bof-launcher is a Zig- and C-based programming library that loads, executes, chains and sleep-masks Beacon Object Files in memory, intended for authorized red team engagements and adversary simulation research.
| Tool | The-Z-Labs/bof-launcher — Zig/C library for in-memory loading, execution, chaining and masking of Beacon Object Files, plus an implant example and BOF collection |
| Category | Red team / post-exploitation tooling library |
| Primary Use | Integrating BOF execution into custom C/C++/Zig/Go/Rust tooling during authorized engagements, and authoring cross-platform BOFs in Zig |
| Safe Use | The README's liability clause states the project is meant to be used with authorization to assess security posture and for research purposes — i.e., contracted red team engagements, adversary simulation and defensive research labs only |
| Telemetry Note | In-memory BOF execution is designed to minimize disk artifacts, but defenders can still observe unusual thread creation, sacrificial-process behavior, sleep-mask memory encryption cycles in beacon processes, and cross-platform COFF/ELF loader activity via EDR behavioral analytics |
bof-launcher from The-Z-Labs answers a question that has been growing in the offensive tooling community since mid-2020: what happens when you want Beacon Object Files without the Beacon? Cobalt Strike 4.1, released on 25 June 2020, introduced BOFs as small post-exploitation capabilities that parse arguments, call a few Win32 APIs, report output and exit — entirely inside the Beacon process. The Z-Labs team saw the format's potential and built a standalone engine around it, turning a proprietary framework feature into an open, embeddable runtime that any authorized operator or researcher can wire into their own tooling.
The core deliverable is a programming library implemented in Zig and C that handles the full in-memory lifecycle of BOFs: loading them, keeping track of what has been loaded, executing them, and applying what the project calls modern sleepmasking — encrypting or obfuscating the loaded code while it idles. It supports x86 and x86_64 on Windows, and x86, x86_64, ARMv6+ and AArch64 on Linux, which is a notably wider architectural footprint than most BOF-adjacent tooling. Integration is offered through both a C API in bof_launcher_api.h and a native Zig API in bof_launcher_api.zig, with sample integrations for programs written in C, C++, Zig, Go and Rust.
What makes the project architecturally interesting is that it treats the BOF as a universal in-memory plugin format rather than a Cobalt Strike curiosity. The launcher accepts objects built against the Windows BOF template from Cobalt-Strike/bof_template as well as the Linux-oriented outflanknl/nix_bof_template, and it handles both Windows COFF and UNIX/Linux ELF object formats seamlessly. The README also highlights a chaining capability, where the output of one BOF feeds the next — described as working like Bash pipes but purely in memory, on both Linux and Windows. That composability is the kind of design detail that separates a runtime from a loader.
The choice of Zig is not incidental marketing. Because BOFs are conventionally written in C against a bare-minimum runtime, developers normally give up conveniences like data structures and networking. Writing BOFs in Zig restores access to a rich standard library — the README enumerates lists, hash maps, a cross-platform OS layer, http, networking, threading, crypto and compression — while keeping the low-level character the format demands. This is what enables the repository's most distinctive offering: genuinely cross-platform BOFs, exemplified by udpScanner, tcpScanner and grep, which run unchanged across the supported Windows and Linux architectures.
Beyond the library itself, the repository is effectively a small ecosystem. It ships z-beac0n, a modular stage-1 pre-C2 implant for Windows and Linux that the README describes as engineered around a small footprint, stealth and modularity, with bof-launcher as its engine. There is also a bof command-line tool in examples/cli4bofs, pitched as a swiss army knife for running, injecting and organizing a BOF collection, plus a growing collection of Z-Labs BOFs organized by functional category. Reading the repo, the implant should be understood as a reference application of the library rather than the primary product.
The bundled BOF collection is a useful map of the intended workflow. Situ-awareness entries (SAL-BOF) include familiar Unix-flavored utilities — whoami, whereami, uname, uptime, ifconfig, lskmod, winver — alongside filesystem tools like pwd, cd, cat, zcat, ls and find. Networking is covered by a socat-style NET-BOF, remote situational awareness by the tcpScanner and udpScanner SAR-BOFs, and there is a TEXT-BOF grep. Importantly, the authors state these conventional BOFs remain fully compatible with Cobalt Strike itself and were tested against Sliver, AdaptixC2 and Meterpreter's executebof command — reinforcing that the launcher extends the ecosystem rather than fragmenting it.
The categories operators should treat with more care are the Elevation-BOF slot, currently holding a dirtypipe implementation for the well-known Linux kernel primitive, and the Injection-BOF slot with processInjectionSrdi. The README's own framing is instructive here: the launcher provides a pattern for running riskier BOFs — the example given is privilege escalation exploits — inside a sacrificial process, so that a crash does not take down the main implant. From a defensive standpoint, that same pattern is a detection angle: sacrificial process spawning plus in-memory object execution is anomalous behavior worth modeling in EDR telemetry.
The special-purpose BOFs exist mainly to serve z-beac0n and reveal the implant's architecture. A BOF0 category — so-called BOF zero — operates as a standalone implant core that manages and executes other loaded BOFs. C2-BOF entries such as C2channelHTTPS provide alternative command-and-control channels as API-style plugins, and API-BOF entries like kmodLoader round out the misc layer. The design lesson is that C2 transport, implant core and capabilities are all decoupled in-memory components — a modular architecture that mirrors where modern adversary simulation tooling is heading.
Building the project leans entirely on Zig's qualities as a zero-dependency, drop-in C/C++ compiler with cross-compilation out of the box. After downloading the 0.15.2 tarball and putting it on PATH, the whole tree — every BOF, example program and the launcher library for all supported platforms — builds with a single zig build. Debug-friendly standalone executables come from zig build -Doptimize=Debug, tests from zig build test, and foreign-architecture testing via zig build test -fqemu --glibc-runtimes /usr using QEMU, which Zig integrates directly. Build artifacts land in zig-out/bin and zig-out/lib. That build ergonomics matter in this space: reproducible cross-platform compilation without a toolchain management headache is a genuine operational advantage for engagement infrastructure.
The repository carries a NOASSERTION license, so teams considering integration into commercial tooling should review the actual license terms carefully before shipping derivatives — an easy step to skip and an expensive one to skip wrongly. With 342 stars and active topic tagging around red-teaming, adversary-simulation and ziglang, the project occupies a credible niche: it is neither a toy loader nor a full commercial framework, but the connective tissue that lets authorized operators build custom tooling on top of the BOF format.
The liability section is explicit and worth quoting in spirit: this is an open source project meant to be used with authorization to assess the security posture and for research purposes. For defenders, bof-launcher is valuable study material precisely because it documents the mechanics of in-memory BOF execution, sleepmasking and chaining in readable Zig source. For authorized red teams, it offers a maintained, cross-platform, language-modern runtime that removes the hard dependency on any single C2 framework — which is exactly the capability gap it set out to close.
The-Z-Labs/bof-launcher.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.