design modern position independent code in C/C++, design modern position independent code in C/C++

Last year, I sat down to explore exception handlers and page permissions for masking payloads in memory. The POC was easy. I hit trouble building it into a position-independent DLL loader. I needed global variables and a means to package multiple resources together. Basic things were just too hard. I realized, wow, these are fundamental…

Today, I’m releasing another update to the various Tradecraft Garden projects. This update is a dose of Future C2 and some cool updates to the Crystal Palace tech. Here’s the latest: Code Mutation and More… This release adds a Binary Transformation Framework (BTF) to Crystal Palace. The BTF is the ability to disassemble programs, modify…

I’m back with another update to the Tradecraft Garden project. Again, this release is focused on the Crystal Palace linker. My priority in this young project is to build the foundation first, then the rest can move in earnest. What’s New? The major focus of this release was the re-development of Crystal Palace’s COFF parser…

When I started work on Crystal Palace, my initial thought was to see how much I could ease development of position-independent code DLL capability loaders using the tools and manipulations possible with a linker. The initial Tradecraft Garden examples were built with these primitives. Crystal Palace doesn’t just merge and append COFFs though. It’s a…

The goal of Tradecraft Garden is to separate evasion tradecraft from C2. Part of this effort involves looking for logical lines of separation. And, with PIC, I think we’ve just found one of them. Two weeks ago, I introduced several features that brought a unified convention model for Crystal Palace PIC and its BOF-like PICOs.…

What’s more relaxing than a beautiful fall day, a crisp breeze, a glass of Sangria, and music from the local orchestra? Of course, I expect you answered: writing position-independent code projects that separate capability from tradecraft. If you didn’t answer that way, you’re wrong. In the last six months, Tradecraft Garden has covered a lot…

I have a challenge for you: How much beaconing agent functionality can you fit into 4KB PIC? How do you do it? This isn’t a shellcode golf challenge. It’s about elegant ways to build common agent stuff in C. I was able to get a WinINet loop, a light command kernel, and a BOF runner…

A new Tradecraft Garden and Crystal Palace release is available. This release introduces a proper install script and consolidates its commands behind a cpl [verb] CLI interface. I’ve also added an x64 tail call intrinsic (__transfer) and expanded API hashing beyond ror13. The new CLI Interface Crystal Palace’s loose link, piclink and other commands are…

A modern 32/64-bit position independent implant template - GitHub - Cracked5pider/Stardust: A modern 32/64-bit position independent implant template

AdaptixC2 default beacon agent extended to support Crystal Palace loaders. - k1ng0fn0th1ng/CrystalForge

Modular User-Defined Reflective Loader (UDRL) built on Crystal Palace for controlled DLL execution and evasion research. - k1ng0fn0th1ng/reflectra

A Cobalt Strike RL built with Crystal Palace — module overloading, NtContinue entry transfer, call stack spoofing, sleep masking, and static signature removal. - kapla0011/KaplaStrike

Crystal Palace Evasion kit for Sliver. Contribute to licitrasimone/CrystalSliver development by creating an account on GitHub.

GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.

An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution - Octoberfest7/Secure_Stager

Evasion kit for Cobalt Strike. Contribute to PhantomSecurityGroup/Crystal-Kit development by creating an account on GitHub.

Evasion kit for Cobalt Strike. Contribute to rasta-mouse/Crystal-Kit development by creating an account on GitHub.

Crystal Palace library for proxying Nt API calls via the Threadpool. Updated for call gadgets. - SAERXCIT/LibTP_Gadget