Simone Licitra 53db225f03 docs: update for Initialize export, evasion fixes, and in-memory loading model ...

- TOOLCHAIN.md §3c: crystal-loader now ~42 KB, exports Initialize, RW→RX,
  -s + --gc-sections flags, no identifying strings
- TOOLCHAIN.md §3d: crystal-exec now ~75 KB, gen_pico_header.py replaces xxd,
  XOR-encrypted embedded PICO, same evasion properties as §3c
- RUNBOOK.md §1.1: correct DLL sizes (42/75 KB)
- RUNBOOK.md §3: add Defender surface note — DLLs load in-memory via Sliver,
  PICO file from upload IS on disk and visible to scanner
- RUNBOOK.md §4: note crystal-exec DLL is in-memory, PICO XOR-encrypted at build
- README.md: fix RWX→RW+RX description, update verified table sizes/export,
  fix default-jdk → openjdk-17-jdk in quick build

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-12 09:35:19 -04:00

..

PORTING_MAP.md

feat: rystal Palace evasion kit ported to Sliver C2

2026-05-14 08:50:51 +02:00

RUNBOOK.md

docs: update for Initialize export, evasion fixes, and in-memory loading model

2026-06-12 09:35:19 -04:00

TOOLCHAIN.md

docs: update for Initialize export, evasion fixes, and in-memory loading model

2026-06-12 09:35:19 -04:00