Simone Licitra cb59516ddf feat: add crystal-exec command and update all docs ...

- crystal-exec: new Sliver extension command that runs shell commands
  through Crystal Palace evasion (Draugr, AMSI bypass, XOR mask,
  cleanup). The post-ex DLL (crystalexec.c) is CRT-free / kernel32-only
  and embedded as a byte array inside crystal-exec.x64.dll — no PICO
  file to upload.

- crystal-exec uses a single callback model: all output accumulated into
  a 4MB heap buffer, exactly one callback() call at the end. Sliver only
  displays the first callback invocation; multiple calls are silently
  dropped.

- Output channel: anonymous pipe (no disk artifact). 30-second PICO
  timeout, 10-second reader drain.

- Extension manifest updated with crystal-exec command entry.
  pack-extension.sh updated to include crystal-exec.x64.dll.

- Docs: RUNBOOK Phase 3 rewritten (correct --payload syntax, | runtime
  args, postex.sh workflow); Phase 4 added for crystal-exec. TOOLCHAIN
  section 3d documents 4-step build pipeline and CRT-free constraint.
  Both READMEs updated with Use case C, new layout entries, and verified
  table.

2026-06-11 15:45:01 -04:00

..

PORTING_MAP.md

feat: rystal Palace evasion kit ported to Sliver C2

2026-05-14 08:50:51 +02:00

RUNBOOK.md

feat: add crystal-exec command and update all docs

2026-06-11 15:45:01 -04:00

TOOLCHAIN.md

feat: add crystal-exec command and update all docs

2026-06-11 15:45:01 -04:00