Harden lookup functions - #190
Merged
Merged
Conversation
…tion-guarded globals and per-thread states via Tls APIs
doomedraven
added a commit
to doomedraven/capemon
that referenced
this pull request
Sep 3, 2026
Conflict in hook_wmi.c resolved as follows: - Dropped the per-thread g_last_seen_* WMI query gating our branch had carried and extended to Win32_BaseBoard / Win32_DiskDrive / Win32_BIOS. Upstream 12f53cf removed this pattern deliberately: SpoofWmiData already resolves the object's __CLASS directly, and gating spoofs on a SELECT seen on the same thread skips CreateInstanceEnum / GetObject / async sink-thread results. The new BaseBoard/DiskDrive/BIOS spoofs are kept but gated on szClassName only, matching the LogicalDisk/PhysicalMemory handling. - WMI_ExecQuery / WMI_ExecQueryAsync restored to upstream's log-before-call form. - InitWmiSpoofStrings() and the polymorphic spoof-string globals retained. Per-thread state converted to the SafeLookup (PR kevoreilly#190) idioms: - bHookViaWbemLocator is now a LOOKUP_THREAD-backed BOOL instead of a manually managed TLS slot; g_wmi_tls_index / g_wmi_tracker_tls_index, GetWmiThreadContext, TlsWmiThreadCleanup and the DLL_THREAD_DETACH / TlsAlloc / TlsFree plumbing in capemon.c are removed. - hooks.h includes lookup.h; g_wmi_locator_lookup defined in capemon.c. Builds clean for x64 and Win32 Release. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011ERDQPRdwhLUf4khBLdvoL
doomedraven
added a commit
to doomedraven/capemon
that referenced
this pull request
Sep 3, 2026
Conflict in hook_wmi.c resolved: - Dropped the per-thread g_last_seen_disk_query / g_last_seen_physicalmemory tracking (and the unused last_seen_fake_class). On this branch nothing read those flags anymore - SpoofWmiData resolves __CLASS directly - so they were dead, and upstream 12f53cf removed the same pattern. Restored WMI_ExecQuery / WMI_ExecQueryAsync to upstream's form (no SELECT parsing). - WMI_ExecQuery keeps this branch's vtable-hooking: call Old_, then set_com_hooks() on *ppEnum, matching WMI_CreateInstanceEnum. The IEnumWbemClassObject_Next hook is retained. - The per-thread "hooking via IWbemLocator" flag (IsHookViaWbemLocator / SetHookViaWbemLocator) now sits on a lock-free lookup table via the LOOKUP_THREAD idiom from SafeLookup (PR kevoreilly#190) instead of a hand-managed TLS slot. Removed g_wmi_tracker_tls_index, GetWmiThreadContext, wmi_thread_context_t, TlsWmiThreadCleanup and the DLL_THREAD_DETACH / TlsAlloc / TlsFree plumbing from capemon.c (capemon.c is now identical to upstream). Builds clean for x64 and Win32 Release.
doomedraven
added a commit
to doomedraven/capemon
that referenced
this pull request
Sep 3, 2026
The previous commit (cd6c6ba) already contains the fully resolved merge of upstream's SafeLookup (PR kevoreilly#190) line, but was recorded as a single-parent commit, so GitHub still computed the PR as conflicting against the base. This is a strategy=ours merge: it records upstream/capemon (681b109) as a second parent without changing the tree, which already matches a clean 3-way merge (verified: cd6c6ba differs from upstream only in the 6 files this branch legitimately modifies - hook_wmi.c, hook_com.c, hooks.c, hooks.h, hooking.h, SKILL.md - and every upstream-only file is byte identical). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011ERDQPRdwhLUf4khBLdvoL
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.