How whispergate/emeraldstrike works
EmeraldStrike is a Mythic Windows post-exploitation agent, with operator tasking translated into an encrypted binary protocol, handled by a PIC agent, and returned as task results. The repository also provides payload configuration, command families, multiple C2 transports, and execution/evasion capabilities. The graph preserves these documented stages; some implementation details are unsampled, so edges are limited to relationships visible in excerpts, the source index, or README statements.
Main entry points: main.cc Agent loop · translator.py Protocol translator · commands Command handlers · agent_functions Task functions
Components 20
Mythic integration
- Task functions
Payload_Type/emeraldstrike/emeraldstrike/agent_functions - Payload builder
Payload_Type/emeraldstrike/emeraldstrike/agent_functions/builder.py - Protocol translator
Payload_Type/emeraldstrike/translator/translator.py - Mythic container entry
Payload_Type/emeraldstrike/main.py
Agent runtime
- Agent loop
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc - Build configuration
agent_code/include/config.h - TLV parser
agent_code/src/parser.cc - Command dispatch
agent_code/src/dispatch.cc - Response packaging
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/package.cc
C2 and protocol
- Encryption
agent_code/src/crypto.cc - HTTP transport
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/http.cc - SMB transport
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/smb.cc - Azure Blob transport
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/azure_blob.cc
Agent operations
- Command handlers
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/commands - BOF execution
agent_code/src/coff_loader.cc
Execution and evasion
- Process injection
agent_code/src/evasion/injection.cc - Sleep masking
agent_code/src/evasion/sleep.cc - Beacon Gate
agent_code/src/evasion/beacon_gate.cc
Other components
- Mythic operator
- Windows host
Connections 23
- Mythic operator → Task functions: tasks
- Mythic container entry → Task functions: registers
Payload_Type/emeraldstrike/main.py - Mythic container entry → Protocol translator: loads
Payload_Type/emeraldstrike/main.py - Payload builder → Build configuration: stamps settings
- Task functions → Protocol translator: task protocol
- Protocol translator → Agent loop: translates tasking
- Agent loop → TLV parser: parses messages
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc - Agent loop → Command dispatch: dispatches commands
- Command dispatch → Command handlers: invokes handlers
- Command handlers → Response packaging: packages results
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/commands/cmd_services.cc - Agent loop → Encryption: encrypts messages
- Agent loop → HTTP transport: uses transport
- Agent loop → SMB transport: uses transport
- Agent loop → Azure Blob transport: uses transport
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc - HTTP transport → Protocol translator: exchanges protocol
- SMB transport → Agent loop: forwards tasks
- Azure Blob transport → Protocol translator: shares wire format
- Agent loop → Sleep masking: sleeps through
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc - Agent loop → Beacon Gate: enables gating
agent_code/src/evasion/beacon_gate.cc - Command handlers → BOF execution: executes BOFs
- Command handlers → Process injection: injects processes
- Command handlers → Windows host: operates on
Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/commands/cmd_services.cc - Protocol translator → Task functions: returns results