GitHub / kevoreilly/capemon issues and pull requests
#95 - Replace internal CreateThread calls with an internal implementation to avoid monitor detection by NtQueryInformationThread using ThreadQuerySetWin32StartAddress
Pull Request -
State: open - Opened by kevoreilly 3 months ago
#94 - Improve log args for a few hooks:
Pull Request -
State: open - Opened by KillerInstinct 3 months ago
- 1 comment
#93 - Hook CryptDuplicateKey
Pull Request -
State: closed - Opened by KillerInstinct 4 months ago
#92 - Hook Request: CommandLineToArgvW
Issue -
State: closed - Opened by kevross33 4 months ago
- 1 comment
#91 - Fixed the bug where the program crashed due to the presence of "?.DLL” after import reconstruction
Pull Request -
State: open - Opened by shuiyc 5 months ago
- 3 comments
#90 - Extra '?' entry in import address table during import reconstruction
Issue -
State: open - Opened by shuiyc 5 months ago
#89 - Add hooks for MsiInstallProductA/W
Pull Request -
State: closed - Opened by KillerInstinct 5 months ago
- 1 comment
#88 - Fixed the bug where the entry point was incorrect during the import reconstruction
Pull Request -
State: closed - Opened by shuiyc 5 months ago
- 2 comments
#87 - Fixed the bug where the entry point was incorrect during the import reconstruction
Pull Request -
State: closed - Opened by shuiyc 5 months ago
- 1 comment
#86 - Initial commit for WMI hooks
Pull Request -
State: closed - Opened by kevoreilly 5 months ago
#85 - Import reconstruction is not working
Issue -
State: closed - Opened by shuiyc 6 months ago
- 8 comments
#84 - fix
Pull Request -
State: closed - Opened by para0x0dise 9 months ago
- 4 comments
#83 - Add RmStartSession hook
Pull Request -
State: closed - Opened by para0x0dise 9 months ago
- 11 comments
#82 - Update stealth values
Pull Request -
State: closed - Opened by enzok 10 months ago
#81 - Bump actions/download-artifact from 3 to 4.1.7 in /.github/workflows
Pull Request -
State: closed - Opened by dependabot[bot] 11 months ago
Labels: dependencies
#80 - Add hooks for MkParseDisplayName & MkParseDisplayNameEx
Pull Request -
State: open - Opened by kevoreilly over 1 year ago
#79 - DllMain: Set process path etc. in standalone mode as well
Pull Request -
State: closed - Opened by heck-gd over 1 year ago
- 2 comments
#78 - Addition of Tracing hooks
Pull Request -
State: open - Opened by cccs-mog over 1 year ago
- 5 comments
#77 - add EnumDisplayDevices hook
Pull Request -
State: closed - Opened by enzok over 1 year ago
#76 - changing project properties to make them fit better
Pull Request -
State: closed - Opened by nblog over 1 year ago
- 9 comments
#75 - Raashidbhatt patch 4
Pull Request -
State: closed - Opened by raashidbhatt over 1 year ago
- 1 comment
#74 - Improving IsPeImageRaw()
Issue -
State: closed - Opened by raashidbhatt over 1 year ago
- 4 comments
#73 - Dumping Issue
Pull Request -
State: closed - Opened by raashidbhatt over 1 year ago
- 1 comment
#72 - Resolve issue causing inaccurate dumping of PE when the size of raw PE is equal to dwPageSize
Pull Request -
State: closed - Opened by raashidbhatt over 1 year ago
- 4 comments
#71 - Capemon failed to build with fatal error C1047: The object or library file 'F:\gitP\kevoreilly\capemon\\libyara\lib\libyara64.lib' was created by a different version of the compiler than other objects like 'x64\Release\alloc.obj'
Issue -
State: closed - Opened by KarenHuang2016 over 1 year ago
- 2 comments
#70 - Initial IPv6 support
Pull Request -
State: closed - Opened by cccs-mog over 1 year ago
- 12 comments
#69 - Capemon Testing Question
Issue -
State: closed - Opened by 0xGotcha over 1 year ago
- 2 comments
#68 - [Compile] LINK : fatal error C1047: The object or library file 'libyara\lib\libyara64.lib' was created by a different version of the compiler
Issue -
State: closed - Opened by Od0VxibTqto6Hs almost 2 years ago
- 2 comments
#67 - Adding safety checks, initialization and error handling
Pull Request -
State: closed - Opened by cccs-mog about 2 years ago
- 9 comments
#66 - Documenting the options in config.c
Pull Request -
State: closed - Opened by cccs-mog about 2 years ago
- 1 comment
#65 - Added hooks for RegDeleteKeyExA and RegDeleteKeyExW
Pull Request -
State: closed - Opened by RazviOverflow about 2 years ago
- 1 comment
#64 - LdrLoadDll BaseAddress always NULL
Issue -
State: closed - Opened by oalieno about 2 years ago
- 8 comments
#63 - x86 DLL detonation issues in Win10
Issue -
State: closed - Opened by cccs-mog about 2 years ago
- 10 comments
#62 - CoCreateInstance(Ex) hook improvements
Pull Request -
State: closed - Opened by heck-gd about 2 years ago
- 6 comments
#61 - Detonation failure due to VS2022
Issue -
State: open - Opened by kevoreilly over 2 years ago
#60 - CoCreateInstance hook Win64 exclusion
Issue -
State: closed - Opened by heck-gd over 2 years ago
- 3 comments
#59 - add PostThreadMessageA/PostThreadMessageW
Pull Request -
State: closed - Opened by nblog over 2 years ago
- 4 comments
#58 - Syscall hooks
Pull Request -
State: closed - Opened by kevoreilly over 2 years ago
#57 - Unpacker overhaul
Pull Request -
State: closed - Opened by kevoreilly over 2 years ago
#56 - Dharma Ransomware won't run with hooks enabled
Issue -
State: closed - Opened by blabla123sdfa almost 4 years ago
- 5 comments
#55 - CAPEv2 cannot handle with GoLang go-clr-based droppers
Issue -
State: closed - Opened by yevhenprotsenko over 3 years ago
- 2 comments
#54 - Crashed in get_full_keyvalue_pathUS
Issue -
State: closed - Opened by oalieno over 2 years ago
- 2 comments
#53 - InjectDllViaIAT failed in Windows 10
Issue -
State: closed - Opened by oalieno over 2 years ago
- 1 comment
#52 - Crash due to wrong prototype for NtAllocateVirtualMemoryEx
Issue -
State: closed - Opened by michaelweiser over 2 years ago
- 2 comments
#51 - Updated docs
Pull Request -
State: closed - Opened by RazviOverflow over 2 years ago
- 5 comments
#50 - Unable to place hook. Unable to hook.
Issue -
State: closed - Opened by RazviOverflow over 2 years ago
- 1 comment
#49 - Infinite recursion from GetThreadID in Debugger
Issue -
State: closed - Opened by michaelweiser over 2 years ago
- 2 comments
#48 - Crash in yara rule matching seemingly due to compiled rule word-size mismatch
Issue -
State: closed - Opened by michaelweiser over 2 years ago
- 20 comments
#47 - [MSVC][permissive-][std:c++latest] Capemon failed to build with msvc due to error C2362 error2440 on Windows
Issue -
State: closed - Opened by shizhuoer almost 3 years ago
- 1 comment
#46 - Capemon failed to build with "fatal error LNK1104: cannot open file 'atls.lib' " with MSVC on Windows arm64ec
Issue -
State: closed - Opened by YangYang129 almost 3 years ago
- 1 comment
#45 - Problem in detonation
Issue -
State: closed - Opened by simone-co almost 3 years ago
- 3 comments
#44 - ci: fix for publish ci failure
Pull Request -
State: closed - Opened by TheMythologist about 3 years ago
#43 - ci: push changes to capev2 repository
Pull Request -
State: closed - Opened by TheMythologist about 3 years ago
- 9 comments
#42 - some minor clean up to workflow file
Pull Request -
State: closed - Opened by r0ny123 about 3 years ago
- 3 comments
#41 - add github workflow for automatically building capemon DLLs
Pull Request -
State: closed - Opened by r0ny123 about 3 years ago
#40 - Test msbuild.yml
Pull Request -
State: closed - Opened by kevoreilly about 3 years ago
#39 - Stylistic issue. Tabbing dump-keys within braces
Pull Request -
State: closed - Opened by Gee-Eng about 3 years ago
#38 - BCryptImportKeyPair
Pull Request -
State: closed - Opened by Gee-Eng about 3 years ago
#37 - Capemon failed to build with "error C2039: 'Dr6': is not a member of '_CONTEXT' " with MSVC on Windows arm64
Issue -
State: closed - Opened by YangYang129 about 3 years ago
- 1 comment
#36 - got 520 error after implement all the rest api
Issue -
State: closed - Opened by ganeshpiplode about 3 years ago
- 1 comment
#35 - Increase GlobalMemoryStatus faked return value (hook_misc.c)
Pull Request -
State: closed - Opened by enzok about 3 years ago
#34 - Broken sleep hooks resulting in nonstable (not working) TCP sessions
Issue -
State: closed - Opened by ilzaman over 3 years ago
- 9 comments
#33 - Fix/merge
Pull Request -
State: closed - Opened by davidt99 over 3 years ago
- 1 comment
#32 - Added hooks for BCryptEncrypt and BCryptDecrypt
Pull Request -
State: closed - Opened by snemes over 3 years ago
- 2 comments
#31 - Some hooks cause Java programs to crash or hang
Issue -
State: open - Opened by psalire over 3 years ago
- 8 comments
#30 - How to compile it properly
Issue -
State: closed - Opened by 3ntr0phy almost 4 years ago
- 7 comments
#29 - Remove duplicate hooks
Pull Request -
State: closed - Opened by enzok almost 4 years ago
#28 - Sample seem hangs and not connect to C2
Issue -
State: closed - Opened by newmsk almost 4 years ago
- 9 comments
#27 - IsValidURL hook, Interop for MSIServer/Outlook
Pull Request -
State: closed - Opened by wmetcalf almost 4 years ago
- 1 comment
#26 - Fixed parameter names on NtCreateNamedPipeFile
Pull Request -
State: closed - Opened by ladislav-zezula almost 4 years ago
- 2 comments
#25 - [Question] Analyzing Linux Binaries
Issue -
State: closed - Opened by swthorn about 4 years ago
- 4 comments
#24 - Fix timestamp value for ncrypt RVA set
Pull Request -
State: closed - Opened by enzok about 4 years ago
- 1 comment
#23 - Question : how does capemon behave with new processes and threads?
Issue -
State: closed - Opened by 3ntr0phy about 4 years ago
- 1 comment
#22 - Question : Defining new log function for Attribute
Issue -
State: closed - Opened by 3ntr0phy about 4 years ago
- 3 comments
#21 - ntdll write protection preventing AppV hooking in Office 2016 32bit
Issue -
State: closed - Opened by michaelweiser about 4 years ago
- 2 comments
#20 - Hook for RtlDispatchException is not implemented well
Issue -
State: closed - Opened by ladislav-zezula about 4 years ago
- 2 comments
#19 - Question : API covered by capemon
Issue -
State: closed - Opened by 3ntr0phy about 4 years ago
- 8 comments
#18 - Default settings are set before bailing out due to non-existing config file
Pull Request -
State: closed - Opened by ladislav-zezula about 4 years ago
#17 - Fixed https://github.com/kevoreilly/capemon/issues/16
Pull Request -
State: closed - Opened by ladislav-zezula about 4 years ago
- 1 comment
#16 - BUGS: get_lasterrors and set_lasterrors
Issue -
State: closed - Opened by ladislav-zezula about 4 years ago
- 4 comments
#15 - When reading configuration, default values should be set before bailing out
Issue -
State: closed - Opened by ladislav-zezula about 4 years ago
- 2 comments
#14 - Issue #13
Pull Request -
State: closed - Opened by ladislav-zezula about 4 years ago
- 1 comment
#13 - BUG: Functions parsing InLoadOrderModuleList have wrong ending condition
Issue -
State: closed - Opened by ladislav-zezula about 4 years ago
- 1 comment
#12 - Deadlock with RtlLookupFunctionEntry-based stack unwinding on 64-bit Windows 10
Issue -
State: closed - Opened by michaelweiser about 4 years ago
- 18 comments
#11 - Windows 10 and PEB module hiding
Issue -
State: closed - Opened by michaelweiser about 4 years ago
- 6 comments
#10 - Hooking failure on .net executable
Issue -
State: closed - Opened by raashidbhatt about 4 years ago
- 5 comments
#9 - Question: what are maldoc detonation issues?
Issue -
State: closed - Opened by mbandzi about 4 years ago
- 1 comment
#8 - Tabs vs. spaces
Issue -
State: closed - Opened by mbandzi over 4 years ago
- 4 comments
#7 - Yara.h not found
Issue -
State: closed - Opened by 3ntr0phy over 4 years ago
- 10 comments
#6 - DsEnumerateDomainTrusts Hook?
Issue -
State: closed - Opened by recvfrom over 4 years ago
- 2 comments
#5 - Add hooks for Excel Macros and registry dumping
Pull Request -
State: closed - Opened by enzok about 5 years ago
#4 - Update Loader.c
Pull Request -
State: closed - Opened by doomedraven over 5 years ago
#3 - Moved APC handoff to occur before image validation to avoid analysis …
Pull Request -
State: closed - Opened by ninewayhandshake almost 6 years ago
#2 - add dump func from old loader
Pull Request -
State: closed - Opened by doomedraven almost 6 years ago
#1 - Add rtcEnvironBstr hook
Pull Request -
State: closed - Opened by enzok over 6 years ago
- 1 comment