Bof and assemblies completed

documentation-payload/Cazalla/commands/inline_execute.md

@@ -53,23 +53,26 @@ inline_execute -BOF custom_bof.x64.o -Arguments int32:5678
 
 ## Output
 
+The command returns the output captured from the BOF via `BeaconPrintf` or `BeaconOutput`:
+
 ```
-[inline_execute] BOF execution requested
-[inline_execute] File ID: abc123...
-[inline_execute] Arguments: int32:1234
 [BOF Output]
 Module Name: ntdll.dll
 Base Address: 0x7ffa12340000
 Size: 0x1f0000
 ```
 
+If the BOF produces no output, the command will indicate successful execution.
+
 ## OPSEC Considerations
 
-- **Process Create Artifact**: BOF execution creates a "Process Create" artifact that is logged
-- **Memory Allocation**: BOFs allocate executable memory which may be detected by EDR solutions
-- **API Hooking**: Some EDR solutions monitor API calls that BOFs make
-- **Symbol Resolution**: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged
-- **No New Process**: Unlike `shell` or `execute_assembly`, BOFs execute in-process, reducing some detection vectors
+- **MEDIUM OPSEC RISK**: In-process execution reduces some detection vectors compared to process spawning
+- **Process Create Artifact**: BOF execution creates a "Process Create" artifact that is logged in Mythic
+- **Memory Allocation**: BOFs allocate executable memory (PAGE_EXECUTE_READWRITE) which may be detected by EDR solutions
+- **API Monitoring**: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged by EDR/XDR
+- **Memory Scanning**: Allocated executable memory may be scanned by EDR memory protection features
+- **No New Process**: Unlike `shell`, BOFs execute in-process, reducing some detection vectors
+- **Thread Isolation**: BOFs execute in a separate thread with a 30-second timeout to prevent agent crashes
 
 ## Technical Details
 
@@ -82,16 +85,32 @@ The COFF loader implementation:
 - Resolves external symbols via LoadLibraryA/GetProcAddress
 - Maps sections with PAGE_EXECUTE_READWRITE permissions
 
+### Thread Isolation
+
+BOFs are executed in a separate thread to prevent agent crashes:
+- **Timeout**: 30-second timeout for BOF execution
+- **Thread Termination**: If BOF hangs, the thread is terminated after timeout
+- **Output Capture**: Output is captured even if BOF hangs or times out
+- **Agent Stability**: Main agent thread continues to function even if BOF crashes
+
 ### Beacon API Compatibility
 
 The following Beacon API functions are supported:
-- `BeaconPrintf` - Formatted output
-- `BeaconOutput` - Raw output
+- `BeaconPrintf` - Formatted output (captured and returned)
+- `BeaconOutput` - Raw output (captured and returned)
 - `BeaconDataParse` - Parse input data
 - `BeaconDataInt`, `BeaconDataShort`, `BeaconDataExtract` - Data extraction
 - `BeaconUseToken`, `BeaconRevertToken` - Token manipulation
 - `BeaconIsAdmin` - Admin check
 
+### Argument Serialization
+
+Arguments are serialized using the Packer class format:
+- Each argument is prefixed with its size (4 bytes, little-endian)
+- Arguments are packed sequentially: `[size:4][data][size:4][data]...`
+- The total buffer size is prepended to the argument buffer
+- Boolean values are converted to integers (0 or 1) before serialization
+
 ## Error Handling
 
 The command handles various error scenarios:
@@ -103,7 +122,6 @@ The command handles various error scenarios:
 ## Related
 
 - [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process
-- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
 - [Artifacts Support](../features.md#artifacts-support)
 
 ---