Havoc Post-Exploitation Framework: Forensic Reverse-Engineering & Architectural Dossier

Havoc is an advanced command-and-control framework architected as an alternative to proprietary platforms like Cobalt Strike. Its core implant, termed 'Demon', is written in pure C and assembly, delivering enterprise-grade evasions. Demon features native indirect syscall resolution (Halo's Gate / RecycledGate), call stack spoofing, hardware breakpoint AMSI/ETW patching, and in-memory heap encryption during sleep intervals via the Ekko technique. The teamserver is developed in Go with high-concurrency channel pipelines, while operators interact through a native Qt6 desktop client.

Detailed reverse-engineering specifications archived in laboratory telemetry.

{
  "structureType": "Embedded Binary Struct (DEMON_CONFIG) & YAOTL Profile Model",
  "decryptionRoutine": "Demon payload initial stage resolves key via pre-configured XOR or AES-256-CBC envelope; runtime configuration resides in unbacked or allocated memory pages with dynamic masking.",
  "inMemoryLayout": "typedef struct {\n    ULONG   Magic;              // Offset 0x00: 0xDEADBEEF\n    ULONG   SleepTime;          // Offset 0x04: Beacon sleep interval in seconds\n    ULONG   SleepJitter;        // Offset 0x08: Randomization percentage (0-100)\n    ULONG   KillDate;           // Offset 0x0C: Unix epoch timestamp for termination\n    ULONG   WorkingHours;       // Offset 0x10: Allowed operational timeframe bitmask\n    BYTE    AmsiEtwPatch;       // Offset 0x14: 0x01 (Patch) | 0x02 (Hardware Breakpoints)\n    BYTE    SyscallMethod;      // Offset 0x15: 0x00 (Win32), 0x01 (Direct), 0x02 (Indirect/Halo's Gate)\n    BYTE    SleepTechnique;     // Offset 0x16: 0x00 (None), 0x01 (Ekko), 0x02 (Foliage), 0x03 (Zsk)\n    BYTE    ProxyType;          // Offset 0x17: 0x00 (Direct), 0x01 (SOCKS5), 0x02 (HTTP Connect)\n    CHAR    Hosts[3][256];      // Offset 0x18: Up to 3 primary and failover C2 domain endpoints\n    BYTE    AesKey[32];         // Offset 0x318: Negotiated 256-bit AES session key\n    BYTE    AesIv[16];          // Offset 0x338: 128-bit initialization vector\n} DEMON_CONFIG;",
  "panelConfigOptions": "Demon Builder GUI allows selection of: Target Arch (x64/x86), Output Format (Windows Shellcode, DLL, Exe, Service Exe), Sleep Obfuscation Method (Ekko, Foliage, TimerQueue), Syscall Engine (Direct Syscalls, Indirect Syscalls), Call Stack Spoofing toggle, AMSI/ETW Patching method, and Malleable HTTP listener headers."
}

{
  "apiResolution": "Demon implements custom hashing (DJB2 with randomized seeds) across PEB InLoadOrderModuleList to locate ntdll.dll and kernel32.dll exports without invoking GetProcAddress.",
  "indirectSyscalls": "Integrates RecycledGate and Halo's Gate mechanics. Evaluates ntdll.dll Export Address Table in memory, computes System Service Numbers (SSN), detects inline hooks (0xE9 JMP), traverses adjacent stubs to extract true SSN, and executes 'syscall ; ret' instructions directly from clean memory offsets inside ntdll.dll.",
  "sleepObfuscation": "Employs the Ekko / Foliage sleep evasion technique. Utilizes CreateTimerQueueTimer or NtSetTimer2 combined with NtContinue contexts. While transitioning to sleep, it invokes SystemFunction032 (RC4) to encrypt the heap and Demon memory image, modifies page protections from PAGE_EXECUTE_READ to PAGE_NOACCESS or PAGE_READWRITE, sleeps for the jittered duration, and restores PAGE_EXECUTE_READ prior to code resumption.",
  "stackSpoofing": "Synthetic stack frame spoofing rewrites thread CONTEXT structures to emulate legitimate execution call stacks (e.g., ntdll!RtlUserThreadStart -> kernel32!BaseThreadInitThunk) masking unbacked thread call graphs from security scanners."
}

Concrete technical breakdown of functional modules implemented in the Havoc Post-Exploitation Framework binary:

Havoc Demon utilizes a binary packet framing protocol over malleable HTTP/HTTPS or SMB Named Pipes. Each packet consists of: [ 4-byte Magic (0xDEADBEEF) ] [ 4-byte Agent ID ] [ 4-byte Command ID ] [ 4-byte Data Length ] [ Encrypted Body (AES-256-CBC or AES-256-GCM) ] [ 16-byte HMAC/Tag ]. Initial registration uses RSA-2048 to negotiate a unique AES-256 session key. In HTTP mode, packets are embedded in custom HTTP headers, base64-encoded cookie fields, or simulated image uploads matching the configured YAOTL malleable profile. In SMB mode, packets traverse named pipes matching configurable path masks (e.g., \\.\pipe\demon-*).

Indicators of compromise and forensic patterns recorded across laboratory triage:

// Decompiled Havoc Demon Indirect Syscall and Ekko Sleep Dispatch
NTSTATUS DemonSyscallInvoke(DWORD ssn, PVOID syscallTrampoline, PVOID args) {
    // SSN loaded into EAX, indirect jump executed to 'syscall; ret' inside clean ntdll address
    __asm {
        mov r10, rcx
        mov eax, ssn
        jmp syscallTrampoline
    }
}

VOID DemonEkkoSleep(DWORD sleepMs) {
    CONTEXT ctxThread, ctxRop;
    HANDLE hTimerQueue = CreateTimerQueue();
    HANDLE hTimer = NULL;
    // Set timer callbacks to SystemFunction032 (RC4 mask), NtProtectVirtualMemory (PAGE_NOACCESS),
    // WaitForSingleObject, and NtProtectVirtualMemory (PAGE_EXECUTE_READ)
    CreateTimerQueueTimer(&hTimer, hTimerQueue, (WAITORTIMERCALLBACK)NtContinue, &ctxRop, sleepMs, 0, WT_EXECUTEINTIMERTHREAD);
    WaitForSingleObject(hTimer, sleepMs);
}