- probe_tcp_port: add error fd set to select() so failed non-blocking
connects that only signal the error set are correctly detected
- build_aws_cred_path: track append position in a local variable instead
of calling wstr_len() on each iteration (O(n) instead of O(n²))
- build_appservice_token_path: resolve the resource string once up front
instead of building the URL with a hardcoded default then tearing it
down and rebuilding when a custom resource is provided
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- applications_enum.c: Remove RegCloseKey on uninitialized handle when
RegOpenKeyExA fails (undefined behavior bug)
- window_handles_enum.c: Report errors when GetClipboardData or
GlobalLock fail in TestClipboardAccess instead of silently ignoring
- powershell_history.c: Add error codes to file open/seek/read failures
in read_snippet_ascii_at for diagnosability
- notepad_grab.c: Report error when CreateToolhelp32Snapshot fails
in FindNotepadProcesses
- process_tokens_list.c: Report specific failure reason in
EnableSeDebugPrivilege (OpenProcessToken vs LookupPrivilegeValue)
- wevt_logon_enum.c: Report which wevtapi function failed to resolve
instead of generic failure message
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- .github/workflows/release.yml: Fix script injection by moving
user-controlled inputs (module_path, tag_suffix) to env vars instead
of direct ${{ }} interpolation in shell blocks. Pin
softprops/action-gh-release to SHA (v2.6.2). Add explicit
permissions: contents: read to the detect job.
- collection/ai_surface/ai_surface.c: Replace INVALID_FILE_ATTRIBUTES
with the correct (DWORD)0xFFFFFFFF for GetFileSize error check.
Both happen to be 0xFFFFFFFF but the former is semantically wrong.
- discovery/wallpaper_enum/metadata.json: Remove trailing comma that
made the file invalid JSON.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Reduced MAX_PROJECT_HITS from 48 to 16 and renamed sections for improved clarity. Updated functions for artifact reporting and path checks, including new checks for Codex and Claude agent artifacts. Enhanced README to reflect changes in functionality and added details on MCP configuration discovery.
Increased MAX_PROJECT_HITS from 16 to 48 and renamed related sections for clarity. Introduced new functions for reporting artifact hits and directory checks. Updated README to reflect changes in AI configuration and agent artifact discovery, including additional paths for Claude, Cursor, Codex, and Gemini configurations.
Single BeaconPrintf call with up to 32KB content caused .NET-based C2
agents to throw startIndex out of range errors. Output is now chunked
into MAX_OUTPUT_LENGTH (32000 byte) segments.
Gavin K