Raphael Mudge
@raphaelmudge.bsky.social
📤 327
📥 18
📝 303
Riding around in the breeze. Security Thinker. Hacker. USAF Veteran.
https://aff-wg.org
If anyone wanted to play with (or look at) the source to the latest Crystal Palace, the cpsrc20260303.tgz archive I shipped had contents from an out of date branch. Oops :) Source for the 20260303 release is on TCG now. Validated it builds what shipped. Thanks
@shogunlab.bsky.social
for heads up
1 day ago
0
6
0
Bypassing EDR in a Crystal Clear Way by
x.com/LorenzoMeacci
Blog:
lorenzomeacci.com/bypassing-ed...
Project:
github.com/kapla0011/Ka...
loading . . .
Bypassing EDR in a Crystal Clear Way | Lorenzo Meacci
Most operators spend days engineering the perfect shellcode loader and ship the payload naked. This blog takes you from how C2 payloads actually work under the hood all the way to building a fully eva...
https://lorenzomeacci.com/bypassing-edr-in-a-crystal-clear-way
2 days ago
0
6
2
reposted by
Raphael Mudge
Calzone
9 days ago
Still very much an early WIP, but the Crystal Palace-based Mythic agent I'm working on can be found here:
github.com/ofasgard/cel...
loading . . .
GitHub - ofasgard/celebi: A WIP Mythic agent that uses Crystal Palace to build its payloads.
A WIP Mythic agent that uses Crystal Palace to build its payloads. - ofasgard/celebi
https://github.com/ofasgard/celebi
2
2
2
reposted by
Raphael Mudge
_RastaMouse
12 days ago
I've added some YARA rules to the Crystal-Kit repo, covering both the loader and the tradecraft PICO. I was pleasantly surprised to see the generator target aspects like heap obfuscation, call stack spoofing, CFG bypass, and memory cleanup.
github.com/rasta-mouse/...
loading . . .
Crystal-Kit/crystalkit.yar at main · rasta-mouse/Crystal-Kit
Evasion kit for Cobalt Strike. Contribute to rasta-mouse/Crystal-Kit development by creating an account on GitHub.
https://github.com/rasta-mouse/Crystal-Kit/blob/main/crystalkit.yar
0
5
1
So, when I was writing my latest blog post, a few typos got in there. It's how you know I wrote it. :) I really wanted to ship that day. The engineering was solid though. I put serious tortured (over-)thinking into the design & impl. decisions. I'm thrilled with the result.
vimeo.com/1170068618
loading . . .
Breaking content signatures with 'ised'
This is "Breaking content signatures with 'ised'" by AFF-WG on Vimeo, the home for high quality videos and the people who love them.
https://vimeo.com/1170068618
12 days ago
1
7
1
reposted by
Raphael Mudge
_RastaMouse
13 days ago
[BLOG] Islands of Invariance
rastamouse.me/islands-of-i...
0
4
2
A Scalpel, A Hammer, and a Foot Gun
aff-wg.org/2026/03/03/a...
loading . . .
A scalpel, a hammer, and a foot gun
Last month, I released a Yara signature generator for Crystal Palace. AKA, an invariant content observation tool. I then used the feature to document the physics of various content-signature parame…
https://aff-wg.org/2026/03/03/a-scalpel-a-hammer-and-a-foot-gun/
14 days ago
0
5
3
reposted by
Raphael Mudge
Calzone
17 days ago
Started working on a Mythic agent that uses Crystal Palace to generate its shellcode. So far I've just got it to emit some generic shellcode - it doesn't talk to Mythic yet. I'm hoping to make a fully modular agent that you can patch your tradecraft into when you generate a payload :)
1
2
2
Punching Sideways
aff-wg.org/2026/02/23/p...
loading . . .
Punching Sideways
While I no longer work in the C2 space and I don’t consider myself up on the operations side of red teaming, I watch the space closely to see where it’s going. In this post, I want to write about a…
https://aff-wg.org/2026/02/23/punching-sideways/
22 days ago
0
11
4
reposted by
Raphael Mudge
_RastaMouse
24 days ago
This is now committed along with a few other changes like using the newer CPL Java API.
add a skeleton here at some point
0
4
2
reposted by
Raphael Mudge
_RastaMouse
about 1 month ago
I've been playing with a C2 built around PIC modularity for the last few weeks. C2 comms are merged into the agent at link time and output as shellcode. COFFs are transformed into PICOs for postex. Evasion tradecraft can be woven in via spec files. Very scriptable using Sleep.
1
7
2
The Islands of Invariance More than I ever thought I'd write about Yara signatures. Oh also, Crystal Palace has a Yara rule generator too.
aff-wg.org/2026/02/02/t...
loading . . .
The Islands of Invariance
Crystal Palace now has a Yara rule generator. In this blog post, I’ll walk you through the design and evaluation of this feature. rule PageStream_rDLL_03495de1 { meta: description = “PageStre…
https://aff-wg.org/2026/02/02/the-islands-of-invariance/
about 1 month ago
0
7
4
Cobalt Strike blog ppost by
x.com/joehowwolf
on using Crystal Palace to mash-up Page Streaming and Draugr Call Stack Spoofing into a Cobalt Strike UDRL. (Again, I really love the comics. They are perfect).
add a skeleton here at some point
about 2 months ago
1
9
2
Georgia Weidman has posted some December 2010 NovaHackers talks, including my first talk on Armitage.
x.com/georgiaweidm...
Video link:
www.youtube.com/watch?v=ZtnK...
loading . . .
Georgia Weidman on X: "A few of you asked if I had the old @novahackers videos. Yes, I do, and I'm rereleasing them! Here are the talks from December 2010, including what is possibly the very first demo of Armitage (before Cobalt Strike, there was Armitage) from @armitagehacker, a talk on hacking" / X
A few of you asked if I had the old @novahackers videos. Yes, I do, and I'm rereleasing them! Here are the talks from December 2010, including what is possibly the very first demo of Armitage (before Cobalt Strike, there was Armitage) from @armitagehacker, a talk on hacking
https://x.com/georgiaweidman/status/2014769592837586998
about 2 months ago
0
4
1
reposted by
Raphael Mudge
_RastaMouse
about 2 months ago
A nice workaround against my YARA rule.
kuwaitist.github.io/posts/Patchi...
add a skeleton here at some point
0
9
2
"By releasing these tables, Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1."
add a skeleton here at some point
2 months ago
0
4
0
I pushed a 1-change update to Crystal Palace. linkfunc now works with make coff. link (in a make coff context) merges the linked data into the .rdata section. Both are to support the BOF cocktails idea.
rastamouse.me/bof-cocktails/
loading . . .
BOF Cocktails
Crystal Palace is a PIC framework that can be used to write, among other things, prepended DLL loaders. The philosophy of the project is to apply evasion tradecraft (also written as PIC), to a capabil...
https://rastamouse.me/bof-cocktails/
2 months ago
0
9
1
Keeping bin2bin out of the bin
aff-wg.org/2026/01/13/k...
Another TCG update. +shatter, +regdance, and -O1 MinGW support. Bigger emphasis in this cycle was hardening the binary transformation foundation--which led to some adventures (details in the post)
loading . . .
Keeping bin2bin out of the bin
Happy New Year. I’ve got another Crystal Palace and Tradecraft Garden update for you. My focus this development cycle was making Crystal Palace’s binary transformation framework more robust. …
https://aff-wg.org/2026/01/13/keeping-bin2bin-out-of-the-bin/
2 months ago
0
10
3
TCG's vision is to separate tradecraft from capability and encourage an ecosystem of ground truth research. I started w/ UDRLs because the need & interfaces are there. This post applies the same ideas to BOFs. Each working tradecraft/capability pairing is a win. Some caveats (see post), exciting.
add a skeleton here at some point
2 months ago
1
4
1
reposted by
Raphael Mudge
_RastaMouse
2 months ago
I managed it:
marketplace.visualstudio.com/items?itemNa...
add a skeleton here at some point
0
4
3
This is fork&run to execute BOFs in a remote process, same API, and get output back over a pipe--demonstrated with Havoc. Same arch could support explicit injection. Add-in an injector artifact + psexec, could remotely run a BOF without an agent and get output back too. bofexec? :)
add a skeleton here at some point
3 months ago
0
6
1
reposted by
Raphael Mudge
3 months ago
To wrap up the year, I've published this Havoc extension that enables remote execution of Beacon Object Files (BOFs) using a PIC loader built with Crystal Palace.
github.com/pard0p/Remot...
loading . . .
GitHub - pard0p/Remote-BOF-Runner: Remote BOF Runner is a Havoc extension framework for remote execution of Beacon Object Files (BOFs) using a PIC loader made with Crystal Palace.
Remote BOF Runner is a Havoc extension framework for remote execution of Beacon Object Files (BOFs) using a PIC loader made with Crystal Palace. - pard0p/Remote-BOF-Runner
https://github.com/pard0p/Remote-BOF-Runner
0
4
3
reposted by
Raphael Mudge
Henri Nurmi
3 months ago
WinAPI DFR remaps for Crystal Palace to automatically convert Func() to Module$Func(). Goodbye preprocessor macros 👋.
github.com/Henkru/cp-df...
loading . . .
GitHub - Henkru/cp-dfr-defs: Dynamic Function Resolution (DFR) definitions for Crystal Palace
Dynamic Function Resolution (DFR) definitions for Crystal Palace - GitHub - Henkru/cp-dfr-defs: Dynamic Function Resolution (DFR) definitions for Crystal Palace
https://github.com/Henkru/cp-dfr-defs
0
10
3
My open source projects server is down. I got a ticket in with the provider as I believe it's something on their end. Hopefully a short outage. I'm engaged with it and will post a reply here when it's back up or if there's a pressing and exciting update.
3 months ago
1
6
0
Discovering Tradecraft Garden by
x.com/jjavierolmedo
hackpuntes.com/posts/explor...
A gentle introduction to the project and specifically using the ./link command & running examples. I'm glad the guardrails example (now follow-on loader agnostic) was called out. It's a waiting gem in the corpus.
3 months ago
0
4
2
"emerald-template is a CMake-based project template designed for developing and debugging Reflective DLL Loaders using the Crystal Palace linker." "This allows for source-code level debugging of your loader logic from Windows (and theoretically Linux) systems"
github.com/0xTriboulet/...
add a skeleton here at some point
3 months ago
0
5
1
Interesting project. Reimplements TCG example loaders in Rust and demonstrates Rust patterns for TCG and Crystal Palace. One note: my scope, dev, tests, and unit tests are limited to MinGW. Binary transforms act on patterns gcc generates and moving away from that, you're gonna hit gaps faster.
add a skeleton here at some point
3 months ago
0
2
1
reposted by
Raphael Mudge
Calzone
3 months ago
My PICOs and unit testing library have been updated for the newest version of Crystal Palace and LibTCG :)
0
1
1
reposted by
Raphael Mudge
_RastaMouse
3 months ago
Pushed a big update to Crystal Kit.
github.com/rasta-mouse/...
loading . . .
GitHub - rasta-mouse/Crystal-Kit: Evasion kit for Cobalt Strike
Evasion kit for Cobalt Strike. Contribute to rasta-mouse/Crystal-Kit development by creating an account on GitHub.
https://github.com/rasta-mouse/Crystal-Kit
0
10
2
Re: the new TCG release. I updated the Simple Hooking example into an empty base architecture and made XOR hooks and Stack Cutting into .spec modules for it:
tradecraftgarden.org/simplehook.h...
Thanks to redirect and foreach, I was able to layer these modules together to compose a tradecraft too.
4 months ago
1
2
0
reposted by
Raphael Mudge
4 months ago
LibPicoManager is a unified PICO management framework that provides centralized control over PICOs in memory, enabling dynamic code loading, runtime PICO substitution, and advanced evasion techniques like sleep masking through a single RWX code block.
github.com/pard0p/LibPi...
loading . . .
GitHub - pard0p/LibPicoManager: LibPicoManager is a unified PICO management framework that provides centralized control over Position Independent Code Objects in shared memory, enabling dynamic code l...
LibPicoManager is a unified PICO management framework that provides centralized control over Position Independent Code Objects in shared memory, enabling dynamic code loading, runtime PICO substitu...
https://github.com/pard0p/LibPicoManager
0
3
3
reposted by
Raphael Mudge
_RastaMouse
4 months ago
[BLOG] This update solved a big issue I had with merging raw assembly into PIC. I cover the new linkfunc command and the updated addhook command.
rastamouse.me/pic-symphony/
add a skeleton here at some point
0
3
2
Tradecraft Orchestration in the Garden
aff-wg.org/2025/12/01/t...
An exercise in building base architectures with Crystal Palace .spec files and configuring/layering specific tradecraft modules over them at link time.
loading . . .
Tradecraft Orchestration in the Garden
What’s more relaxing than a beautiful fall day, a crisp breeze, a glass of Sangria, and music from the local orchestra? Of course, I expect you answered: writing position-independent code projects …
https://aff-wg.org/2025/12/01/tradecraft-orchestration-in-the-garden/
4 months ago
0
7
5
reposted by
Raphael Mudge
_RastaMouse
4 months ago
[BLOG] Cracking the Crystal Palace - detecting in-memory PIC using Crystal Palace's __resolve_hook() intrinsic.
rastamouse.me/cracking-the...
add a skeleton here at some point
0
4
3
reposted by
Raphael Mudge
_RastaMouse
4 months ago
The new version of RTO II is finally available to purchase.
www.zeropointsecurity.co.uk/course/red-t...
loading . . .
Red Team Ops II
Gain the knowledge and skills necessary to operate against advanced defences.
https://www.zeropointsecurity.co.uk/course/red-team-ops-ii
1
11
9
reposted by
Raphael Mudge
_RastaMouse
4 months ago
This iteration leverages the power of
@raphaelmudge.bsky.social
's Crystal Palace ecosystem to build custom evasion tradecraft, and apply it to Beacon, BOFs and post-ex DLLs.
add a skeleton here at some point
0
8
3
Cobalt Strike thrives and innovates thanks to community + multi-talented dev/R&D/QA team mixing professional engineers & former users/contributors who know and continue the vision. (Or, just had a big wishlist they wanted to see acted on) <3 the comics. Fantastic work. Thanks for AFF-WG shout out
add a skeleton here at some point
4 months ago
0
8
0
The work under way: PIC programs (loader, capability) become a reusable & empty base. PIC service modules control bootstrapping. merge and: attach (incept Win32 API calls), redirect (N:1 layering), C modular programming (1:1 interface+implementation) populates that base with tradecraft specifics
add a skeleton here at some point
4 months ago
1
5
0
reposted by
Raphael Mudge
_RastaMouse
4 months ago
[BLOG] PICing AOP - a summary of the latest Crystal Palace commands for Aspect-Oriented Programming.
rastamouse.me/picing-aop/
loading . . .
PICing AOP
The 11.10.25 Crystal Palace release added more new commands in one go than I think I've seen thus far. Many of them seemed really similar at first blush, and it took me a while to get an understanding...
https://rastamouse.me/picing-aop/
0
6
2
Tradecraft Engineering with Aspect-Oriented Programming
@rastamouse.me
pretty much predicted what was coming in his last blog post. attach (Win32 APIs), redirect (local funcs), capability right-sized IAT hooks, and PICO function exports. Yes, attach can incept its PIC.
aff-wg.org/2025/11/10/t...
loading . . .
Tradecraft Engineering with Aspect-Oriented Programming
It’s 2025 and apparently, I’m still a Java programmer. One of the things I never liked about Java’s culture, going back many years ago, was the tendency to hype frameworks that seemed to over-engin…
https://aff-wg.org/2025/11/10/tradecraft-engineering-with-aspect-oriented-programming/
4 months ago
0
10
10
reposted by
Raphael Mudge
4 months ago
I've updated
github.com/pard0p/PICO-...
to execute indirect syscalls via LibTP + an enhanced version of LibGate. I hope this helps to demonstrate the utility of shared libraries in Crystal Palace projects 😁
loading . . .
GitHub - pard0p/PICO-Implant: PICO-Implant is a Proof of Concept C2 implant built using Position-independent Code Objects (PICO) for modular functionality. This project demonstrates that It's possible...
PICO-Implant is a Proof of Concept C2 implant built using Position-independent Code Objects (PICO) for modular functionality. This project demonstrates that It's possible to build a multi-stage...
https://github.com/pard0p/PICO-Implant/
0
3
1
reposted by
Raphael Mudge
4 months ago
PICO-Implant is a Proof of Concept C2 implant built using Position-independent Code Objects (PICO) for modular functionality. This project demonstrates that It's possible to build a multi-stage and modular C2 implant made of PICOs.
github.com/pard0p/PICO-...
loading . . .
GitHub - pard0p/PICO-Implant: PICO-Implant is a Proof of Concept C2 implant built using Position-independent Code Objects (PICO) for modular functionality. This project demonstrates that It's possible...
PICO-Implant is a Proof of Concept C2 implant built using Position-independent Code Objects (PICO) for modular functionality. This project demonstrates that It's possible to build a multi-stage...
https://github.com/pard0p/PICO-Implant
0
5
4
"I did give a heads up to Elastic before publishing this post. They have taken this technique into account and are working on updates to the detection rules to catch this." "Provided as a Crystal Palace shared library. Format inspired by
@rastamouse.me
's LibTP. " Ground truth security research.
add a skeleton here at some point
4 months ago
0
5
2
4 of the ~37 links in
@badsectorlabs.com
Last Week in Security are Tradecraft Garden related. LibIPC, LibGate, Arranging the PIC Parterre, & TCG's Community Pavilion.
@pard0p.bsky.social
dropped a WinHTTP shared library today.
blog.badsectorlabs.com/last-week-in...
Thank you for building with me.
loading . . .
Last Week in Security (LWiS) - 2025-11-03
ShareHound (@podalirius_), Conquest C2 (@virtualloc), Docker Compose path traversal (@RonMasas), dead domain discovery (@_lauritz_), Narrator persistence/lat movement (@Oddvarmoe ), Windows 11 LPE (@d...
https://blog.badsectorlabs.com/last-week-in-security-lwis-2025-11-03.html
4 months ago
0
11
0
reposted by
Raphael Mudge
4 months ago
LibWinHttp is a simplified WinHTTP wrapper designed as a Crystal Palace shared library for implant development. Its primary purpose is to facilitate the development of PICO modules that require HTTP/HTTPS transport layer communication.
github.com/pard0p/LibWi...
loading . . .
GitHub - pard0p/LibWinHttp: LibWinHttp is a simplified WinHTTP wrapper designed as a Crystal Palace shared library for implant development. Its primary purpose is to facilitate the development of PICO...
LibWinHttp is a simplified WinHTTP wrapper designed as a Crystal Palace shared library for implant development. Its primary purpose is to facilitate the development of PICO modules that require HTT...
https://github.com/pard0p/LibWinHttp
0
3
3
reposted by
Raphael Mudge
5 months ago
LibIPC is a simple Crystal Palace shared library for inter-process communication, based on Named Pipes.
github.com/pard0p/LibIPC
loading . . .
GitHub - pard0p/LibIPC: LibIPC is a simple Crystal Palace shared library for inter-process communication, based on Named Pipes.
LibIPC is a simple Crystal Palace shared library for inter-process communication, based on Named Pipes. - pard0p/LibIPC
https://github.com/pard0p/LibIPC
1
5
4
As new projects, blog posts, and other efforts around TCG show up, I'm listing them here:
tradecraftgarden.org/references.h...
I've put together a Friends of the Tradecraft Garden list on BlueSky too:
bsky.app/profile/did:...
Thank you for building, exploring, & teaching w/ this young project 🪴
add a skeleton here at some point
5 months ago
0
12
4
reposted by
Raphael Mudge
_RastaMouse
5 months ago
I've also updated Crystal Loaders to benefit from some of the new CP features
github.com/rasta-mouse/...
loading . . .
GitHub - rasta-mouse/Crystal-Loaders: A small collection of Crystal Palace PIC loaders designed for use with Cobalt Strike
A small collection of Crystal Palace PIC loaders designed for use with Cobalt Strike - rasta-mouse/Crystal-Loaders
https://github.com/rasta-mouse/Crystal-Loaders/
0
2
2
reposted by
Raphael Mudge
_RastaMouse
5 months ago
LibGate - a Crystal Palace shared library for resolving and performing syscalls
github.com/rasta-mouse/...
loading . . .
GitHub - rasta-mouse/LibGate: A Crystal Palace shared library to resolve & perform syscalls
A Crystal Palace shared library to resolve & perform syscalls - rasta-mouse/LibGate
https://github.com/rasta-mouse/LibGate
1
12
2
reposted by
Raphael Mudge
_RastaMouse
5 months ago
Quick blog post that explores some of the problems (that I had) that this update has helped solve, and where I see it potentially going in the future.
rastamouse.me/arranging-th...
add a skeleton here at some point
0
2
1
Load more
feeds!
log in