Windows
Windows provides several ExecUnit formats and execution contexts. This page explains their architectural differences and the local communication model shared by command and listener ExecUnits.
Supported combinations
The current commercial Windows agent supports x86 and x86_64 builds. Its own-process context accepts shellcode, .NET executables, .NET dynamic-link libraries (DLLs), and native DLLs; its new-process and existing-process contexts support shellcode.
| Component | Available Windows artifacts | Compatibility consideration |
|---|---|---|
| Default command ExecUnits | Managed artifacts; native DLLs for commands with native implementations | Check the individual command; the command catalog is not uniform |
| Simple Hypertext Transfer Protocol (HTTP), Transmission Control Protocol (TCP), and Domain Name System (DNS) listeners | Managed artifacts and native DLLs | Choose a format supported by the selected agent and context |
| TCP and Server Message Block (SMB) relay listeners | Managed artifacts | These families currently have no native DLL implementation |
| Listener-owned commands | Managed artifacts | They are command ExecUnits, with availability separate from their listener |
Managed artifacts include .NET executables, .NET DLLs, and shellcode packaged from managed implementations. A format supported by the agent is usable only when the selected plugin supplies it.
Loading model
Managed code relies on the .NET runtime. The default managed command and listener projects target .NET Framework 4.6.2. A shellcode artifact produced from a managed implementation still has managed runtime requirements; its packaging alone does not establish compatibility.
Native DLL compatibility depends on the architecture of the process hosting the library and any required dependencies. Concepts and Lifecycle explains how artifact format, execution context, and communication fit together.
Local communication
The standard Windows local channel uses one duplex named pipe: both peers can send and receive through the same pipe connection. This differs from the two directional filesystem endpoints used on Linux, FreeBSD, and macOS.
See Windows Named Pipes for endpoint responsibilities and Local and External Communication for the distinction from a listener's network transport.
Lifetime and limitations
Windows provides a choice of process boundaries, subject to the format restrictions above. That choice does not establish a component's concurrency or cancellation guarantees. See command limitations, listener limitations, and Lifetimes and Outcomes for the shared lifecycle considerations.