### Get Windows Version Information (Zig vs C) Source: https://github.com/the-z-labs/bof-launcher/blob/main/README.md Retrieves and prints Windows version information (major version, minor version, and OS build number). This example is provided in both Zig and C, showcasing the implementation in each language using the respective APIs. ```zig const w32 = @import("bof_api").win32; const beacon = @import("bof_api").beacon; pub export fn go(adata: ?[*]u8, alen: i32) callconv(.c) u8 { @import("bof_api").init(adata, alen, .{}); var version_info: w32.OSVERSIONINFOW = undefined; version_info.dwOSVersionInfoSize = @sizeOf(@TypeOf(version_info)); if (w32.RtlGetVersion(&version_info) != .SUCCESS) return 1; _ = beacon.printf( .output, "Windows version: %d.%d, OS build number: %d\n", version_info.dwMajorVersion, version_info.dwMinorVersion, version_info.dwBuildNumber, ); return 0; } ``` ```c #include #include "beacon.h" NTSYSAPI NTSTATUS NTAPI NTDLL$RtlGetVersion(OSVERSIONINFOW* lpVersionInformation); unsigned char go(unsigned char* arg_data, int arg_len) { OSVERSIONINFOW version_info; version_info.dwOSVersionInfoSize = sizeof(version_info); if (NTDLL$RtlGetVersion(&version_info) != 0) return 1; BeaconPrintf( CALLBACK_OUTPUT, "Windows version: %d.%d, OS build number: %d\n", version_info.dwMajorVersion, version_info.dwMinorVersion, version_info.dwBuildNumber ); return 0; } ``` -------------------------------- ### Integrate bof-launcher with C Source: https://github.com/the-z-labs/bof-launcher/blob/main/README.md A simple example demonstrating how to integrate the bof-launcher library into an application written in C. This allows C applications to leverage the functionality of BOFs. ```c #include // Assume bof_launcher.h is available and provides necessary functions // For example: void bof_execute(const char* bof_path, void* args); int main() { printf("Integrating bof-launcher with C\n"); // Example: Execute a BOF from a file path // const char* bof_file = "/path/to/your/bof.bin"; // bof_execute(bof_file, NULL); // Replace NULL with actual arguments if needed printf("C integration example finished.\n"); return 0; } ``` -------------------------------- ### Integrate bof-launcher with Go Source: https://github.com/the-z-labs/bof-launcher/blob/main/README.md A simple example demonstrating how to integrate the bof-launcher library into an application written in Go. This allows Go applications to leverage the functionality of BOFs. ```go package main import "fmt" // Assume bof_launcher is available via CGO or other means // For example: // import "C" func main() { fmt.Println("Integrating bof-launcher with Go") // Example: // bofPath := "/path/to/your/bof.bin" // C.bof_execute(C.CString(bofPath), nil) // Replace nil with actual arguments fmt.Println("Go integration example finished.") } ``` -------------------------------- ### Build Project with Zig Source: https://github.com/the-z-labs/bof-launcher/blob/main/README.md Builds all included BOFs, example programs, and the bof-launcher library for all supported platforms using Zig. Debug builds can be enabled with '-Doptimize=Debug'. Tests can be run with 'zig build test', and tests on foreign architectures can be run using QEMU integration. ```shell zig build ``` ```shell zig build -Doptimize=Debug ``` ```shell zig build test ``` ```shell zig build test -fqemu --glibc-runtimes /usr ``` -------------------------------- ### Integrate bof-launcher with Rust Source: https://github.com/the-z-labs/bof-launcher/blob/main/README.md A simple example demonstrating how to integrate the bof-launcher library into an application written in Rust. This allows Rust applications to leverage the functionality of BOFs. ```rust fn main() { println!("Integrating bof-launcher with Rust"); // Assume bof_launcher is available as a Rust crate or FFI bindings // Example: // let bof_path = "/path/to/your/bof.bin"; // unsafe { // bof_launcher::execute(bof_path.as_ptr() as *const i8, std::ptr::null_mut()); // } println!("Rust integration example finished."); } ``` -------------------------------- ### Run BOFs with CLI Tool (Bash) Source: https://context7.com/the-z-labs/bof-launcher/llms.txt This section provides Bash commands for using the 'cli4bofs' tool to execute BOFs. It includes instructions for installation, running a BOF from the filesystem, executing a BOF with arguments, and injecting a BOF into a running process using its PID. ```bash # Install cli4bofs git clone https://github.com/The-Z-Labs/cli4bofs cd cli4bofs zig build # Run BOF from filesystem ./cli4bofs exec ./zig-out/bin/whoami.elf.x64.o # Run with arguments ./cli4bofs exec ./zig-out/bin/tcpScanner.elf.x64.o str:192.168.1.1-10:22,80,443 # Run with injection into process ./cli4bofs inject file:/path/to/bof.coff.x64.o -i: ``` -------------------------------- ### Go Application Example for bof-launcher Source: https://github.com/the-z-labs/bof-launcher/blob/main/examples/integration-with-go/README.md A simple Go application demonstrating the execution of a BOF file using cgo to interface with the bof-launcher library. It requires the bof-launcher API header and compiled library to be present. ```go package main /* #cgo LDFLAGS: -L./lib -lbof_launcher_lin_x64 #include "./lib/bof_launcher_api.h" */ import "C" import ( "fmt" "os" "unsafe" ) func main() { if len(os.Args) < 2 { fmt.Fprintf(os.Stderr, "Usage: %s \n", os.Args[0]) return } bofPath := os.Args[1] file, err := os.Open(bofPath) if err != nil { fmt.Fprintf(os.Stderr, "Error opening BOF file: %v\n", err) return } fileInfo, err := file.Stat() if err != nil { fmt.Fprintf(os.Stderr, "Error getting file info: %v\n", err) return } fileSize := fileInfo.Size() buffer := make([]byte, fileSize) _, err = file.Read(buffer) if err != nil { fmt.Fprintf(os.Stderr, "Error reading BOF file: %v\n", err) return } // Convert Go byte slice to C byte array cBuffer := C.CBytes(buffer) defer C.free(unsafe.Pointer(cBuffer)) // Call the C function from bof_launcher result := C.InvokeBof(cBuffer, C.int(fileSize)) fmt.Printf("BOF execution finished with result: %d\n", result) } ``` -------------------------------- ### Bash Commands for C2 Server and Implant Client Usage Source: https://context7.com/the-z-labs/bof-launcher/llms.txt Provides essential bash commands for setting up and interacting with the BOF launcher C2 server and implant clients. This includes commands to start the server, copy BOF files, run the implant, and task the implant with specific BOFs and arguments. ```bash # Start C2 server mkdir -p doc_root/bofs/ cp zig-out/bin/*.o doc_root/bofs/ cd doc_root/ python serve_bofs.py # Run implant (connects to C2 and awaits tasks) ./bof-stager_lin_x64 # Task implant to run BOF curl -H 'Content-Type: application/json' \ -d '{"header": "inline:z", "name": "bof:uname", "argv": "-a"}' \ http://127.0.0.1:8000/tasking curl -H 'Content-Type: application/json' \ -d '{"header": "inline:z", "name": "bof:tcpScanner", "argv": "192.168.1.1-10:22,80,443"}' \ http://127.0.0.1:8000/tasking # View results curl http://127.0.0.1:8000/tasking ``` -------------------------------- ### Run Go Application with bof-launcher Source: https://github.com/the-z-labs/bof-launcher/blob/main/examples/integration-with-go/README.md Executes a pre-built Go application that uses bof-launcher to run a specified BOF file. The example shows running 'uname.elf.x64.o'. ```bash ./bofsFromGo uname.elf.x64.o ``` -------------------------------- ### bof-launcher C API BOF Object Handling Source: https://github.com/the-z-labs/bof-launcher/wiki/1.-Basic-Concepts Functions for initializing a BOF object from memory, releasing it, checking its validity, and getting procedure addresses. ```c int bofObjectInitFromMemory(const unsigned char* file_data_ptr, int file_data_len, BofObjectHandle* out_bof_handle); void bofObjectRelease(BofObjectHandle bof_handle); int bofObjectIsValid(BofObjectHandle bof_handle); void* bofObjectGetProcAddress(BofObjectHandle bof_handle, const char* name); ``` -------------------------------- ### Get Windows Version Information (C) Source: https://context7.com/the-z-labs/bof-launcher/llms.txt This C code snippet retrieves and prints the Windows version and OS build number using the NTDLL$RtlGetVersion function. It's designed for Beacon integration and requires the 'beacon.h' header. ```c #include #include "beacon.h" NTSYSAPI NTSTATUS NTAPI NTDLL$RtlGetVersion(OSVERSIONINFOW* lpVersionInformation); unsigned char go(unsigned char* arg_data, int arg_len) { OSVERSIONINFOW version_info; version_info.dwOSVersionInfoSize = sizeof(version_info); if (NTDLL$RtlGetVersion(&version_info) != 0) return 1; BeaconPrintf( CALLBACK_OUTPUT, "Windows version: %d.%d, OS build number: %d\n", version_info.dwMajorVersion, version_info.dwMinorVersion, version_info.dwBuildNumber ); return 0; } ``` -------------------------------- ### bof-launcher C API BOF Context Management Source: https://github.com/the-z-labs/bof-launcher/wiki/1.-Basic-Concepts Functions for managing the context of a running BOF, including releasing the context, checking if it's running, waiting for completion, getting the exit code, and retrieving output. ```c void bofContextRelease(BofContext* context); int bofContextIsRunning(BofContext* context); void bofContextWait(BofContext* context); unsigned char bofContextGetExitCode(BofContext* context); const char* bofContextGetOutput(BofContext* context, int* out_output_len); BofObjectHandle bofContextGetObjectHandle(BofContext* context); ``` -------------------------------- ### Memory Masking for Evasion using C Source: https://context7.com/the-z-labs/bof-launcher/llms.txt Demonstrates how to enable memory masking for Win32 API calls made by BOFs to evade detection. A masking key is set, and specific or all supported API calls can be configured to be masked (XORed with the key) before execution and unmasked afterward. This example shows enabling masking for `VirtualAlloc`, `CreateThread`, `WriteProcessMemory`, and disabling it for `CloseHandle`. It utilizes `bofLauncherInit`, `bofMemoryMaskKey`, `bofMemoryMaskSysApiCall`, `bofObjectInitFromMemory`, `bofObjectRun`, `bofContextGetOutput`, `bofContextRelease`, `bofObjectRelease`, and `bofLauncherRelease`. ```c #include "bof_launcher_api.h" int main() { bofLauncherInit(); // Set XOR key for memory masking (max 32 bytes) unsigned char mask_key[] = {0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48}; if (bofMemoryMaskKey(mask_key, sizeof(mask_key)) < 0) { fprintf(stderr, "Failed to set masking key\n"); return -1; } // Enable masking for specific Win32 API calls bofMemoryMaskSysApiCall("VirtualAlloc", 1); // Enable for VirtualAlloc bofMemoryMaskSysApiCall("CreateThread", 1); // Enable for CreateThread bofMemoryMaskSysApiCall("WriteProcessMemory", 1); // Enable for WriteProcessMemory // Or enable for all supported APIs bofMemoryMaskSysApiCall("all", 1); // Disable for specific API if needed bofMemoryMaskSysApiCall("CloseHandle", 0); // Now load and run BOFs - their API calls will be masked BofObjectHandle bof_handle; bofObjectInitFromMemory(obj_file_data, obj_file_size, &bof_handle); BofContext* context = NULL; bofObjectRun(bof_handle, NULL, 0, &context); // When VirtualAlloc is called from BOF, it's wrapped: // zgateVirtualAlloc(...) { // maskMemory(); // XOR memory with key // ret = VirtualAlloc(...); // Call actual API // unmaskMemory(); // Restore memory // return ret; // } const char* output = bofContextGetOutput(context, NULL); printf("%s\n", output ? output : ""); bofContextRelease(context); bofObjectRelease(bof_handle); bofLauncherRelease(); return 0; } ``` -------------------------------- ### Initialize and Run Simple BOF (C) Source: https://context7.com/the-z-labs/bof-launcher/llms.txt Demonstrates the basic workflow of initializing the BOF Launcher library, loading a BOF object from memory, executing it synchronously, and retrieving its output and exit code. This function requires the 'bof_launcher_api.h' header. ```c #include "bof_launcher_api.h" #include // Initialize the library if (bofLauncherInit() < 0) { fprintf(stderr, "Failed to initialize bof-launcher\n"); return -1; } // Load BOF from memory BofObjectHandle bof_handle; unsigned char* obj_file_data = /* BOF file bytes */; int obj_file_size = /* file size */; if (bofObjectInitFromMemory(obj_file_data, obj_file_size, &bof_handle) < 0) { fprintf(stderr, "Failed to load BOF object\n"); bofLauncherRelease(); return -1; } // Execute BOF synchronously BofContext* context = NULL; if (bofObjectRun(bof_handle, NULL, 0, &context) < 0) { fprintf(stderr, "Failed to execute BOF\n"); bofObjectRelease(bof_handle); bofLauncherRelease(); return -1; } // Retrieve and display output const char* output = bofContextGetOutput(context, NULL); if (output) { printf("BOF Output:\n%s\n", output); printf("Exit Code: %d\n", bofContextGetExitCode(context)); } // Cleanup bofContextRelease(context); bofObjectRelease(bof_handle); bofLauncherRelease(); ``` -------------------------------- ### Execute BOF with Arguments (C) Source: https://context7.com/the-z-labs/bof-launcher/llms.txt Shows how to pass arguments to a BOF during execution. It covers initializing the library, loading the BOF, preparing and adding different types of arguments (string, integer, short), executing the BOF with these arguments, and then retrieving the output. Requires 'bof_launcher_api.h'. ```c #include "bof_launcher_api.h" // Initialize library and load BOF bofLauncherInit(); BofObjectHandle bof_handle; bofObjectInitFromMemory(obj_file_data, obj_file_size, &bof_handle); // Prepare arguments BofArgs* args = NULL; if (bofArgsInit(&args) < 0) { fprintf(stderr, "Failed to initialize arguments\n"); return -1; } bofArgsBegin(args); // Add string argument bofArgsAdd(args, "z:/etc/passwd", 13); // z: prefix = null-terminated string // Add integer argument bofArgsAdd(args, "i:1234", 6); // i: prefix = 32-bit integer // Add short argument bofArgsAdd(args, "s:80", 5); // s: prefix = 16-bit short bofArgsEnd(args); // Execute with arguments BofContext* context = NULL; if (bofObjectRun(bof_handle, (unsigned char*)bofArgsGetBuffer(args), bofArgsGetBufferSize(args), &context) < 0) { fprintf(stderr, "Failed to run BOF\n"); bofArgsRelease(args); return -1; } // Get output const char* output = bofContextGetOutput(context, NULL); printf("Output: %s\n", output ? output : "No output"); // Cleanup bofArgsRelease(args); bofContextRelease(context); bofObjectRelease(bof_handle); bofLauncherRelease(); ``` -------------------------------- ### Build BOFs with Zig Build System (Bash) Source: https://context7.com/the-z-labs/bof-launcher/llms.txt These commands demonstrate how to build BOFs and libraries using the Zig build system. It covers downloading a specific Zig version, building all BOFs, compiling with debug info, running tests, and targeting specific platforms. Output files are located in 'zig-out/bin/' and 'zig-out/lib/'. ```bash # Download Zig 0.15.2 (strictly required version) wget https://ziglang.org/download/0.15.2/zig-linux-x86_64-0.15.2.tar.xz tar xf zig-linux-x86_64-0.15.2.tar.xz export PATH=$PATH:$PWD/zig-linux-x86_64-0.15.2 # Build all BOFs and libraries for all platforms zig build # Build with debug info (creates standalone executables) zig build -Doptimize=Debug # Build and run tests zig build test # Build for specific target zig build -Dtarget=x86_64-windows # Output locations ls zig-out/bin/ # BOF object files ls zig-out/lib/ # bof-launcher libraries ``` -------------------------------- ### Integrate and Run BOF from File in Go Source: https://context7.com/the-z-labs/bof-launcher/llms.txt This Go program utilizes CGo to integrate with the BOF launcher library. It takes a BOF file as a command-line argument, initializes the launcher, reads the BOF file into memory, loads it, executes it, retrieves and prints the output and exit code, and finally cleans up resources. Ensure the BOF launcher library is linked correctly. ```go package main /* #cgo CFLAGS: -I./lib #cgo LDFLAGS: ./lib/libbof_launcher_lin_x64.a #include "bof_launcher_api.h" */ import "C" import ( "fmt" "os" "io" "unsafe" ) func main() { if len(os.Args) < 2 { fmt.Printf("usage: %s \n", os.Args[0]) return } bof_file := os.Args[1] // Initialize bof-launcher library C.bofLauncherInit() // Read BOF file f, err := os.Open(bof_file) if err != nil { panic(err) } defer f.Close() size, _ := f.Seek(0, io.SeekEnd) f.Seek(0, io.SeekStart) fmt.Printf("Launching BOF file (size: %d): %s\n", size, bof_file) buf := make([]byte, size) f.Read(buf) // Load BOF bof_handle := C.BofObjectHandle{} var bof_context *C.BofContext cbuf := (*C.uchar)(unsafe.Pointer(&buf[0])) if C.bofObjectInitFromMemory(cbuf, C.int(len(buf)), &bof_handle) != 0 { fmt.Println("bofObjectInitFromMemory failed") return } // Execute BOF if C.bofObjectRun(bof_handle, nil, 0, &bof_context) != 0 { fmt.Println("bofObjectRun failed") return } if bof_context == nil { fmt.Println("Creation of BofContext failed") return } // Get output bof_output := C.bofContextGetOutput(bof_context, nil) if bof_output != nil { fmt.Printf("BOF output:\n%s\n", C.GoString(bof_output)) fmt.Printf("BOF exit code: %d\n", int(C.bofContextGetExitCode(bof_context))) } // Cleanup C.bofObjectRelease(bof_handle) C.bofContextRelease(bof_context) } ``` -------------------------------- ### Basic C API Usage for BOF Launcher Source: https://github.com/the-z-labs/bof-launcher/blob/main/README.md Demonstrates the fundamental steps for loading and executing a BOF using the bof-launcher C API. This includes initializing the BOF object from memory, running it, retrieving its output, and releasing the context. It's essential for integrating BOF execution into C/C++ applications. ```c // Load object file (COFF or ELF) and get a handle to it BofObjectHandle bof_handle; if (bofObjectInitFromMemory(obj_file_data, obj_file_data_size, &bof_handle) < 0) { // handle the error } // Execute BofContext* context = NULL; if (bofObjectRun(bof_handle, NULL, 0, &context) < 0) { // handle the error } // Get output const char* output = bofContextGetOutput(context, NULL); if (output) { // handle BOF output } bofContextRelease(context); ``` -------------------------------- ### Execute Multiple BOFs with Different Arguments in C Source: https://context7.com/the-z-labs/bof-launcher/llms.txt This C code snippet demonstrates how to load a BOF once from memory and execute it multiple times with varying arguments. It initializes the BOF launcher, loads the BOF object, iterates to set different arguments for each execution, runs the BOF, prints its output, and finally releases the resources. ```c #include "bof_launcher_api.h" int main() { bofLauncherInit(); // Load BOF once BofObjectHandle bof_handle; bofObjectInitFromMemory(obj_file_data, obj_file_size, &bof_handle); // Execute multiple times with different arguments for (int i = 0; i < 5; i++) { BofArgs* args = NULL; bofArgsInit(&args); bofArgsBegin(args); char target[32]; snprintf(target, sizeof(target), "z:192.168.1.%d", i); bofArgsAdd(args, (unsigned char*)target, strlen(target)); bofArgsEnd(args); // Run with different arguments BofContext* context = NULL; if (bofObjectRun(bof_handle, (unsigned char*)bofArgsGetBuffer(args), bofArgsGetBufferSize(args), &context) == 0) { printf("Scan %d: %s\n", i, bofContextGetOutput(context, NULL)); bofContextRelease(context); } bofArgsRelease(args); } // Release BOF once when done bofObjectRelease(bof_handle); bofLauncherRelease(); return 0; } ``` -------------------------------- ### Simple C2 HTTP Backend with Flask Source: https://context7.com/the-z-labs/bof-launcher/llms.txt This Python code snippet sets up a basic Command and Control (C2) HTTP backend using the Flask framework. It includes necessary imports for handling web requests, encoding/decoding data, and managing queues, providing a foundation for a C2 server. ```python from flask import Flask, request, send_from_directory import base64 import json import secrets from collections import deque app = Flask(__name__) ``` -------------------------------- ### Execute BOF files using Rust FFI Source: https://context7.com/the-z-labs/bof-launcher/llms.txt This Rust code snippet demonstrates how to use Foreign Function Interface (FFI) to load and execute a Beacon Object File (BOF). It initializes the bof-launcher library, loads a BOF from a file, executes it, retrieves its output and exit code, and then cleans up resources. It requires the `bof_launcher_win_x64` library to be linked. ```rust use std::env; use std::fs::File; use std::io::Read; use std::ffi::c_void; #[repr(C)] struct BofObjectHandle { bits: u32, } #[repr(C)] struct BofContext { _private: [u8; 0], } #[link(name = "bof_launcher_win_x64")] extern "C" { fn bofLauncherInit() -> i32; fn bofLauncherRelease(); fn bofObjectInitFromMemory( data: *const u8, len: i32, handle: *mut BofObjectHandle ) -> i32; fn bofObjectRun( handle: BofObjectHandle, args: *const u8, args_len: i32, context: *mut *mut BofContext ) -> i32; fn bofContextGetOutput(context: *mut BofContext, len: *mut i32) -> *const i8; fn bofContextGetExitCode(context: *mut BofContext) -> u8; fn bofContextRelease(context: *mut BofContext); fn bofObjectRelease(handle: BofObjectHandle); } fn main() { let args: Vec = env::args().collect(); if args.len() < 2 { eprintln!("Usage: {} ", args[0]); return; } // Read BOF file let mut file = File::open(&args[1]).expect("Failed to open BOF file"); let mut buffer = Vec::new(); file.read_to_end(&mut buffer).expect("Failed to read BOF file"); unsafe { // Initialize library if bofLauncherInit() != 0 { eprintln!("Failed to initialize bof-launcher"); return; } // Load BOF let mut handle = BofObjectHandle { bits: 0 }; if bofObjectInitFromMemory( buffer.as_ptr(), buffer.len() as i32, &mut handle ) != 0 { eprintln!("Failed to load BOF"); bofLauncherRelease(); return; } // Execute BOF let mut context: *mut BofContext = std::ptr::null_mut(); if bofObjectRun(handle, std::ptr::null(), 0, &mut context) != 0 { eprintln!("Failed to execute BOF"); bofObjectRelease(handle); bofLauncherRelease(); return; } // Get output let output = bofContextGetOutput(context, std::ptr::null_mut()); if !output.is_null() { let output_str = std::ffi::CStr::from_ptr(output); println!("BOF Output:\n{}", output_str.to_string_lossy()); println!("Exit Code: {}", bofContextGetExitCode(context)); } // Cleanup bofContextRelease(context); bofObjectRelease(handle); bofLauncherRelease(); } } ``` -------------------------------- ### Configure and Run BOF-stager Client (Zig) Source: https://github.com/the-z-labs/bof-launcher/blob/main/examples/BOF-stager/README.md This snippet demonstrates the client-side configuration for the BOF-stager, including setting the C2 server host, port, endpoint, and jitter. It also shows the build command and execution for a Linux x64 target. ```zig const std = @import("std"); const assert = std.debug.assert; const bof = @import("bof_launcher_api"); const c2_host = "127.0.0.1:8000"; const c2_endpoint = "/endpoint"; const jitter = 3; const stdout = std.io.getStdOut(); $ zig build $ ./zig-out/bin/bof-stager_lin_x64 ``` -------------------------------- ### Initialization and Release Source: https://github.com/the-z-labs/bof-launcher/wiki/1.-Basic-Concepts Functions for initializing and releasing the bof-launcher library. ```APIDOC ## Initialization and Release ### Description Functions to initialize and clean up the bof-launcher library resources. ### Functions - **bofLauncherInit** - **Description**: Initializes the bof-launcher library. - **Return Value**: Returns an integer status code (0 for success, non-zero for failure). - **bofLauncherRelease** - **Description**: Releases all resources allocated by the bof-launcher library. ``` -------------------------------- ### Running BOF Objects Source: https://github.com/the-z-labs/bof-launcher/wiki/1.-Basic-Concepts Functions for executing BOF programs. ```APIDOC ## Running BOF Objects ### Description Functions to execute BOF programs, either directly or asynchronously. ### Functions - **bofRun** - **Parameters**: - `file_data_ptr` (const unsigned char*): Pointer to the BOF file data in memory. - `file_data_len` (int): The size of the BOF file data. - **Return Value**: Returns an integer status code (0 for success, non-zero for failure). - **bofObjectRun** - **Parameters**: - `bof_handle` (BofObjectHandle): The handle of the BOF object to run. - `arg_data_ptr` (unsigned char*): Pointer to the argument data for the BOF. - `arg_data_len` (int): The size of the argument data. - `out_context` (BofContext**): Pointer to a variable that will receive the context of the running BOF. - **Return Value**: Returns an integer status code (0 for success, non-zero for failure). - **bofObjectRunAsyncThread** - **Parameters**: - `bof_handle` (BofObjectHandle): The handle of the BOF object to run. - `arg_data_ptr` (unsigned char*): Pointer to the argument data for the BOF. - `arg_data_len` (int): The size of the argument data. - `completion_cb` (BofCompletionCallback): A callback function to be called upon completion. - `completion_cb_context` (void*): User-defined context data for the callback. - `out_context` (BofContext**): Pointer to a variable that will receive the context of the running BOF. - **Return Value**: Returns an integer status code (0 for success, non-zero for failure). - **bofObjectRunAsyncProcess** - **Parameters**: - `bof_handle` (BofObjectHandle): The handle of the BOF object to run. - `arg_data_ptr` (unsigned char*): Pointer to the argument data for the BOF. - `arg_data_len` (int): The size of the argument data. - `completion_cb` (BofCompletionCallback): A callback function to be called upon completion. - `completion_cb_context` (void*): User-defined context data for the callback. - `out_context` (BofContext**): Pointer to a variable that will receive the context of the running BOF. - **Return Value**: Returns an integer status code (0 for success, non-zero for failure). ``` -------------------------------- ### Build Go Application with bof-launcher Source: https://github.com/the-z-labs/bof-launcher/blob/main/examples/integration-with-go/README.md Builds a Go application that utilizes the bof-launcher library. This command assumes the Go source file is named 'cgo.go' and an output executable 'bofsFromGo' is desired. ```bash go build -o bofsFromGo ./cgo.go ``` -------------------------------- ### bof-launcher C API Initialization and Release Source: https://github.com/the-z-labs/bof-launcher/wiki/1.-Basic-Concepts Initializes and releases the bof-launcher library. These functions must be called before and after using other bof-launcher functions. ```c int bofLauncherInit(void); void bofLauncherRelease(void); ``` -------------------------------- ### bof-launcher C API Argument Handling Source: https://github.com/the-z-labs/bof-launcher/wiki/1.-Basic-Concepts Functions for initializing, releasing, adding arguments to, and retrieving arguments from a BOF argument handler. This allows prepared arguments to be passed to BOF functions. ```c int bofArgsInit(BofArgs** out_args); void bofArgsRelease(BofArgs* args); int bofArgsAdd(BofArgs* args, unsigned char* arg, int arg_len); void bofArgsBegin(BofArgs* args); void bofArgsEnd(BofArgs* args); const char* bofArgsGetBuffer(BofArgs* args); int bofArgsGetBufferSize(BofArgs* args); ``` -------------------------------- ### BOF File Serving Source: https://context7.com/the-z-labs/bof-launcher/llms.txt Endpoint for serving Binary Object Files (BOFs) to implants. ```APIDOC ## GET /bofs/ ### Description Serves BOF files to implants. ### Method GET ### Endpoint /bofs/ ### Parameters #### Path Parameters - **path** (string) - Required - The path to the BOF file within the 'bofs' directory. ### Response #### Success Response (200) - **file** (binary) - The requested BOF file. #### Response Example (Binary content of the BOF file) ``` -------------------------------- ### bof-launcher C API Running BOFs Source: https://github.com/the-z-labs/bof-launcher/wiki/1.-Basic-Concepts Functions to run BOF programs either directly from memory, as an object with arguments, or asynchronously in a separate thread or process. ```c int bofRun(const unsigned char* file_data_ptr, int file_data_len); int bofObjectRun(BofObjectHandle bof_handle, unsigned char* arg_data_ptr, int arg_data_len, BofContext** out_context); int bofObjectRunAsyncThread(BofObjectHandle bof_handle, unsigned char* arg_data_ptr, int arg_data_len, BofCompletionCallback completion_cb, void* completion_cb_context, BofContext** out_context); int bofObjectRunAsyncProcess(BofObjectHandle bof_handle, unsigned char* arg_data_ptr, int arg_data_len, BofCompletionCallback completion_cb, void* completion_cb_context, BofContext** out_context); ``` -------------------------------- ### Arguments Management Source: https://github.com/the-z-labs/bof-launcher/wiki/1.-Basic-Concepts Functions for creating, managing, and preparing arguments for BOF programs. ```APIDOC ## Arguments Management ### Description Functions to create, add arguments to, and retrieve the argument buffer for BOF programs. ### Functions - **bofArgsInit** - **Parameters**: - `out_args` (BofArgs**): Pointer to a variable that will receive the pointer to the newly created arguments object. - **Return Value**: Returns an integer status code (0 for success, non-zero for failure). - **bofArgsRelease** - **Parameters**: - `args` (BofArgs*): Pointer to the arguments object to release. - **bofArgsAdd** - **Parameters**: - `args` (BofArgs*): Pointer to the arguments object. - `arg` (unsigned char*): Pointer to the argument data. - `arg_len` (int): The size of the argument data. - **Return Value**: Returns an integer status code (0 for success, non-zero for failure). - **bofArgsBegin** - **Parameters**: - `args` (BofArgs*): Pointer to the arguments object. - **bofArgsEnd** - **Parameters**: - `args` (BofArgs*): Pointer to the arguments object. - **bofArgsGetBuffer** - **Parameters**: - `args` (BofArgs*): Pointer to the arguments object. - **Return Value**: Returns a pointer to the arguments buffer. - **bofArgsGetBufferSize** - **Parameters**: - `args` (BofArgs*): Pointer to the arguments object. - **Return Value**: Returns the size of the arguments buffer. ``` -------------------------------- ### BOF Documentation YAML Syntax Source: https://github.com/the-z-labs/bof-launcher/blob/main/README.md This YAML syntax is used to document Binary Operational Functions (BOFs) directly within their source code files. Documentation lines are prefixed with '///'. This data is concatenated into a common file 'BOF-collection.yaml' during the build process, making it usable by the cli4bofs tool. ```yaml name: BOFname description: string:"short description of a BOF" author: BOFauthor tags: list of tags OS: string:linux|windows|cross sources: list of URLs entrypoint: optional:"go" api: optional:list of signatures of exported functions examples: string:"usage examples of a BOF" - arguments: - name: string:argName desc: string:"short description of an argument" type: string:"short|integer|string|stringW" required: bool api: optional:string:"api function name" - errors: - name: errorName code: int message: string:"short description of the error" ``` -------------------------------- ### Run BOF from Filesystem with cli4bofs Source: https://github.com/the-z-labs/bof-launcher/blob/main/README.md Executes a BOF directly from the filesystem using the 'cli4bofs' tool. This is useful for development and debugging. The command specifies the executable path and can include arguments for the BOF, such as network addresses and ports for port scanner BOFs. ```shell cli4bofs.exe exec .\zig-out\bin\wWinver.coff.x64.o ``` ```shell cli4bofs.exe exec .\zig-out\bin\udpScanner.coff.x64.o str:162.159.200.1-5:123,88 ``` -------------------------------- ### Zig BOF for Windows Version Information Source: https://context7.com/the-z-labs/bof-launcher/llms.txt A simple BOF written in Zig that retrieves and prints Windows operating system version information. It uses the `bof_api` for interacting with the Cobalt Strike beacon and the `win32` module for calling `RtlGetVersion`. ```zig const w32 = @import("bof_api").win32; const beacon = @import("bof_api").beacon; pub export fn go(adata: ?[*]u8, alen: i32) callconv(.c) u8 { @import("bof_api").init(adata, alen, .{}); var version_info: w32.OSVERSIONINFOW = undefined; version_info.dwOSVersionInfoSize = @sizeOf(@TypeOf(version_info)); if (w32.RtlGetVersion(&version_info) != .SUCCESS) return 1; _ = beacon.printf( .output, "Windows version: %d.%d, OS build number: %d\n", version_info.dwMajorVersion, version_info.dwMinorVersion, version_info.dwBuildNumber, ); return 0; } ``` -------------------------------- ### BOF Object Management Source: https://github.com/the-z-labs/bof-launcher/wiki/1.-Basic-Concepts Functions for creating, managing, and releasing BOF objects. ```APIDOC ## BOF Object Management ### Description Functions to manage BOF objects, which represent executable BOF files in memory. ### Functions - **bofObjectInitFromMemory** - **Parameters**: - `file_data_ptr` (const unsigned char*): Pointer to the BOF file data in memory. - `file_data_len` (int): The size of the BOF file data. - `out_bof_handle` (BofObjectHandle*): Pointer to a variable that will receive the handle to the newly created BOF object. - **Return Value**: Returns an integer status code (0 for success, non-zero for failure). - **bofObjectRelease** - **Parameters**: - `bof_handle` (BofObjectHandle): The handle of the BOF object to release. - **bofObjectIsValid** - **Parameters**: - `bof_handle` (BofObjectHandle): The handle of the BOF object to validate. - **Return Value**: Returns 1 if the handle is valid, 0 otherwise. - **bofObjectGetProcAddress** - **Parameters**: - `bof_handle` (BofObjectHandle): The handle of the BOF object. - `name` (const char*): The name of the procedure to find. - **Return Value**: Returns a pointer to the procedure's entry point, or NULL if not found. ``` -------------------------------- ### Add Custom BOF to Collection Source: https://github.com/the-z-labs/bof-launcher/blob/main/README.md Demonstrates how to add a custom BOF to the Z-Labs BOFs collection. This involves placing the BOF source file in the 'bofs/src' directory and adding a corresponding entry in the 'bofs/build.zig' file, specifying its name, desired formats, and target architectures. ```zig { .name = "YOUR_BOF_NAME", .formats = &.{.elf, .coff}, .archs = &.{ .x64, .x86 } }, ``` -------------------------------- ### BOF Context Management Source: https://github.com/the-z-labs/bof-launcher/wiki/1.-Basic-Concepts Functions for managing the execution context of a running BOF program. ```APIDOC ## BOF Context Management ### Description Functions to manage the execution context of a running BOF program, allowing retrieval of status, output, and exit code. ### Functions - **bofContextRelease** - **Parameters**: - `context` (BofContext*): Pointer to the BOF context to release. - **bofContextIsRunning** - **Parameters**: - `context` (BofContext*): Pointer to the BOF context. - **Return Value**: Returns 1 if the BOF is still running, 0 otherwise. - **bofContextWait** - **Parameters**: - `context` (BofContext*): Pointer to the BOF context. - **bofContextGetExitCode** - **Parameters**: - `context` (BofContext*): Pointer to the BOF context. - **Return Value**: Returns the exit code of the BOF program. - **bofContextGetOutput** - **Parameters**: - `context` (BofContext*): Pointer to the BOF context. - `out_output_len` (int*): Pointer to a variable that will receive the length of the output buffer. - **Return Value**: Returns a pointer to the output buffer of the BOF program. ``` -------------------------------- ### Add Custom BOF to Zig Build (Zig) Source: https://context7.com/the-z-labs/bof-launcher/llms.txt This Zig code snippet shows how to add a custom BOF to the build configuration by defining its name, supported formats (ELF, COFF), and target architectures within the 'bofs/build.zig' file. ```zig // In bofs/build.zig, add entry: .{ .name = "myCustomBOF", .formats = &.{"elf", .coff}, // Build both ELF and COFF .archs = &.{ .x64, .x86, .arm, .aarch64 } // All architectures }, ``` -------------------------------- ### Task Queueing API Source: https://context7.com/the-z-labs/bof-launcher/llms.txt Endpoints for queuing BOF execution tasks and retrieving pending tasks. ```APIDOC ## POST /tasking ### Description Queues a Binary Object File (BOF) execution task. ### Method POST ### Endpoint /tasking ### Parameters #### Request Body - **header** (string) - Required - Header information, e.g., "inline:z". - **name** (string) - Required - The name of the BOF to execute, e.g., "bof:tcpScanner". - **argv** (string) - Optional - Arguments for the BOF, e.g., "192.168.1.1-255:22,80,443". ### Request Example ```json { "header": "inline:z", "name": "bof:tcpScanner", "argv": "192.168.1.1-255:22,80,443" } ``` ### Response #### Success Response (200) - **message** (string) - Confirmation message, e.g., "Task queued". #### Response Example ``` Task queued ``` ## GET /tasking ### Description Retrieves a pending task for an implant. ### Method GET ### Endpoint /tasking ### Parameters None ### Response #### Success Response (200) - **csv_response** (string) - Task details in CSV format, e.g., "task_id,bof_name,bof_path,argv". Returns "nothing to do" if no tasks are pending. #### Response Example ``` 123e4567-e89b-12d3-a456-426614174000,tcpScanner,/bofs/tcpScanner.elf.x64,MTkyLjE2OC4xLjEtMjU1OjIyLDgwLDQ0Mw== ``` ```