portbuster1337-ArachneC2/docs/development-roadmap.md

Development Roadmap

Phase 0: Foundation (Weeks 1-2)

• Project structure and documentation
• Go module initialization (go mod init)
• libp2p host setup (TCP + WebSocket transports)
• Ed25519 key generation and PeerID derivation
• GossipSub topic subscription and publishing
• Basic Envelope protobuf definition

Phase 1: Core Protocol (Weeks 3-4)

• Implant registration and beacon model
• Operator node: subscribe to beacons, dispatch commands
• Envelope signing and verification
• Task execution and result delivery
• Reconnect / resilience logic

Phase 2: Implant Capabilities (Weeks 5-8)

• File system operations (ls, cd, pwd, download, upload)
• Process enumeration (ps)
• Command execution (execute)
• Interactive shell (shell with PTY — direct libp2p stream)
• Screenshot capture (stub)
• Cross-platform support (Linux, macOS, Windows)
• Beacon interval + jitter configuration

Phase 3: Interactive Sessions (Weeks 9-10)

• Direct libp2p stream establishment
• Interactive shell with PTY support
• Port forwarding (libp2p stream tunnel)
• SOCKS5 proxy through implant
• Session multiplexing

Phase 4: IPFS Integration (Weeks 11-12)

• IPFS data exfiltration (CID-based file transfer)
• IPNS for operator key rotation
• Public pinning service integration (optional)
• Filecoin storage deals (future)

Phase 5: Operator Tooling (Weeks 13-14)

• Single binary architecture (cmd/arachne — serves and generates)
• Self-contained binary (implant source embedded at build time)
• Implant generation from CLI (generate --os --arch --upx --output)
• Implant generation from interactive console ('generate' command)
• Persistent implant identity (embedded keypair per build)
• Interactive console (liner-based readline)
• gRPC local API (service definitions exist, needs integration)
• Multi-operator support
• Proper CLI framework (flag-based commands)

Phase 6: Advanced Features (Weeks 15-16)

• VM detection (--antivm: 65+ techniques, VMAware-compatible scoring, pure Go)
• Process injection and migration
• Windows token manipulation
• Pivot through compromised implants
• COFF/BOF loading (inline execution)

Phase 7: Hardening (Ongoing)

• Cover traffic (random noise to mask beacon timing)
• Ephemeral implant PeerIDs (new key per build)
• End-to-end encryption review
• Traffic analysis resistance
• Protocol fuzzing
• Go routine leak detection
• Memory safety review of implant

Tech Stack

Component	Technology
Language	Go (1.22+)
P2P Networking	go-libp2p
PubSub	go-libp2p-pubsub
Serialization	Protocol Buffers (proto3)
DHT	go-libp2p-kad-dht
Relay	go-libp2p-circuit
PTY	creack/pty
CLI	peterh/liner (readline)
RPC	gRPC (protos defined, not yet wired)