Neura Market
boku7/BokuLoader logo

boku7/BokuLoader

Free

Cobalt Strike User-Defined Reflective Loader written in Assembly & C for advanced evasion capabilities. By: @0xBoku & @s4ntiago_p

FreeFree tier
Type
Open Source
Visit Website GitHub (38 stars)

About boku7/BokuLoader

BokuLoader is an open-source proof-of-concept User-Defined Reflective Loader (UDRL) for Cobalt Strike, written in Assembly and C. It aims to recreate, integrate, and enhance Cobalt Strike's evasion features. The project supports multiple Malleable PE evasion features including allocator types (HeapAlloc, MapViewOfFile, VirtualAlloc), DLL name specification, obfuscation for HTTP/S beacons, entry point RVA, cleanup, userwx, and sleep_mask. It also implements custom evasion techniques such as reflective call stack spoofing via synthetic frames, indirect NT syscalls using HellsGate/HalosGate techniques, memory protection changes via indirect syscall to NtProtectVirtualMemory, NOHEADERCOPY, Caesar cipher string obfuscation, and import name stomping. BokuLoader is intended for red teams to develop their own in-house Cobalt Strike UDRLs and requires thorough testing before operational use.

Key Features

Reflective call stack spoofing via synthetic frames
Indirect NT syscalls via HellsGate and HalosGate techniques
Custom ASM/C reflective loader code
Memory protection changes via indirect syscall to NtProtectVirtualMemory
Obfuscate true support with custom UDRL Aggressor script implementation
NOHEADERCOPY: Loader does not copy headers (first 0x1000 bytes are nulls)
XGetProcAddress for resolving symbols (avoids Kernel32.GetProcAddress)
xLoadLibrary for resolving DLL base addresses from TEB-PEB structures
Caesar cipher for string obfuscation
Import DLL names and entry name strings stomped in virtual beacon DLL

Pros & Cons

Pros
  • Open source and actively maintained by the community
  • Enhances Cobalt Strike's evasion capabilities with custom techniques
  • Supports a wide range of Malleable PE evasion features
  • Modular design allows for customization and integration
  • Detailed documentation of supported and unsupported features
Cons
  • Not all Cobalt Strike evasion features are supported (e.g., SMB/TCP obfuscation)
  • Requires thorough testing across different environments before operational use
  • Compilation results may vary by OS version, compiler, and Java version
  • Primarily a proof-of-concept; not intended as a production-ready loader

Best For

Red team operations requiring custom Cobalt Strike reflective loadersAdversary simulation and evasion technique developmentTesting and enhancing Cobalt Strike's Malleable PE evasion featuresEducational research into reflective loading and evasion methodologies

FAQ

What is BokuLoader?
BokuLoader is an open-source proof-of-concept User-Defined Reflective Loader (UDRL) for Cobalt Strike, written in Assembly and C. It aims to recreate, integrate, and enhance Cobalt Strike's evasion features.
What Malleable PE evasion features does BokuLoader support?
BokuLoader supports allocator (HeapAlloc, MapViewOfFile, VirtualAlloc), module_x64 string, obfuscate true/false (HTTP/S beacons only), entry_point, cleanup true, userwx true/false, and sleep_mask.
Does BokuLoader support SMB or TCP beacons with obfuscate true?
Currently, SMB/TCP is not supported for obfuscate true. The project accepts help to fix this issue.