C source → mingw-gcc → COFF objects → Crystal Palace link → raw PIC shellcode → loader (Exe/Dll/Svc)

x64:
    load "Bin/obj/main.x64.o"           # Core PIC
        make pic +gofirst
        foreach %LIBS: mergelib %_       # Merge libtcg
        load "Bin/obj/entry.x64.o"       # Entry PICO
            make object
            load "Bin/obj/crypto.x64.o"  #   merge crypto into entry
                merge
            load "Bin/obj/packer.x64.o"  #   merge packer into entry
                merge
            export
            link "entry_module"          #   link at section marker
        load "Bin/obj/transport.x64.o"   # Transport PICO
            make object
            mergelib "lib/LibWinHttp/..."
            export
            link "transport_module"
        ...                              # task_module, obfuscation_module
        dfr "resolve" "ror13"            # resolve all DFR symbols
        export

Core PIC (main.c)
  │
  ├── resolve()              DFR bridge → libtcg hash lookup
  ├── AllocateAndLoadModule() PicoLoad each PICO into shared RWX region
  │
  └── calls entry module go() with pointers to all other modules
        │
        ├── Entry Module (entry.c)
        │     MvState, checkin, transact (RC4 wire format), task loop
        │
        ├── Transport Module (transport.c)
        │     HTTP/HTTPS POST via LibWinHttp
        │
        ├── Task Module (tasks.c)
        │     Command dispatch: whoami (0x30), sleep (0x20), exit (0x10)
        │
        └── Obfuscation Module (obfuscation.c)
              Ekko sleep — timer-queue ROP chain that encrypts module memory
              with RC4 (SystemFunction033) during sleep, decrypts on wake

┌─────────────────────────────┐
│ Shared RWX Region           │  VirtualAlloc(PAGE_EXECUTE_READWRITE)
│  ├── Entry code             │  PicoLoad → code here
│  ├── Transport code         │
│  ├── Task code              │
│  └── Obfuscation code       │
├─────────────────────────────┤
│ Entry data (RW)             │  PicoLoad → data here (separate alloc)
│ Transport data (RW)         │
│ Task data (RW)              │
│ Obfuscation data (RW)       │
├─────────────────────────────┤
│ Core PIC (freed after boot) │  Original shellcode, freed by entry module
└─────────────────────────────┘

Send:    [36B agent_id][RC4(payload)][16B key (first checkin only)]
Receive: [36B agent_id][RC4(response)]

src_beacon/Source/
├── main.c           Core PIC — DFR resolver, module loading, bootstrap
├── entry.c          Entry PICO — agent state, checkin, task loop, transact
├── transport.c      Transport PICO — HTTP POST via LibWinHttp
├── tasks.c          Task PICO — whoami/sleep/exit dispatch
├── obfuscation.c    Obfuscation PICO — Ekko sleep (timer-queue ROP + RC4)
├── crypto.c         RC4 stream cipher (merged into entry PICO)
├── packer.c         Binary packer BE / parser LE (merged into entry PICO)
└── includes/
    ├── config.h     Build-time defines (UUID, sleep, callback host/port/uri/ssl)
    ├── crypto.h     RC4 API
    ├── packer.h     PackBuf / Parser API
    ├── tcg.h        Crystal Palace libtcg (PicoLoad, findModuleByHash, etc.)
    └── HTTP.h       LibWinHttp API

./setup.sh --ax ../AdaptixC2