─────────────────────────────────────────────────────────────────────────
Overview
Rook is a self-contained C2 framework targeting macOS and Linux. The triple-DH handshake establishes forward-secret sessions from first contact. Every session gets its own persistent pty — cd sticks, environment changes persist across reconnects. The operator interface is a full Ratatui TUI that behaves like a real terminal. Zig cross-compile produces a fresh binary per build, changing the binary hash each time.
Architecture
>
rook-implant
Standalone binary. Triple-DH initiation, AES-256-GCM command channel, persistent pty per session. Zig cross-compiled per build.
>
rook-server
Beacon listener and operator API. Maintains session state, routes commands to the correct pty.
>
rook-operator
Ratatui TUI. Full terminal emulation per session — tab-switch between active implants. Session history persisted locally.
>
rook-forge
Build system: seeds Zig cross-compile toolchain, produces a fresh binary with new embedded keys each run.