HOVEL // module 01.01
Module 01.01 Payload provider / Integrated

picblobs

// position-independent code blobs

picblobs is Hovel's position-independent payload blob provider module. It imports the original pic source tree under modules/picblobs, keeps the original tests and specifications, and exposes a Hovel JSON-RPC payload-provider shim.

The imported project provides pre-compiled, position-independent code blobs for loading and executing arbitrary payloads on multiple operating systems and architectures. It keeps the original Python API, CLI, Bazel build, generated blob catalogue, and cross-architecture test runners available inside the Hovel module tree.

The Pitch

As a cybersecurity developer, I am sick and tired of writing assembly and shellcode. I would like prestaged payloads for all targets I touch on a regular basis to enable ethical security research.

What's in the Box

  • 13 architectures -- x86_64, i686, aarch64, armv5 (ARM/Thumb), armv7, s390x, mipsel32, mipsbe32, sparcv8, powerpc, ppc64le, riscv64
  • 3 operating systems -- Linux, FreeBSD, Windows
  • Freestanding C blobs compiled with -ffreestanding -nostdlib -fPIC -Os
  • Python API for loading, extracting, introspecting, and assembling blobs
  • CLI (picblobs-cli) for inspecting, building, running, and verifying blobs
  • Cross-architecture testing via QEMU user-mode (binfmt_misc or qemu-*-static)
  • Mbed OS proof of concept with bidirectional authenticated NaCl encryption, hosted Cortex-M4 execution tests, and a pinned NUCLEO-F429ZI firmware compile
  • Bazel 9 build system with automatic Bootlin toolchain provisioning
  • Kernel toolkit for red-team lab exercises
The Mbed channel is not the workspace TLS subsystem. The picblobs proof of concept uses a deployment-provisioned symmetric key, an authenticated ephemeral X25519 exchange, and NaCl crypto_secretbox. Hovel's workspace PKI separately owns X.509 authorities, TLS profiles, trust sets, assignments, rotation, and provider delivery. Start with TLS and Workspace PKI when a module needs Hovel-managed certificates.

Entry Points

Use User Guide Stage provider and payload artifacts, then link the module into a Hovel workspace. Build Build Notes Root Bazel configs, platform configs, staging, and provider binary output. Verify Testing Bazel tests, Python tests, payload tests, generated-file checks, and dist checks. Ref Reference Important files, module manifest, preserved original docs, and source specs. Embedded Mbed Encrypted Pair Materialize a matched key and endpoint, compile both firmware roles, and understand exactly what CI proves. Guide Original pic Guide The full original guide, refactored into the Hovel module documentation shell.