iiinova — where your digital self keeps evolving

This looks promising! Even if it's just moving all the choices to a config.spec with a bunch of string variables, that'll help separate the implementation from the user-facing bit.

100

Calzone @calz0n3.bsky.social · 7h

If anyone has ideas about a more ergonomic way to specify which labels are "switched on" in the Crystal Palace spec file, I'm all ears btw! This is the best way I could figure out for now...

110

Calzone @calz0n3.bsky.social · 10/10/2026

tinkering with composable tradecraft 👀

screenshot of the output of a WIP crystal palace based tool building reflective loaders

030

Calzone @calz0n3.bsky.social · 26/07/2026

bof2pico: Simple helper utility for converting BOFs into PICOs (with hardcoded arguments) that celebi knows how to understand. github.com/ofasgard/cel... Thanks to @rastamouse.me for the suggestion to include a format specifier with the arguments!

062

Reposted by Calzone

Bingus @sizeable-bingus.bsky.social · 14/07/2026

New post about a CET compatible stack spoofing technique and a loader integrating it :) bigbingus.com/posts/bingus... github.com/Sizeable-Bin...

bigbingus.com

BingusLdr: CET Compatible Stack Spoofing | bigbingus.com

BingusLdr: CET Compatible Stack Spoofing

175

Calzone @calz0n3.bsky.social · 24/07/2026

Yeah, that's a good shout!

000

Calzone @calz0n3.bsky.social · 24/07/2026

That's probably a sensible way to handle it as an agent command! Right now though I'm just making a little standalone bof->pico converter script, so I'd like it to handle complex args sanely for testing if nothing else

100

Calzone @calz0n3.bsky.social · 23/07/2026

Yeah, my current PoC just treats every argument as a string, but it crashes any BOF that expects numerical arguments - linking a packed arg buffer is probably more flexible!

100

Calzone @calz0n3.bsky.social · 23/07/2026

Might look into using CPL's "pack" command to construct valid BOF-format arguments at link time, although that would mean that they're hardcoded into the PICO and can't be specified on invocation 🤔

100

Calzone @calz0n3.bsky.social · 23/07/2026

Got a little bof2pico tool working (based on @raphaelmudge.bsky.social's "Simple BOF Runner") to convert BOFs into PICOs that celebi knows how to execute :) parsing arbitrary argument datatypes into the BOF argument format is a little more challenging, though.

Screenshot demonstrating the TrustedSec sc_stop BOF running as a PICO!

152

Reposted by Calzone

k1ng0fn0th1ng.bsky.social @k1ng0fn0th1ng.bsky.social · 06/05/2026

I've published CrystalForge, a Crystal Palace-based project that brings custom Crystal Palace loaders into AdaptixC2. Provide a .spec file, and the agent plugin handles the intermediate DLL linking and shellcode generation. github.com/k1ng0fn0th1n...

071

Calzone @calz0n3.bsky.social · 29/04/2026

In other words, the only part of the payload/delivery mechanism that's exposed as JavaScript is the code that imports the web assembly and the glue code generated by wasm-bindgen.

000

Calzone @calz0n3.bsky.social · 29/04/2026

I've seen this done before, but one area where my implementation differs (I think) from others is that it uses the web-sys crate to move the browser API calls (i.e. registering an onClick event handler for the button) into the Rust/WASM side as well!

100

Calzone @calz0n3.bsky.social · 29/04/2026

The idea is to replicate the basic purpose of HTML smuggling (delivering a download without making an additional request), but further obfuscate the malicious part by wrapping it in a widely supported binary format...

100

Calzone @calz0n3.bsky.social · 29/04/2026

Taking a break from other projects, so just a small one for now: I made a little proof-of-concept HTML smuggling implementation using Rust's web assembly support: github.com/ofasgard/smu...

github.com

GitHub - ofasgard/smuggle-rs: PoC for WASM HTML smuggling, written in Rust.

PoC for WASM HTML smuggling, written in Rust. Contribute to ofasgard/smuggle-rs development by creating an account on GitHub.

194

Reposted by Calzone

Raphael Mudge @raphaelmudge.bsky.social · 21/04/2026

I did some garden tending: Updated the TCG community pavilion. Added some projects and posts. Re-organized the projects section. I also added a note about ground truth curation vs. provenance for red team use. Something I wrestled with/put some thought into. tradecraftgarden.org/references.h...

063

Reposted by Calzone

Eli Mallon @iame.li · 15/04/2026

Every shell and terminal emulator ever with 100% confidence that they're doing the right thing for the user: ^[[A^[[A^[[A^[[A^[[A^[[A^[[A

922724

Reposted by Calzone

David Buchanan @retr0.id · 31/03/2026

have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.

262852855

Reposted by Calzone

Raphael Mudge @raphaelmudge.bsky.social · 28/03/2026

If you're a C2 engineer, I encourage you to watch @rastamouse.me 's expanding Crystal C2 docs. It's a World-of-tomorrow exhibit for what C2 architecture could be. Use-time capability composition, radical instrumentation opportunity, & reducing agent's burden rasta-mouse.gitbook.io/crystalc2/do...

rasta-mouse.gitbook.io

Welcome | Documentation | CrystalC2

1102

Calzone @calz0n3.bsky.social · 28/03/2026

Seconding this! Would help with dockerfiles for Mythic agents :)

020

Calzone @calz0n3.bsky.social · 25/03/2026

Relevant source code is the resolve_loaded_pico() function here: github.com/ofasgard/cel... I'm open to suggestions though, this is my first C2 agent!

110

Calzone @calz0n3.bsky.social · 25/03/2026

I wanted to keep all the PICOs in one blob of contiguous memory to make memory masking easier, so I keep the unmapped PICOs in that memory blob. Then I dynamically allocate some memory and call PicoLoad() and PicoEntrypoint() when it's time to invoke them, if that makes sense

110

Calzone @calz0n3.bsky.social · 13/03/2026

You can just turn a BOF into a PICO. No one can stop you

TrustedSec's whoami BOF from the CS-Situational-Awareness-BOF repository, ported into PICO format at running with celebi.

020

Calzone @calz0n3.bsky.social · 12/03/2026

Got dynamic PICO upload and execution working on Celebi :) both agent and uploaded capability are all written in pure Crystal Palace C, which means this is now starting to vaguely resemble a usable (though opsec-unsafe) implant!

First screenshot, displaying the Mythic UI. The register and execute_pico command have been used to upload a PICO, then execute it.

Second screenshot, showing the debug console on the target machine. It displays logs of a successful file upload and PICO execution.

Third screenshot, displaying the PICO actually executing. A messagebox has popped up onscreen.

260

Calzone @calz0n3.bsky.social · 11/03/2026

Hello prospective employer, I have various useful skills such as: - write malware - eat hot chip - lie Wait, where are you going?

010

Reposted by Calzone

Almond Offsec @almondoffsec.bsky.social · 10/03/2026

Are one-way trusts really one way? @lowercasedrm.bsky.social sums up how the TDO password lets you turn a one-way AD forest trust into bidirectional access, and releases a new tool to remotely extract these secrets. offsec.almond.consulting/trust-no-one...

032

Calzone @calz0n3.bsky.social · 10/03/2026

At the moment, I'm working on having a command to upload & map a file into memory (+corresponding cmd to free it)... then separate commands to treat it as either a PICO or BOF and invoke it. Feels like it gives the most control over what the agent is doing, but it might be a bit clunky in practice

110

Calzone @calz0n3.bsky.social · 08/03/2026

My overall goal is for it to be as modular is possible, everything from the tradecraft to the commands represented as a series of PICOs that can be swapped out either at *build time* or at *run time*. Still a long way to go from this PoC before I get there, though!

000

Reposted by Calzone

Alice Averlong 🏳️‍⚧️ @alice.averlong.com · 06/03/2026

Hiya! Anyone in the SF Bay Area/Remote need a cool programmer for your team? I've been messing with computers for over 30 years now, I can program anything with bits, and I've got a lot of experience with all sorts of different systems, environments, and languages. wiki.averlong.com/My_Resume

wiki.averlong.com

My Resume - Alice Averlong Wiki

7358191

Calzone @calz0n3.bsky.social · 01/03/2026

This would be much less doable without some of Crystal Palace's newer features! For example, I'm dynamically generating a linker spec with C2 parameters from Mythic (i.e. payload UUID and callback host). Then I can just... pack them into a byte array and patch them straight into my PIC. It's neat!

020

Calzone @calz0n3.bsky.social · 01/03/2026

Got a basic checkin working from CPL shellcode with minimal hassle, thanks to @pard0p.bsky.social's useful LibWinHttp library :)

Screenshot demonstrating agents checking into Mythic C2

110

Calzone @calz0n3.bsky.social · 28/02/2026

Started working on a Mythic agent that uses Crystal Palace to generate its shellcode. So far I've just got it to emit some generic shellcode - it doesn't talk to Mythic yet. I'm hoping to make a fully modular agent that you can patch your tradecraft into when you generate a payload :)

Screenshot demonstrating some Crystal Palace shellcode generated by Mythic, running on a Windows machine and popping a message box.

Screenshot demonstrating the payload UUID from a Mythic payload, patched into a Crystal Palace linker variable.

122

Calzone @calz0n3.bsky.social · 11/02/2026

There are variants, I believe.

000

Calzone @calz0n3.bsky.social · 11/02/2026

If your lab environment doesn't have a dumb theme, what's even the point?

Two virtual machines in a testing lab, with wallpapers and names based on characters from Over the Garden Wall

010

Reposted by Calzone

Mallory Moore @sexabolition.blog · 06/02/2026

If Minnesota soccer moms in signal chats can figure out compartmentalization and redundancy so can fucking IoT vendors

1383

Reposted by Calzone

Amos @amosduveen.bsky.social · 02/02/2026

This pretty much nails what underlies all the hype about sentient AIs.

14217

Reposted by Calzone

Raphael Mudge @raphaelmudge.bsky.social · 23/01/2026

Cobalt Strike blog ppost by x.com/joehowwolf on using Crystal Palace to mash-up Page Streaming and Draugr Call Stack Spoofing into a Cobalt Strike UDRL. (Again, I really love the comics. They are perfect).

192

Reposted by Calzone

Caravelle @caravellin.bsky.social · 17/12/2025

low erth orbit perfec t size for put datacenter in to n\ap! outside very Soft and Comfort datacenter hum soundly in Low Earth Orbit. Put Datacenter in Low Earth Orbit. no problems ever in low earth orbbt because good Temperature and Sun exposure for datacenter hot of radiation.

1164

Calzone @calz0n3.bsky.social · 06/12/2025

Absolutely! I'm excited by how much more configurable my projects can be with the new features. I couldn't figure out a user-friendly way to pass in string args at link-time before, so it's awesome that we can now!

030

Calzone @calz0n3.bsky.social · 06/12/2025

Yeah, I realised shortly after posting it that, while neat, patching in each arg separately is fiddly and doesn't really make sense with a variable number of args. One big string is probably the way to go!

100

Calzone @calz0n3.bsky.social · 05/12/2025

Is it cursed to pass arguments to the assembly in execute-assembly-pico using the linker variables introduced in the new Crystal Palace?

It's a screenshot of a linker spec for Crystal Palace. The screenshot depicts the argument-passing setup described in the post. The screenshot menaces with bands of tourmaline.

010

Calzone @calz0n3.bsky.social · 03/12/2025

My PICOs and unit testing library have been updated for the newest version of Crystal Palace and LibTCG :)

011

Calzone @calz0n3.bsky.social · 03/12/2025

Nothing like a two-week holiday to completely kill your momentum on all of your projects! Not that I'm complaining... but how do I write assembly again? 🤔

010

Calzone @calz0n3.bsky.social · 21/10/2025

LibCPLTest: A shared library for Crystal Palace that allows you to unit test your PICOs. It's nothing too fancy, just a few helper functions and a macro, but it's helped me to create a consistent framework for testing my PIC capabilities. github.com/ofasgard/Lib...

github.com

GitHub - ofasgard/LibCPLTest: A shared library for Crystal Palace that allows you to unit test your PICOs.

A shared library for Crystal Palace that allows you to unit test your PICOs. - ofasgard/LibCPLTest

023