Table) signature (0x54454157) on-the-fly, returning a seamless and continuous signature list.
2. Intercepts direct queries to the WAET table in GetSystemFirmwareTable and force-returns 0 (Not Found), perfectly simulating physical hardware.
3. Performs fast, safe, and bounded in-place ASCII memory replacements on other ACPI tables (DSDT, FACP, etc.) and Raw SMBIOS ('RSMB') tables to dynamically overwrite virtualization signatures (VMware, VirtualBox, QEMU, Hyper-V, Bochs) with physical OEM identifiers (Intel, HP, Dell, Samsung, ASUS), bypassing firmware checking scripts cleanly without corrupting structures or table checksums.
…f monitor threads, is_monitor_thread() helper function
Spoof ACPI and SMBIOS raw firmware tables dynamically
Implement high-level .NET API Translation and JIT Metadata Tracing (PR-2)
docs(skill): add build and compilation guide to capemon-developer skill
…tion-guarded globals and per-thread states via Tls APIs
Fix infinite YaraScan loop when dump limit is reached
PR #116 made SpoofWmiData resolve the object's WMI __CLASS directly, so the g_last_seen_disk_query / g_last_seen_physicalmemory flags PR #161 brought back from the old #97 patch are redundant. Worse, gating the LogicalDisk Size and PhysicalMemory Capacity spoofs on those flags skips spoofing whenever the class isn't reached via a SELECT on the same thread: CreateInstanceEnum (Get-CimInstance / Get-WmiObject -Class), GetObject on an instance, and async results delivered on the WMI sink thread. Remove the flags and restore both ExecQuery hooks to log-before-call. The AdapterRAM (realistic 4GB overflow value) and MaxRefreshRate spoofs from #161 are correct and kept.
Drop redundant g_last_seen_* WMI query gating from PR #161
…ines docs(skill): add C++ compilation and include order guidelines
Harden lookup functions
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.1)
Can you help keep this open source service alive? 💖 Please sponsor : )