Skip to main content

bof.cpp (Beacon Object File)

Source: src/modules/bof.cpp

The bof module loads and executes a Beacon Object File (BOF) directly from memory within the implant's process space. It leverages an external C-based BOF launcher API to allocate the object, pack arguments, execute the entry point, capture standard output, and safely clean up the execution context.

Function Signature​

ModuleResult run_bof(std::vector<uint8_t> bof_bytes, const std::string& bof_args);

Parameters​

  • bof_bytes: A byte vector containing the raw, compiled object code of the BOF to be executed.
  • bof_args: A string containing the arguments to be packed and passed into the BOF during execution.

Logic & Behavior​

This module relies heavily on the bof_launcher_api:

  1. Initializes the underlying BOF launcher environment (bofLauncherInit).
  2. Parses and initializes the BOF object directly from the provided byte buffer (bofObjectInitFromMemory).
  3. Allocates and constructs the BOF argument structure, packing the provided string into it (bofArgsInit, bofArgsBegin, bofArgsAdd, bofArgsEnd).
  4. Executes the BOF object (bofObjectRun) passing the handle and the packed argument buffer, which yields an execution context.
  5. Extracts the output from the execution context (bofContextGetOutput) and copies it into a standard C++ string.
  6. Cleans up by releasing the allocated memory for both the arguments and the execution context (bofArgsRelease, bofContextRelease).

Return Values (ModuleResult)​

  • data: A string containing the captured standard output from the BOF execution. Returns empty ("") if execution failed or there was no output.
  • windows_error_code:
  • ERROR_SUCCESS (0): The BOF executed and output was successfully retrieved.
  • ERROR_INTERNAL_ERROR: The BOF launcher failed to initialize, or the BOF failed to execute.
  • ERROR_BAD_FORMAT: The provided BOF bytes could not be parsed or loaded from memory.
  • ERROR_OUTOFMEMORY: The argument structure failed to initialize.
  • ERROR_UNIDENTIFIED_ERROR: The BOF finished, but no output string could be retrieved from the context.