Which commit was capemon.dll compiled from

[tsarpaul]

Which commit was capemon.dll compiled from

[kevoreilly]

Hi Paul, the very latest commit is the one used to compile capemon. So I'm not sure what might be causing your issue, just in case I used VS 2017 with the latest updates.

If you have modified the code then I would suggest trying first without mods. If that doesn't work then please try and let me know any further details from the logs. Sometimes the RVA of the crash in capemon can be used to pinpoint the area in the source responsible for the crash.

[tsarpaul]

Cool, I thought it might've been an integration issue since the dates which have capemon.dll compiled in the repository are earlier than the most recent commits.

It was an issue on my end: the same patch I placed on NewExtraction branch:
tsarpaul/capemon@ba3c555

Didn't work on capemon for some reason so I did something else.
(I'm speeding up the environment by disabling behavior logging)

[kevoreilly]

That's probably commits where the only code changes were to the loader so these were the only updated binaries.

[kevoreilly]

Actually it could be that i committed changes which failed in testing when trying to integrate the behavioural extraction code into the main monitor. I will hopefully complete this work soon but have to be very careful with changes to the monitor binaries as they are complex, sensitive and critical.