Rasta Mouse

Capabilities written to PICO conventions can be output as PIC, PICOs, or COFFs.

Intrinsics are functions used in code that are later replaced - typically with compiler-generated instructions.

Despite what some would lead you to believe, Crystal Kit is not, and was never intended to be, an all-encompassing nirvana of evasion tradecraft.

In a previous post, I wrote about BOF Cocktails - an execution pattern to merge tradecraft into postex BOFs so they didn't have to rely on an agent/loader for their evasion.

💡 This blog was originally posted on 26 May 2026 and subsequently updated on 04 June 2026.

tl;dr Inspired by Red Canary's Atomic Red Team, 'Atomic BOFs' is my attempt at an implementation pattern to ease detection engineering for Beacon Object Files.

The goal of Crystal Palace (and the Tradecraft Garden) is to separate evasion tradecraft from the capability.

In my post Cracking the Crystal Palace, I explored several aspects of Crystal Palace that remain unchanged after +optimize and +mutate passes have been performed.

Crystal Palace is a PIC framework that can be used to write, among other things, prepended DLL loaders.

Raffi just released another update to Crystal Palace, which serves to improve the way specification files are handled by making them more modular.

If you follow this blog, you'll know I've been posting about Crystal Palace a LOT recently, mostly from an attack perspective.

The 11.10.25 Crystal Palace release added more new commands in one go than I think I've seen thus far.

Raffi just released an update to Crystal Palace (CP), so I wanted to write about some of the problems that I think it helps solve for PIC development and where it may take us in the future.

tl;dr - repo here.

Crystal Palace provides two command-line tools, called link and piclink, which are used with a specification file to combine a reflective loader with one or more capabilities (DLLs and/or COFFs). link takes the path to a spec file, the path to a DLL or CO…