Definitely a balancing act on this one. And, I agree fully. Good project ownership/management requires strong opinions and strong sense of what "the integrity" of the project is. :)
I've added some YARA rules to the Crystal-Kit repo, covering both the loader and the tradecraft PICO. I was pleasantly surprised to see the generator target aspects like heap obfuscation, call stack spoofing, CFG bypass, and memory cleanup.
github.com/rasta-mouse/...
The above doesn't just apply to C2s or offensive security. Platform owners of any ilk, who see a problem that their community and partners are collectively trying to solve, would do well to look for that expended energy, see the barriers, and ask what they can do to make that energy more effective
This isn't new for me. I ran CS this way too. My theory remains: if 1-3 people did something the hard way, maybe 5-100 people will engage with, bring new ideas, and build on something if I solve the ass pains well enough.
This is some of the most important project management advice I have to offer
And, the above is one of the ways I think about leverage. It's never an isolated thought exercise. It really is seeing what you want to do, filtering w/ and re-assessing my scope, making good guesses about what's making your work harder, and trying to go from painful slog to fast effort/reward loop.
ised was my response here. One command. Match a pattern, insert or replace w/ some user-provided code. Binary patching upgraded by bin2bin lifting and lowering. No need to edit source code, can happen at time of use, re-usable across programs, and much safer/flexible/more powerful than byte patching
Instead, I see that effort as a vote that the problem matters now (possibly contrary to my thinking) & despite barriers, someone is willing to expend energy with my work to get that outcome. Not only that, but it's also a clue about the skills I can reasonably assume too (e.g., comfort with x64 asm)
Digging into a project's source code to change a content specific tell is never high-leverage. I appreciate folks do it, but it's tedious & time sucking work. It makes it hard to stay in sync with updates. Sure, it's doable. But, just because it's POSSIBLE does not mean the problem is solved.
When ised was crystallizing for me, I saw Abdullah's blog post. It validated what I was thinking about.
Here's another Raffi-ism: I watch what you're trying to do, and I EVALUATE the effort for the reward. I do not think: oh, they COULD do it, problem solved. I think: how hard was it and why?
Daniel's post was important, because it gave me two pieces of information:
(1) +mutate didn't break-up constants in the linker-generated __resolve_hook. It should have, but I missed this.
(2) Even if CPL worked w/ another obfuscator, the linker's output is targetable. CPL needs a strategy there
But, if you read those two blog posts, something I hope you'll see:
I took both of those thought exercises, and sought to compress them into one fast workflow.
This is how I think about "leverage". I see what you're already doing and ask: can I make that better w/o an important sacrifice?
When I wrote the narrative for the post, I *really* wanted to work in:
@rastamouse.me 's Cracking the Crystal Palace
rastamouse.me/cracking-the...
AND
Abdullah's Patching Crystal Palace: bypassing detection
kuwaitist.github.io/posts/Patchi...
I was too exhausted at the finish line to do it.
So, when I was writing my latest blog post, a few typos got in there. It's how you know I wrote it. :)
I really wanted to ship that day. The engineering was solid though. I put serious tortured (over-)thinking into the design & impl. decisions. I'm thrilled with the result.
vimeo.com/1170068618
[BLOG]
Islands of Invariance
rastamouse.me/islands-of-i...
Screenshot demonstrating some Crystal Palace shellcode generated by Mythic, running on a Windows machine and popping a message box.
Screenshot demonstrating the payload UUID from a Mythic payload, patched into a Crystal Palace linker variable.
Started working on a Mythic agent that uses Crystal Palace to generate its shellcode. So far I've just got it to emit some generic shellcode - it doesn't talk to Mythic yet.
I'm hoping to make a fully modular agent that you can patch your tradecraft into when you generate a payload :)
This is now committed along with a few other changes like using the newer CPL Java API.
I've been playing with a C2 built around PIC modularity for the last few weeks. C2 comms are merged into the agent at link time and output as shellcode. COFFs are transformed into PICOs for postex. Evasion tradecraft can be woven in via spec files. Very scriptable using Sleep.
The Islands of Invariance
More than I ever thought I'd write about Yara signatures. Oh also, Crystal Palace has a Yara rule generator too.
aff-wg.org/2026/02/02/t...
And, here's the GitHub project for Eden Loader.
github.com/Cobalt-Strik...
And, just posted too: Will Burgess' Linkers and Loaders: Experiments with Crystal Palace at beac0n 2025.
www.youtube.com/watch?v=GijV...
Will and I know the same tech pains really well. Good play-through with Crystal Palace and ideas around it. I appreciate the kind words & getting the word out
Cobalt Strike blog ppost by x.com/joehowwolf on using Crystal Palace to mash-up Page Streaming and Draugr Call Stack Spoofing into a Cobalt Strike UDRL.
(Again, I really love the comics. They are perfect).
Georgia Weidman has posted some December 2010 NovaHackers talks, including my first talk on Armitage.
x.com/georgiaweidm...
Video link:
www.youtube.com/watch?v=ZtnK...
A nice workaround against my YARA rule.
kuwaitist.github.io/posts/Patchi...
"By releasing these tables, Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1."
I pushed a 1-change update to Crystal Palace. linkfunc now works with make coff. link (in a make coff context) merges the linked data into the .rdata section.
Both are to support the BOF cocktails idea.
rastamouse.me/bof-cocktails/
Keeping bin2bin out of the bin
aff-wg.org/2026/01/13/k...
Another TCG update. +shatter, +regdance, and -O1 MinGW support.
Bigger emphasis in this cycle was hardening the binary transformation foundation--which led to some adventures (details in the post)
The caveat emptor which is in Daniel's post: Crystal Palace needs a patch to get rid of an over broad error check. I'll address this in the next release and even make sure my local unit tests are covering/working with COFF output more.
This does change how I see COFF output in Crystal Palace though
Further, while a transparent time-of-use BOF hook isn't there for CS (yet?):
BOFs could be processed offline to add your favored tradecraft cocktail to them. Any C2 could benefit from that.
Further, any C2 could build this time-of-use hook for their BOFs too.
TCG is C2/capability agnostic
