# whispergate/emeraldstrike architecture

> Architecture diagram of the GitHub repository whispergate/emeraldstrike, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/whispergate/emeraldstrike
- Repository: https://github.com/whispergate/emeraldstrike

## Overview

EmeraldStrike is a Mythic Windows post-exploitation agent, with operator tasking translated into an encrypted binary protocol, handled by a PIC agent, and returned as task results. The repository also provides payload configuration, command families, multiple C2 transports, and execution/evasion capabilities. The graph preserves these documented stages; some implementation details are unsampled, so edges are limited to relationships visible in excerpts, the source index, or README statements.

Main entry points: [`Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc`](https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc) (Agent loop), [`Payload_Type/emeraldstrike/translator/translator.py`](https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/translator/translator.py) (Protocol translator), [`Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/commands`](https://github.com/whispergate/emeraldstrike/tree/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/commands) (Command handlers), [`Payload_Type/emeraldstrike/emeraldstrike/agent_functions`](https://github.com/whispergate/emeraldstrike/tree/main/Payload_Type/emeraldstrike/emeraldstrike/agent_functions) (Task functions)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_mythic["Mythic integration"]
  node_functions["Task functions"]
  node_builder["Payload builder<br/>[builder.py]"]
  node_translator["Protocol translator<br/>[translator.py]"]
  node_container["Mythic container entry<br/>[main.py]"]
end

subgraph group_agent["Agent runtime"]
  node_agent_main["Agent loop<br/>[main.cc]"]
  node_config["Build configuration<br/>[config.h]"]
  node_parser["TLV parser<br/>[parser.cc]"]
  node_dispatch["Command dispatch<br/>[dispatch.cc]"]
  node_package["Response packaging<br/>[package.cc]"]
end

subgraph group_c2["C2 and protocol"]
  node_crypto["Encryption<br/>[crypto.cc]"]
  node_http["HTTP transport<br/>[http.cc]"]
  node_smb["SMB transport<br/>[smb.cc]"]
  node_azure["Azure Blob transport<br/>[azure_blob.cc]"]
end

subgraph group_operations["Agent operations"]
  node_commands["Command handlers"]
  node_bof["BOF execution<br/>[coff_loader.cc]"]
end

subgraph group_evasion["Execution and evasion"]
  node_injection["Process injection<br/>[injection.cc]"]
  node_sleep["Sleep masking<br/>[sleep.cc]"]
  node_beacon_gate["Beacon Gate<br/>[beacon_gate.cc]"]
end

node_operator(("Mythic operator"))
node_windows(("Windows host"))

node_operator -->|"tasks"| node_functions
node_container -->|"registers"| node_functions
node_container -->|"loads"| node_translator
node_builder -->|"stamps settings"| node_config
node_functions -.->|"task protocol"| node_translator
node_translator -->|"translates tasking"| node_agent_main
node_agent_main -->|"parses messages"| node_parser
node_agent_main -->|"dispatches commands"| node_dispatch
node_dispatch -->|"invokes handlers"| node_commands
node_commands -->|"packages results"| node_package
node_agent_main -->|"encrypts messages"| node_crypto
node_agent_main -.->|"uses transport"| node_http
node_agent_main -->|"uses transport"| node_smb
node_agent_main -->|"uses transport"| node_azure
node_http -.->|"exchanges protocol"| node_translator
node_smb -.->|"forwards tasks"| node_agent_main
node_azure -->|"shares wire format"| node_translator
node_agent_main -->|"sleeps through"| node_sleep
node_agent_main -->|"enables gating"| node_beacon_gate
node_commands -.->|"executes BOFs"| node_bof
node_commands -.->|"injects processes"| node_injection
node_commands -->|"operates on"| node_windows
node_translator -->|"returns results"| node_functions

click node_functions "https://github.com/whispergate/emeraldstrike/tree/main/Payload_Type/emeraldstrike/emeraldstrike/agent_functions"
click node_builder "https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_functions/builder.py"
click node_translator "https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/translator/translator.py"
click node_container "https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/main.py"
click node_agent_main "https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc"
click node_config "https://github.com/whispergate/emeraldstrike/blob/main/agent_code/include/config.h"
click node_parser "https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/parser.cc"
click node_dispatch "https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/dispatch.cc"
click node_package "https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/package.cc"
click node_crypto "https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/crypto.cc"
click node_http "https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/http.cc"
click node_smb "https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/smb.cc"
click node_azure "https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/azure_blob.cc"
click node_commands "https://github.com/whispergate/emeraldstrike/tree/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/commands"
click node_bof "https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/coff_loader.cc"
click node_injection "https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/evasion/injection.cc"
click node_sleep "https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/evasion/sleep.cc"
click node_beacon_gate "https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/evasion/beacon_gate.cc"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_functions,node_builder,node_translator,node_container toneBlue
class node_agent_main,node_config,node_parser,node_dispatch,node_package toneAmber
class node_crypto,node_http,node_smb,node_azure toneMint
class node_commands,node_bof toneRose
class node_injection,node_sleep,node_beacon_gate,node_operator,node_windows toneIndigo
```

## Components

### Mythic integration

- [Task functions](https://github.com/whispergate/emeraldstrike/tree/main/Payload_Type/emeraldstrike/emeraldstrike/agent_functions): `Payload_Type/emeraldstrike/emeraldstrike/agent_functions`
- [Payload builder](https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_functions/builder.py): `Payload_Type/emeraldstrike/emeraldstrike/agent_functions/builder.py`
- [Protocol translator](https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/translator/translator.py): `Payload_Type/emeraldstrike/translator/translator.py`
- [Mythic container entry](https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/main.py): `Payload_Type/emeraldstrike/main.py`

### Agent runtime

- [Agent loop](https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc): `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc`
- [Build configuration](https://github.com/whispergate/emeraldstrike/blob/main/agent_code/include/config.h): `agent_code/include/config.h`
- [TLV parser](https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/parser.cc): `agent_code/src/parser.cc`
- [Command dispatch](https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/dispatch.cc): `agent_code/src/dispatch.cc`
- [Response packaging](https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/package.cc): `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/package.cc`

### C2 and protocol

- [Encryption](https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/crypto.cc): `agent_code/src/crypto.cc`
- [HTTP transport](https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/http.cc): `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/http.cc`
- [SMB transport](https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/smb.cc): `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/smb.cc`
- [Azure Blob transport](https://github.com/whispergate/emeraldstrike/blob/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/azure_blob.cc): `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/transport/azure_blob.cc`

### Agent operations

- [Command handlers](https://github.com/whispergate/emeraldstrike/tree/main/Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/commands): `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/commands`
- [BOF execution](https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/coff_loader.cc): `agent_code/src/coff_loader.cc`

### Execution and evasion

- [Process injection](https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/evasion/injection.cc): `agent_code/src/evasion/injection.cc`
- [Sleep masking](https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/evasion/sleep.cc): `agent_code/src/evasion/sleep.cc`
- [Beacon Gate](https://github.com/whispergate/emeraldstrike/blob/main/agent_code/src/evasion/beacon_gate.cc): `agent_code/src/evasion/beacon_gate.cc`

### Other components

- **Mythic operator**
- **Windows host**

## Connections

- Mythic operator → Task functions: tasks
- Mythic container entry → Task functions: registers (evidence: `Payload_Type/emeraldstrike/main.py`)
- Mythic container entry → Protocol translator: loads (evidence: `Payload_Type/emeraldstrike/main.py`)
- Payload builder → Build configuration: stamps settings
- Task functions → Protocol translator: task protocol
- Protocol translator → Agent loop: translates tasking
- Agent loop → TLV parser: parses messages (evidence: `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc`)
- Agent loop → Command dispatch: dispatches commands
- Command dispatch → Command handlers: invokes handlers
- Command handlers → Response packaging: packages results (evidence: `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/commands/cmd_services.cc`)
- Agent loop → Encryption: encrypts messages
- Agent loop → HTTP transport: uses transport
- Agent loop → SMB transport: uses transport
- Agent loop → Azure Blob transport: uses transport (evidence: `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc`)
- HTTP transport → Protocol translator: exchanges protocol
- SMB transport → Agent loop: forwards tasks
- Azure Blob transport → Protocol translator: shares wire format
- Agent loop → Sleep masking: sleeps through (evidence: `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/main.cc`)
- Agent loop → Beacon Gate: enables gating (evidence: `agent_code/src/evasion/beacon_gate.cc`)
- Command handlers → BOF execution: executes BOFs
- Command handlers → Process injection: injects processes
- Command handlers → Windows host: operates on (evidence: `Payload_Type/emeraldstrike/emeraldstrike/agent_code/src/commands/cmd_services.cc`)
- Protocol translator → Task functions: returns results