Ignorantia Invinciblis
Another Crystal Palace and Tradecraft Garden release is now available. This release fills some gaps from recent releases and rounds out the feature set (aka, stuff I wanted to ship, but didn t get to in time). Language-specific Handlers Two releases ago, I added stack unwinding meta-info generation to Crystal Palace. My original goal was to Continue reading LSH delish
A new Tradecraft Garden and Crystal Palace release is available. This release introduces a proper install script and consolidates its commands behind a cpl [verb] CLI interface. I’ve also added an x64 tail call intrinsic (__transfer) and expanded API hashing beyond ror13. The new CLI Interface Crystal Palace’s loose link, piclink and other commands are Continue reading Cruising Forward with the…
Last week, I came across the Asynchronous PICOs project released by Marcos Gonzalez Hermida at NCC Group. The project is a source code framework for in-process long-running PIC jobs in Cobalt Strike. The Async PICOs project uses Crystal Palace PICOs (output as PIC) to define a base convention. I like the problem Marcos chose here. Continue reading A Long-running BOF Component Contract
We’re at the 12th release of Crystal Palace and marking one year in the Tradecraft Garden. This release adds reference relaxation to make global references PIC-friendly. I’ve also added stack unwinding generation for Crystal Palace outputs too. And, I’ve got some thoughts on an alternative to PE shellcode runners. Before we go further, I want Continue reading Relax and unwind in the Tradecraft…
Last week, memN0ps published DoublePulsar: A User-defined Reflective Loader in the Crystal Palace and Tradecraft Garden Era. It’s a lengthy blog post, about 50 printed pages. And, most of those are devoted to memN0ps fantastic deep-dive into evasion mechanics and conquering the challenges of building a monolithic UDRL using Rust s nightly toolchain. memN0ps devoted significant Continue reading…
I have a challenge for you: How much beaconing agent functionality can you fit into 4KB PIC? How do you do it? This isn’t a shellcode golf challenge. It’s about elegant ways to build common agent stuff in C. I was able to get a WinINet loop, a light command kernel, and a BOF runner Continue reading Small PIC Energy
Last month, I released a Yara signature generator for Crystal Palace. AKA, an invariant content observation tool. I then used the feature to document the physics of various content-signature parameters (e.g., length, signature agreement, etc.) Now, I’m releasing the follow-on features to give you tools to play with the program content assumptions that signatures act Continue reading A scalpel, a…
Crystal Palace now has a Yara rule generator. In this blog post, I’ll walk you through the design and evaluation of this feature. Add -g "outfile.yar" to generate Yara rules alongside ./link and ./piclink s output. There s a Java API for this too. The .spec file rule command gives advice to the Yara generation. This command Continue reading The Islands of Invariance
Happy New Year. I’ve got another Crystal Palace and Tradecraft Garden update for you. My focus this development cycle was making Crystal Palace s binary transformation framework more robust. I think this is also a good opportunity to brain dump some technical details on this piece of our tradecraft and capability separation stack. But before we Continue reading Keeping bin2bin out of the bin
What’s more relaxing than a beautiful fall day, a crisp breeze, a glass of Sangria, and music from the local orchestra? Of course, I expect you answered: writing position-independent code projects that separate capability from tradecraft. If you didn’t answer that way, you’re wrong. In the last six months, Tradecraft Garden has covered a lot Continue reading Tradecraft Orchestration in the Garden