← Back to Dashboard

COFFLoader

// Beacon Object File Loader Masterclass

8
Modules
C
Language
x64
Architecture
3
Difficulty Tiers

A standalone COFF (Common Object File Format) loader that executes Beacon Object Files (BOFs) outside of Cobalt Strike. Understand in-process execution of position-independent object code, COFF section loading, symbol resolution, relocation fixups, and the Beacon API compatibility layer. By TrustedSec.

01 Beginner

What Are Beacon Object Files?

BOFs explained, why in-process execution matters, advantages over fork-and-run, and why COFFLoader brings BOFs outside Cobalt Strike.

 02 Beginner

COFF File Format Deep Dive

COFF header, section table, symbol table, string table, relocation entries — understanding the raw binary format that BOFs compile to.

 03 Beginner

The BOF API Contract

BeaconPrintf, BeaconDataParse, BeaconDataExtract, the datap/formatp structures, and the Beacon compatibility layer that BOFs depend on.

 04 Intermediate

COFF Section Loading

Parsing section headers, VirtualAlloc with RWX, copying raw data, handling .text, .data, .rdata, .bss, and section characteristics.

 05 Intermediate

Symbol Resolution & Linking

Parsing the symbol table, resolving external symbols, the __imp_ prefix convention, LoadLibraryA/GetProcAddress resolution, and function pointer tables.

 06 Intermediate

Relocation Processing

IMAGE_REL_AMD64_ADDR64, REL32, ADDR32NB — applying fixups to loaded sections so code and data references point to the right addresses.

 07 Advanced

The Beacon Compatibility Layer

Implementing BeaconPrintf, BeaconOutput, BeaconDataParse outside CS, the InternalFunctions table, dynamic API resolution, and beacon_funcs mapping.

 08 Advanced

Full Chain, Writing BOFs & Security

Complete loader walkthrough, writing custom BOFs, MSVC/MinGW compilation flags, security considerations, and comparison with bof-launcher.

References & Resources