Adaptix C2 ships an agent DLL which does not provide any evasion mechanism: it gets loaded into memory with RWX permissions, no SleepMask, garbage call stacks, etc.. The goal of this repo is to show how to wrap AdaptixC2 agent in a Crystal Palace Reflective DLL Loader, along with examples implementing different maldev techniques.

It is recommended to setup WSL as it is the ideal environment for Tradecraft Garden projects and Crystal Palace. Check out the guide provided by Rafael Mudge: https://tradecraftgarden.org/wslsetup.html.

make clean; make all

cp/link loaders/simple_rdll/loader.spec agent.x64.dll loaders/simple_rdll/bin/agent.bin

runner/bin/run.x64.exe loaders/simple_rdll/bin/agent.bin

• Provide other samples: Api Hooking, Call Stack Spoofing, Execution Guardrails, SleepMask, Indirect Syscalls, ...
• AdaptixC2 Integration via Service Extenders

You are deeply welcome to contribute by adding your own samples :)

Provided samples are intended strictly for educational purposes and authorized security engagements only.