# inline_execute - Execute Beacon Object File (BOF)

Execute a Beacon Object File (BOF) in the current process thread and capture its output.

## Description

The `inline_execute` command loads and executes a COFF (Common Object File Format) file, commonly known as a Beacon Object File (BOF), directly in the memory of the current process. BOFs are lightweight, position-independent code objects that can be executed without creating new processes, making them useful for stealthy operations.

## Syntax

```
inline_execute -BOF <bof_file> [-Arguments <arguments>]
```

## Parameters

- `-BOF` or `bof_name` (required): Name of an already uploaded BOF file (e.g., `whoami.x64.o`)
- `bof_file` (required for new uploads): A new BOF file to upload and execute
- `-Arguments` or `bof_arguments` (optional): Arguments to pass to the BOF

### Argument Types

BOF arguments can be specified using the following format:
- `int16:123` or `-s:123` - 16-bit integer
- `int32:1234` or `-i:1234` - 32-bit integer
- `string:hello` or `-z:hello` - Null-terminated string
- `wchar:hello` or `-Z:hello` - Wide character string
- `base64:abc==` or `-b:abc==` - Base64-encoded binary data

## Examples

```
# Execute a BOF with no arguments
inline_execute -BOF whoami.x64.o

# Execute a BOF with integer argument
inline_execute -BOF listmods.x64.o -Arguments int32:1234

# Execute a BOF with multiple arguments
inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP

# Upload and execute a new BOF
inline_execute -BOF custom_bof.x64.o -Arguments int32:5678
```

## Features

- **In-Memory Execution**: BOFs are executed directly in the current process memory without creating new processes
- **COFF Loader**: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
- **Beacon API Compatibility**: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
- **Output Capture**: Automatically captures and returns BOF output
- **Argument Parsing**: Supports multiple argument types (int16, int32, string, wchar, base64)

## Output

The command returns the output captured from the BOF via `BeaconPrintf` or `BeaconOutput`:

```
[BOF Output]
Module Name: ntdll.dll
Base Address: 0x7ffa12340000
Size: 0x1f0000
```

If the BOF produces no output, the command will indicate successful execution.

## OPSEC Considerations

- **MEDIUM OPSEC RISK**: In-process execution reduces some detection vectors compared to process spawning
- **Process Create Artifact**: BOF execution creates a "Process Create" artifact that is logged in Mythic
- **Memory Allocation**: BOFs allocate executable memory (PAGE_EXECUTE_READWRITE) which may be detected by EDR solutions
- **API Monitoring**: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged by EDR/XDR
- **Memory Scanning**: Allocated executable memory may be scanned by EDR memory protection features
- **No New Process**: Unlike `shell`, BOFs execute in-process, reducing some detection vectors
- **Thread Isolation**: BOFs execute in a separate thread with a 30-second timeout to prevent agent crashes

## Technical Details

### COFF Loader

The COFF loader implementation:
- Supports x64 COFF files (IMAGE_FILE_MACHINE_AMD64)
- Handles relocations (IMAGE_REL_AMD64_ADDR64, IMAGE_REL_AMD64_ADDR32NB, IMAGE_REL_AMD64_REL32)
- Resolves internal Beacon API functions
- Resolves external symbols via LoadLibraryA/GetProcAddress
- Maps sections with PAGE_EXECUTE_READWRITE permissions

### Thread Isolation

BOFs are executed in a separate thread to prevent agent crashes:
- **Timeout**: 30-second timeout for BOF execution
- **Thread Termination**: If BOF hangs, the thread is terminated after timeout
- **Output Capture**: Output is captured even if BOF hangs or times out
- **Agent Stability**: Main agent thread continues to function even if BOF crashes

### Beacon API Compatibility

The following Beacon API functions are supported:
- `BeaconPrintf` - Formatted output (captured and returned)
- `BeaconOutput` - Raw output (captured and returned)
- `BeaconDataParse` - Parse input data
- `BeaconDataInt`, `BeaconDataShort`, `BeaconDataExtract` - Data extraction
- `BeaconUseToken`, `BeaconRevertToken` - Token manipulation
- `BeaconIsAdmin` - Admin check

### Argument Serialization

Arguments are serialized using the Packer class format:
- Each argument is prefixed with its size (4 bytes, little-endian)
- Arguments are packed sequentially: `[size:4][data][size:4][data]...`
- The total buffer size is prepended to the argument buffer
- Boolean values are converted to integers (0 or 1) before serialization

## Error Handling

The command handles various error scenarios:
- **File Not Found**: Returns error if BOF file cannot be retrieved from Mythic
- **Invalid COFF**: Returns error if file is not a valid COFF or unsupported architecture
- **Symbol Resolution Failure**: Warns if external symbols cannot be resolved
- **Execution Failure**: Returns error if BOF entry point cannot be found or execution fails

## Related

- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process
- [Artifacts Support](../features.md#artifacts-support)

---

**Command Category:** Execution & Control  
**Requires Admin:** No  
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/)