iiinova — where your digital self keeps evolving

Raphael Mudge

@raphaelmudge.bsky.social

404 followers 38 following 116 posts

Riding around in the breeze. USAF Veteran.

Raphael Mudge @raphaelmudge.bsky.social · 22/09/2026

If you are in London, @rastamouse.me is THE headliner speaker at the beac0n red teaming conference tomorrow talking CS and CPL tradecraft. Tickets here: www.eventbrite.co.uk/e/beacon-26-... Org/conf details here: beac0n.org

251

Raphael Mudge @raphaelmudge.bsky.social · 07/09/2026

Playing a Different Game: Rethinking Modern Defense Evasion c0rnbread.com/playing-a-di... """Sometimes the most effective tradecraft isn't the most technically sophisticated. You don't always win by playing the game better and better, but by playing beyond the rules of the game.""" Mmmm hmmm...

065

Raphael Mudge @raphaelmudge.bsky.social · 19/08/2026

The Game Has Changed: Rapid PIC Development with Crystal Palace and Cobalt Strike by Will Burgess [Beware, marketing wall will ask for email few mins in] www.cobaltstrike.com/the-black-ha... Demos a Universal Loader which modularizes loader problem set & allows mix/match of tradecraft in it. 🙌

0132

Raphael Mudge @raphaelmudge.bsky.social · 01/06/2026

I'm a little late on this. Primo (x.com/cr4ckeddd) is continuing work on TinyC2. Added built-in Lua scripting to it: x.com/cr4ckeddd/st... Project is at: github.com/0xPrimo/Tiny... Seems a bunch of other post-ex added too.

010

Raphael Mudge @raphaelmudge.bsky.social · 27/05/2026

My observation is it's tightly bound (sometimes, that's the goal) to a loader with one hook only. mov ecx, eax is ror13hash's return value (eax) getting placed into the first arg register ecx. The middle is code generated by the attached. xor rax, rax is the prologue of the generated code.

100

Raphael Mudge @raphaelmudge.bsky.social · 02/05/2026

The PIC Parterre blog post touched on some of this. Next CPL release, I plan to de-emphasize PIC (in the same way I de-emphasized DLL loaders)--because I hope next features make the code/conventions => multiple modality thing clearer... and modality is a tradecraft choice... separate of capability.

110

Raphael Mudge @raphaelmudge.bsky.social · 27/04/2026

VIA: x.com/NationalCCDC... Congratulations to Dakota State University--the 2026 National Collegiate Cyber Defense Competition champions. A huge congrats to University of Virginia on 2nd and Western Washington University on 3rd.

040

Raphael Mudge @raphaelmudge.bsky.social · 02/01/2026

Comment out line 54 of src/crystalpalace/export/ParseImport.java. That'll take care of the error. Just did a quick hacky POC and it worked with my unit test BOF runner. I'll work a more permanent fix to that in the next release. (I used LIbTCG only for dprintf). I think this is an interesting use.

120

Raphael Mudge @raphaelmudge.bsky.social · 12/12/2025

Discovering Tradecraft Garden by x.com/jjavierolmedo hackpuntes.com/posts/explor... A gentle introduction to the project and specifically using the ./link command & running examples. I'm glad the guardrails example (now follow-on loader agnostic) was called out. It's a waiting gem in the corpus.

041