timwhitez starred BokuLoader

2022-7-7 14:11:58 Author: github.com(查看原文) 阅读量:25 收藏
Switch branches/tags

1 branch 0 tags


This branch is up to date with boku7/BokuLoader:main.

  • This branch is not ahead of the upstream boku7:main.

    No new commits yet. Enjoy your day!

Latest commit

+ Stomp MZ Magic Bytes
+ Find-Self EggHunter
+ PE Header Obfuscation
+ PE String Replacement
+ Prepend ASM Instructions


Git stats



Failed to load latest commit information.



Latest commit message

Commit time

Cobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities.

Project Contributors: Bobby Cooke @0xBoku & Santiago Pecin @s4ntiago_p


  • Stomp MZ Magic Bytes
  • Find-Self EggHunter
  • Direct NT Syscalls via HellsGate & HalosGate
  • PE Header Obfuscation
  • PE String Replacement
  • NOHEADERCOPY - Loader will not copy headers over to beacon. Decommits the first memory page which would normally hold the headers
  • NoRWX - The Reflective loader writes beacon with Read & Write permissions and after resolving Beacons Import Table & Relocations, changes the .TEXT code section of Beacon to Read & Execute permissions
  • XGetProcAddress for resolving symbols
  • 100k UDRL Size
  • Caesar Cipher for string obfuscation
  • Prepend ASM Instructions


  1. Start your Cobalt Strike Team Server with or without a profile.
  2. Unless you only generate RAW payloads, set the stagesize to 412256 on build.sh in the artifact kit.
  3. Load the dist-template/artifact.cna Aggressor script.
  4. Go to your Cobalt Strike GUI and import the BokuLoader.cna Aggressor script.
  5. Generate your x64 payload (Attacks -> Packages -> Windows Executable (S))
  • Does not support x86 option. The x86 bin is the original Reflective Loader object file.
  1. Use the Script Console to make sure that the beacon created successfully with this User-Defined Reflective Loader
  • If successful, the output in the Script Console will look like this:


  1. Run the make command after installling required dependencies
# Install brew on macOS if you need it (https://brew.sh/)
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
# Install Ming using Brew
brew install mingw-w64
# Clone this Reflective DLL project from this github repo
git clone https://github.com/boku7/BokuLoader.git
# Compile the BokuLoader Object file
cd BokuLoader/
  1. Follow "Usage" instructions

Credits / References

Reflective Loader

HalosGate SysCaller

  • Reenz0h from @SEKTOR7net
    • Most of the C techniques I use are from Reenz0h's awesome courses and blogs
    • Best classes for malware development out there.
    • Creator of the halos gate technique. His work was the motivation for this work.
    • Sektor7 HalosGate Blog

HellsGate Syscaller

Cobalt Strike User Defined Reflective Loader

Great Resource for learning Intel ASM

ETW and AMSI Bypass

Implementing ASM in C Code with GCC

Cobalt Strike C2 Profile Generator

文章来源: https://github.com/xforcered/BokuLoader