mirror of https://github.com/licitrasimone/CrystalSliver synced 2026-06-21 13:55:58 +00:00

Files

T

History

Simone Licitra f908321ebf fix: evade Win64/MeterBof.A — rename go export, strip BOF strings, fix RWX

- Rename exported symbol go → Initialize in both crystal-loader.c and
  crystal-exec.c; update extension.json entrypoint accordingly.
  The go(char*, uint32_t, callback) export is the primary MeterBof.A
  static signature — renaming it removes the match.
- Remove all [crystal-loader] / [crystal-exec] / PICO-identifying string
  literals from both DLLs; replace with short generic error strings.
- Fix crystal-loader.c VirtualAlloc(PAGE_EXECUTE_READWRITE) → VirtualAlloc(RW)
  + VirtualProtect(RX); no RWX mapping ever held (same fix applied to
  crystal-exec.c in previous commit).
- Add -s / -ffunction-sections / -fdata-sections / --gc-sections to
  wrapper/Makefile; crystal-loader.x64.dll shrinks from ~232 KB to 42 KB.

2026-06-12 09:23:27 -04:00

loader

feat: add crystal-exec command and update all docs

2026-06-11 15:45:01 -04:00

postex-loader

feat: add crystal-exec command and update all docs

2026-06-11 15:45:01 -04:00

sliver-glue

fix: evade Win64/MeterBof.A — rename go export, strip BOF strings, fix RWX

2026-06-12 09:23:27 -04:00

README.md

feat: two-file stager with AES-256-CBC evasion (bypasses Wacatac.B!ml + ZomBytes.B)

2026-06-11 16:46:46 -04:00

README.md

crystal-kit-sliver/

Source tree for the Crystal Palace ↔ Sliver port. See the project root README for the overview, build instructions, and operational flow.

Layout

Directory	Contents
`loader/`	Reflective loader sources (Use case A, implant evasion). Verbatim copy of `loader/` from upstream Crystal-Kit.
`postex-loader/`	Post-ex loader sources (Use case B). Crystal-Kit upstream + Xenon patch (DFR → `ror13`, removed `$GMH`/`$GPA` CS smart pointers, added `dll_args` section).
`sliver-glue/`	Sliver-specific build glue and Extension wrapper.
`sliver-glue/wrapper/`	`crystal-loader.c` — Sliver Extension DLL for Use case B (`crystal` command).
`sliver-glue/crystal-exec/`	`crystalexec.c` + `crystal-exec.c` — built-in shell executor via Crystal Palace (`crystal-exec` command). 4-step build: DLL → PICO → embedded header → extension DLL.
`sliver-glue/stager/`	Custom Use case A stager. `stager.c` reads `payload.dat` (AES-256-CBC), decrypts via BCrypt, and executes the PICO. `gen_payload.py` encrypts with `openssl`. `manifest.xml` declares `asInvoker`.
`libtcg.x64.zip`	Upstream binary dependency. Kept in-tree so `loader.spec`'s `mergelib "../libtcg.x64.zip"` resolves without extra setup.

Build entry points

make -C loader all — produce 8 .o files + 1 .bin under loader/bin/
make -C postex-loader all — same for postex
make -C sliver-glue/wrapper all — produce sliver-glue/crystal-loader.x64.dll (Sliver Extension, crystal command)
make -C sliver-glue/crystal-exec all — produce sliver-glue/crystal-exec.x64.dll (built-in shell executor, crystal-exec command)
sliver-glue/postex.sh <dll> [args] — Use case B convenience wrapper: DLL → PICO, prints ready-to-paste Sliver command
sliver-glue/generate.sh — lower-level Use case B build wrapper (called by postex.sh)
sliver-glue/generate-implant.sh — Use case A build wrapper
sliver-glue/bundle-stager.sh <pico.bin> [stager.exe] — Use case A primary: AES-encrypt PICO, compile stager → csvchelper.exe + payload.dat
sliver-glue/bundle-implant.sh — Use case A legacy: Crystal Palace demo stager run.x64.exe (detected by Defender, kept for reference)
sliver-glue/pack-extension.sh — package both DLLs + extension.json into Sliver Extension tarball

Required environment

export CRYSTAL_PALACE_HOME=/path/to/external/crystalpalace/dist
# Optional, only for generate-implant.sh --profile mode:
export SLIVER_SERVER=/path/to/sliver-server

Detailed documentation

Upstream attributions: ../NOTICE.md