Squatter Reference

Important Paths

Path	Purpose
`modules/squatter/README.md`	Short source-level overview.
`modules/squatter/provider/`	Go payload-provider implementation and step dispatcher.
`modules/squatter/provider/mesh.go`	Multi-node destination topology and routed raw or encrypted payload streams.
`modules/squatter/provider/stamp.go`	Standard `payload-tls-server` credential slot and PE stamp encoder.
`modules/squatter/windows/src/`	Windows payload source, no-CRT runtime, modules, wire protocol, and logging.
`modules/squatter/windows/src/security/`	Versioned stamped-PKI region validation and payload-owned wolfSSL TLS sessions.
`third_party/wolfssl/`	Pinned static wolfSSL build profile for the legacy-compatible no-CRT payload.
`modules/squatter/client/cmd/squatterctl/`	Operator-side client shell for direct Squatter sessions.
`modules/squatter/client/smbpipe/`	SMB named-pipe connector and admin helper code.
`modules/squatter/client/wire/`	Go framing implementation for the Squatter mux protocol.
`modules/squatter/tests/`	Wine-backed C/C++ integration tests.
`modules/docker/squatter-wine/`	Non-root Docker Wine functional runner for concrete x86 and x64 payloads.
`modules/squatter/tools/coverage_check.py`	Aggregate LCOV coverage ratchet used by the module CI gate.
`modules/squatter/bazel/`	MinGW toolchain and Windows transition helpers.
`modules/tools/package_examples.py`	Release package manifest source for Squatter and example modules.
`docs/site/src/content/spec/squatter-payload-provider.html`	Full architecture and provider contract chapter.

Step IDs

Step	Role
`squatter.generate`	Generate a target-specific PE payload artifact.
`squatter.install_smb`	Upload and start the payload over SMB with explicit credentials.
`squatter.connect_smb`	Connect to a named-pipe Squatter session through SMB.
`squatter.connect_tcp_bind`	Connect to a target-side TCP listener.
`squatter.listen_tcp_callback`	Start a provider listener for callback sessions.
`squatter.connect_tcp_callback`	Adopt an accepted callback connection as a Hovel session.

Payload Metadata

name: squatter
version: v0.1.0
type: payload_provider
kind: pe
platform: windows
arch: x86
minOS: windows-7
formats: pe-exe, pe
transports: smb-named-pipe, tcp-bind, tcp-callback
tags: payload_provider, squatter, windows, lab, dangerous

Payload TLS Credential Slot

name: payload-tls-server
delivery: stamp-standard
purpose: tls-server
endpointRole: server
consumerType: payload
profile: tls-server
compatibilityTarget: portable-x509
projection: bundle
materialForm: private-bytes
remainderPolicy: zero-fill

The provider validates the complete hovel.pki.bundle/v1 and writes a versioned, integrity-bound SQPKI001 manifest into the generated PE. The payload loads the certificate chain and PKCS#8 key into statically linked wolfSSL. Mesh does not receive or terminate the TLS identity.

Command Surface

wininfo
process.list
process.run
process.run_as_user
process.kill
payload.status
payload.cleanup
file.stat
registry.query
eventlog.query
drive.list
share.list
acl.stat
getfile
putfile
cmd