/*
 * hello_bof.c -- The simplest possible Beacon Object File
 * Step 01: A minimal BOF that prints a message using BeaconPrintf.
 *
 * Compile (do NOT link -- the -c flag is critical):
 *   MinGW:  x86_64-w64-mingw32-gcc -c hello_bof.c -o hello_bof.o
 *   MSVC:   cl.exe /c /GS- hello_bof.c /Fo hello_bof.obj
 *
 * Run with COFFLoader:
 *   COFFLoader.exe go hello_bof.o
 */

#include <windows.h>
#include "beacon.h"

/* Declare the DLL import using the LIBRARY$Function convention.
 * The compiler generates symbol: __imp_KERNEL32$GetCurrentProcessId
 * The COFF loader will split on '$', call LoadLibraryA("KERNEL32"),
 * then GetProcAddress(hLib, "GetCurrentProcessId"). */
DECLSPEC_IMPORT DWORD WINAPI KERNEL32$GetCurrentProcessId(void);

void go(char* args, int len) {
    DWORD pid = KERNEL32$GetCurrentProcessId();
    BeaconPrintf(CALLBACK_OUTPUT, "[*] Hello from BOF! PID: %d\n", pid);
}