- Change all apt install commands from default-jdk to openjdk-17-jdk;
default-jdk on current Kali/Ubuntu pulls Java 21 which breaks
crystalpalace.jar with NoSuchMethodError
- Fix RUNBOOK.md verify step: ">= 11" → "must be 17"
- TOOLCHAIN.md tools table: mark Java 17 as exact requirement
- TOOLCHAIN.md section 7: add Java version gotcha with fix command
- Add `make -C crystal-exec all` to README quick build, RUNBOOK Phase 1.1
build steps, and quick smoke test — without it pack-extension.sh fails
because crystal-exec.x64.dll is missing from the tarball
- Update crystal-loader.x64.dll verified size: 114 KB → ~232 KB (grew after
post-ex ExitThread and loader fixes were merged)
- Add crystal-exec.x64.dll verified size: ~328 KB (was undocumented)
- Fix stager "~60 KB" placeholder in bundle-stager.sh and stager/Makefile:
actual built size is ~17 KB
- RUNBOOK Phase 1.1: add explicit note that both DLLs must exist before
running pack-extension.sh
- crystal-exec: new Sliver extension command that runs shell commands
through Crystal Palace evasion (Draugr, AMSI bypass, XOR mask,
cleanup). The post-ex DLL (crystalexec.c) is CRT-free / kernel32-only
and embedded as a byte array inside crystal-exec.x64.dll — no PICO
file to upload.
- crystal-exec uses a single callback model: all output accumulated into
a 4MB heap buffer, exactly one callback() call at the end. Sliver only
displays the first callback invocation; multiple calls are silently
dropped.
- Output channel: anonymous pipe (no disk artifact). 30-second PICO
timeout, 10-second reader drain.
- Extension manifest updated with crystal-exec command entry.
pack-extension.sh updated to include crystal-exec.x64.dll.
- Docs: RUNBOOK Phase 3 rewritten (correct --payload syntax, | runtime
args, postex.sh workflow); Phase 4 added for crystal-exec. TOOLCHAIN
section 3d documents 4-step build pipeline and CRT-free constraint.
Both READMEs updated with Use case C, new layout entries, and verified
table.
Simone Licitra