← Back to Dashboard

Crystal-Loaders

// PIC Reflective Loaders & the Crystal Palace Ecosystem

8
Modules
C
Language
x64 PIC
Architecture
3
Difficulty Tiers

A deep dive into rasta-mouse's Crystal-Loaders — position-independent reflective loaders built with Raphael Mudge's Crystal Palace linker. Learn how the spec-driven build system, LibTCG PE loading primitives, LibGate indirect syscalls, and Beacon User Data (BUD) combine to create a modular, composable approach to Cobalt Strike loader development. By Daniel Duggan (@_RastaMouse). Crystal Palace by Raphael Mudge.

01 Beginner

The Reflective Loader Problem

Why traditional reflective loaders get caught: private-commit RWX memory, PE headers, IAT artifacts, and return-address validation.

 02 Beginner

Crystal Palace — The PIC Linker

The spec language, directives (load, make pic, dfr, mergelib, link, export), and how COFF objects become shellcode.

 03 Intermediate

LibTCG — The Tradecraft Garden

The shared PE loading library: ParseDLL, LoadDLL, ProcessImports, PEB walking, and ROR13 hash resolution.

 04 Intermediate

LibGate — Indirect Syscalls

RecycledGate lineage, SYSCALL_GATE, Hell's Gate + Halo's Gate SSN extraction, and the push/ret trampoline.

 05 Intermediate

The UDRL Loader Walkthrough

Line-by-line analysis of loader.c: XOR unmasking, PE loading, section permissions, and the three DllMain calls.

 06 Advanced

Beacon User Data (BUD)

The USER_DATA structure: SYSCALL_API with 35 Nt* entries, RTL_API, ALLOCATED_MEMORY regions, and sleep mask integration.

 07 Advanced

Post-Ex UDRL & Aggressor

The postex loader, $GMH/$GPA patching, string-based DFR, .cna hooks, and the full build pipeline.

 08 Advanced

Extending Crystal-Loaders

Module stomping, sleep masking, call stack spoofing, IAT hooking PICOs, guardrails, and porting beyond Cobalt Strike.

References & Resources