Injection Failed

[bluebook313]

Hi @kevoreilly,

I'm attempting to inject the capemon DLL into Edge and Chrome, but it isn't working as expected. For context, I've already tested this on Firefox and Internet Explorer, and it works fine—the PDF opens correctly in both browsers. The issue appears to be isolated to Edge and Chrome.

Here’s the log output I’m seeing:
[PipeServer] Starting on \.\pipe\cape
[RootInjector] Launched suspended → PID 888
[+] .ini written for PID 888 → .\Desktop\888.ini
[RootInjector] Injecting PID 888: C:\Users\Smb\Desktop\Viwa_Agent\app\bin\loader64.exe inject 888 724 C:\Users\Smb\Desktop\Viwa_Agent\app\bin\capemon64.dll
C:\Users\Smb\Desktop\Viwa_Agent\app\bin\loader64.exe inject 888 724 C:\Users\Smb\Desktop\Viwa_Agent\app\bin\capemon64.dll
2026-05-19 18:53:08,644 - INFO - (b'DEBUG', b'Loader: Injecting process 888 (thread 724) with C:\Users\Smb\Desktop\Viwa_Agent\app\bin\capemon64.dll.', 'dispatch')
2026-05-19 18:53:08,644 - INFO - (b'DEBUG', b'InjectDllViaIAT: Successfully patched IAT.', 'dispatch')
2026-05-19 18:53:08,644 - INFO - (b'DEBUG', b'Successfully injected DLL C:\Users\Smb\Desktop\Viwa_Agent\app\bin\capemon64.dll.', 'dispatch')
[RootInjector] SUCCESS injecting PID 888
[RootInjector] Root process resumed
[ChildInjector] Started monitoring children of root PID 888
2026-05-19 18:53:08,863 - INFO - (b'DEBUG', b'888: Disabling sleep skipping.', 'dispatch')
2026-05-19 18:53:08,863 - INFO - (b'DEBUG', b'888: Chrome-specific hook-set enabled.', 'dispatch')
2026-05-19 18:53:08,863 - INFO - (b'GETPIDS', b'', 'dispatch')
[PipeServer] Client connected to \.\pipe\cape
[BsonLogForwarder] Thread started
2026-05-19 18:53:08,878 - INFO - (b'DEBUG', b'888: RtlInsertInvertedFunctionTable 0x00007FFFDE48090E, LdrpInvertedFunctionTableSRWLock 0x00007FFFDE5DD510', 'dispatch')
2026-05-19 18:53:08,878 - INFO - (b'DEBUG', b'888: Monitor initialised: 64-bit capemon loaded in process 888 at 0x00007FFFAD220000, thread 724, image base 0x00007FF63B660000, stack from 0x0000006C62BF1000-0x0000006C62C00000', 'dispatch')
2026-05-19 18:53:08,878 - INFO - (b'DEBUG', b'888: Commandline: "C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Users\Smb\Desktop\extracted_files_folder\New_folder_v2_2\aa.pdf', 'dispatch')
49 2026-05-19 18:53:08,894 - INFO - (b'DEBUG', b'888: Hooked 2 out of 2 functions', 'dispatch')
[BsonLogForwarder] PeekNamedPipe failed - client likely disconnected
[BsonLogForwarder] Thread stopped - pipe closed, files flushed

Let me know if you need any additional details or if I'm missing something on my end. Thanks!

[kevoreilly]

capemon intentionally uses an extremely limited hookset for known browser processes; full hooking of Chromium's process tree and sandbox model has proven impractical and causes widespread breakage, so it's deliberately avoided. This hookset appears to be working as intended here, as suggested by the log output Hooked 2 out of 2 functions.

However RootInjector, ChildInjector, Viwa_Agent, etc aren't part of this project, it's quite possible there are issues with this orchestration harness which it seems you are not being forthcoming about. I would be happy to help if you want to explain what you're building and share the actual code path failing.