Conversation
…irst, complete scan on canary detection
…) with non-allocating get_module_name()
…han ntdll (ntdll-protect) - off by default
…king() from NtReadFile hook
Couple new thread hooks
Introduce `_pipe_sprintf` for formatted string output and `InteractiveBreakpointCallback` for handling interactive breakpoints. Update `SetConfigBP` and `SetInitialBreakpoints` to conditionally use the new callback based on configuration, enhancing breakpoint functionality for interactive debugging.
- WMI_Next hook added, which functions similar to WMI_Get for async related APIs on the backend (e.g. Get-CimInstance instead of Get-WmiObject - Added initial spoofery for WMI - Couple more hooks (to be officially added by Kevin at some point) - Hopefully fixed weirdness with existing WMI hooks and NOTAIL shenanigans, just converted them to HOOK macros and we now log prior to calling the hook (which is effectively the same as NOTAIL)
Moved the declaration of the function pointer _NtQueryInformationThread from static to non-static, allowing broader access outside the current translation unit.
Moved the declaration of the function pointer _NtQueryInformationThread from static to non-static, allowing broader access outside the current translation unit.
Surgically hooks the GetSystemFirmwareTable and EnumSystemFirmwareTables APIs exported by kernel32.dll to hide virtualization environments in-memory with 100% fidelity:
1. Intercepts ACPI table enumerations in EnumSystemFirmwareTables and deletes the virtual-guest-specific WAET (Windows ACPI Emulated devices Table) signature (0x54454157) on-the-fly, returning a seamless and continuous signature list.
2. Intercepts direct queries to the WAET table in GetSystemFirmwareTable and force-returns 0 (Not Found), perfectly simulating physical hardware.
3. Performs fast, safe, and bounded in-place ASCII memory replacements on other ACPI tables (DSDT, FACP, etc.) and Raw SMBIOS ('RSMB') tables to dynamically overwrite virtualization signatures (VMware, VirtualBox, QEMU, Hyper-V, Bochs) with physical OEM identifiers (Intel, HP, Dell, Samsung, ASUS), bypassing firmware checking scripts cleanly without corrupting structures or table checksums.
…f monitor threads, is_monitor_thread() helper function
Spoof ACPI and SMBIOS raw firmware tables dynamically
Implement high-level .NET API Translation and JIT Metadata Tracing (PR-2)
docs(skill): add build and compilation guide to capemon-developer skill
…tion-guarded globals and per-thread states via Tls APIs
Fix infinite YaraScan loop when dump limit is reached
PR #116 made SpoofWmiData resolve the object's WMI __CLASS directly, so the g_last_seen_disk_query / g_last_seen_physicalmemory flags PR #161 brought back from the old #97 patch are redundant. Worse, gating the LogicalDisk Size and PhysicalMemory Capacity spoofs on those flags skips spoofing whenever the class isn't reached via a SELECT on the same thread: CreateInstanceEnum (Get-CimInstance / Get-WmiObject -Class), GetObject on an instance, and async results delivered on the WMI sink thread. Remove the flags and restore both ExecQuery hooks to log-before-call. The AdapterRAM (realistic 4GB overflow value) and MaxRefreshRate spoofs from #161 are correct and kept.
Drop redundant g_last_seen_* WMI query gating from PR #161
…ines docs(skill): add C++ compilation and include order guidelines
Harden lookup functions
…mit is reached)
…dName to resolve detonation failures
Reviewing a pull request or testing someone else's branch means checking it out somewhere. Doing that in your working clone is unsafe when it carries uncommitted work, and doing it with git worktree by hand means resolving which fork the branch lives in, fetching it under a name that will not collide, setting upstream, and remembering to tear it down. This repository uses the fork convention - origin is your fork, upstream is kevoreilly/capemon, and the default branch is 'capemon' - which makes the manual version more error-prone than usual. The script reads the canonical repository from upstream, so PR lookups go to the right place, and 'new --branch' searches origin, upstream and any other remote in turn. new --pr <id> / --branch <name> / --from <ref> list / path / update / remove / cleanup / info Standard library only; no dependencies and nothing to build. gh is needed only for --pr. Worktrees it creates are tagged inside the git admin directory, so git status stays clean and cleanup only ever removes its own. remove and cleanup refuse to discard uncommitted changes or unpushed commits. The same script lives in CAPEv2 as utils/agent_worktree.py.
Mirrors kevoreilly/CAPEv2#3228. The removal guard compared HEAD against the tracked upstream only, so a branch tracking 'upstream/capemon' while its commits were pushed to a fork looked unpushed and cleanup refused to remove it. Work now counts as unpushed only when no remote-tracking ref contains HEAD.
skills: add agent_worktree.py for isolated PR/branch checkouts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
9 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.1)
Can you help keep this open source service alive? 💖 Please sponsor : )