[pull] master from kevoreilly:master

analyzer/windows/analyzer.py

@@ -1241,6 +1241,7 @@ def _handle_service(self, servname):
     def _handle_resume(self, data):
         # RESUME:2560,3728'
         self.analyzer.LASTINJECT_TIME = timeit.default_timer()
+        self._handle_process(data)
 
     def _handle_shutdown(self, data):
         """Handle attempted shutdowns/restarts.
@@ -1334,16 +1335,9 @@ def _handle_process(self, data):
         suspended = False
         process_id = thread_id = None
         # We parse the process ID.
-        suspended, data = data.split(b":")
-        if b"," not in data:
-            if data.isdigit():
-                process_id = int(data)
-        elif data.count(b",") == 1:
-            process_id, param = data.split(b",")
-            thread_id = None
-            process_id = int(process_id) if process_id.isdigit() else None
-            if param.isdigit():
-                thread_id = int(param)
+        pid_s, tid_s = data.split(b",", 1)
+        process_id = int(pid_s)
+        thread_id  = int(tid_s)
         if process_id and not ANALYSIS_TIMED_OUT:
             if process_id not in (self.analyzer.pid, self.analyzer.ppid):
                 # We inject the process only if it's not being

changelog.md

@@ -1,3 +1,16 @@
+### [22.10.2025]
+* Remove obsolete 'suspended' parameter from PROCESS monitor message
+* Monitor updates:
+    * WriteMemoryHandler: prevent analysis log spam for small PE writes
+    * Cap per-process messages to prevent detonation slow-down & failure in e.g. 9f8333d81c13ea426953b758140836cff2cf7e7f32e36738f118c6257c6efd34
+    * Experimental debugger action 'guard' to trap on guard violation
+    * (origin/capemon, origin/HEAD) YaraHarness: write rules canary detection to analysis log
+    * YaraHarness: simplify 'dump' option
+    * Deprecate Win7 wow64 breakpoint workaround
+    * Implement Gemini suggestions from #111
+    * Merge pull request #111 from StephanTLavavej/unordered_map
+    * Improve NtContinueHandler debug register stealth/protection to allow detonation of e.g. 8443224de889424012ba57ec075fec219104fffa8c3ae13a2db27b4ba9d71a3b
+
 ### [13.10.2025]
 * Monitor updates:
     * Fix debug output for dump-limit config setting