Imix eldritch events

docs/_docs/user-guide/imix.md

@@ -145,10 +145,50 @@ The install subcommand executes embedded tomes similar to golem.
 It will loop through all embedded files looking for main.eldritch.
 Each main.eldritch will execute in a new thread. This is done to allow imix to install redundantly or install additional (non dependent) tools.
 
-Installation scripts are specified in the `realm/implants/imix/install_scripts` directory.
+Installation scripts are specified in the `realm/implants/imixv2/embedded` directory.
 
 This feature is currently under active development, and may change. We'll do our best to keep these docs updates in the meantime.
 
+## Events
+
+Imix supports an event system that allows executing Eldritch scripts when specific internal events occur. This feature is enabled by compiling with the `events` feature flag (enabled by default).
+
+The system looks for a universal event script at `on_event.eldritch` within the embedded assets. If found, this script is executed for every triggered event.
+
+The script receives a global variable `input_params` containing:
+- `event`: The name of the event (e.g., "on_start", "on_callback_fail").
+- `args`: A dictionary of event-specific arguments.
+
+### Supported Events
+
+| Event Name | Description | Arguments |
+|String | String | Map<String, Value> |
+|---|---|---|
+| `on_start` | Triggered when the agent initializes. | None |
+| `on_exit` | Triggered when the agent shuts down. | None |
+| `on_callback_success` | Triggered after a successful callback to the C2 server. | None |
+| `on_callback_fail` | Triggered when a callback fails. | `error`: The error message. |
+| `on_sigint` | Triggered on SIGINT (Ctrl+C). | None |
+| `on_sigterm` | Triggered on SIGTERM. | None |
+| `on_sighup` | Triggered on SIGHUP. | None |
+| `on_sigquit` | Triggered on SIGQUIT. | None |
+| `on_sigusr1` | Triggered on SIGUSR1. | None |
+| `on_sigusr2` | Triggered on SIGUSR2. | None |
+| `on_sigchild` | Triggered on SIGCHLD. | None |
+
+### Example Script
+
+Create `realm/implants/imixv2/embedded/on_event.eldritch`:
+
+```python
+HANDLED_EVENTS = set(["on_callback_fail", "on_sigint"])
+
+evt = input_params.get("event", "???")
+if evt in HANDLED_EVENTS:
+    print(f"[EVENT] {evt} called:", input_params.get("args", {}))
+```
+
+
 ## Functionality
 
 Imix derives all it's functionality from the eldritch language.

implants/Cargo.toml

@@ -28,7 +28,7 @@ members = [
     "lib/eldritchv2/stdlib/tests",
     "lib/eldritchv2/stdlib/migration",
     "lib/eldritchv2/eldritchv2",
-    "lib/portals/portal-stream",
+    "lib/portals/portal-stream", "lib/eldritchv2/stdlib/eldritch-libevents",
 ]
 resolver = "2"
 
@@ -57,6 +57,7 @@ eldritch-libregex = {path = "lib/eldritchv2/stdlib/eldritch-libregex",default-fe
 eldritch-libreport = {path = "lib/eldritchv2/stdlib/eldritch-libreport",default-features = false }
 eldritch-libsys = {path = "lib/eldritchv2/stdlib/eldritch-libsys",default-features = false }
 eldritch-libtime = {path = "lib/eldritchv2/stdlib/eldritch-libtime",default-features = false }
+eldritch-libevents = {path = "lib/eldritchv2/stdlib/eldritch-libevents", default-features = false }
 portal-stream = { path = "lib/portals/portal-stream" }
 
 aes = "0.8.3"

implants/imixv2/Cargo.toml

@@ -7,13 +7,14 @@ edition = "2024"
 crate-type = ["cdylib"]
 
 [features]
-default = ["install", "grpc", "http1", "dns", "doh"]
+default = ["install", "grpc", "http1", "dns", "doh", "events"]
 grpc = ["transport/grpc"]
 http1 = ["transport/http1"]
 dns = ["transport/dns"]
 doh = ["transport/doh"]
 win_service = []
 install = []
+events = []
 tokio-console = ["dep:console-subscriber", "tokio/tracing"]
 
 [dependencies]
@@ -25,6 +26,7 @@ tokio = { workspace = true, features = [
     "net",
     "io-util",
     "tracing",
+    "signal",
 ] }
 portal-stream = { workspace = true }
 anyhow = { workspace = true }
@@ -40,6 +42,11 @@ pb = { workspace = true, features = ["imix"] }
 portable-pty = { workspace = true }
 rust-embed = { workspace = true }
 console-subscriber = { workspace = true, optional = true }
+libc = { workspace = true }
+nix = { workspace = true }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+signal-hook = { version = "0.3", features = ["extended-siginfo"] }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 windows-service = { workspace = true }

implants/imixv2/embedded/on_event.eldritch

@@ -0,0 +1,8 @@
+def on_callback_fail(args={}):
+    print("[on_callback_fail]", args)
+
+def on_callback_success(args={}):
+    print("[on_callback_success]", args)
+
+def on_start(args={}):
+    print("started")

implants/imixv2/src/assets.rs

@@ -1,5 +1,5 @@
 use rust_embed::RustEmbed;
 
 #[derive(RustEmbed)]
-#[folder = "./install_scripts"]
+#[folder = "./embedded"]
 pub struct Asset;