# inline_execute - Execute Beacon Object File (BOF)

Execute a Beacon Object File (BOF) in the current process thread and capture its output.

## Description

The `inline_execute` command loads and executes a COFF (Common Object File Format) file, commonly known as a Beacon Object File (BOF), directly in the memory of the current process. BOFs are lightweight, position-independent code objects that can be executed without creating new processes, making them useful for stealthy operations.

## Syntax

```
inline_execute -BOF <bof_file> [-Arguments <arguments>]
```

## Parameters

- `-BOF` or `bof_name` (required): Name of an already uploaded BOF file (e.g., `whoami.x64.o`)
- `bof_file` (required for new uploads): A new BOF file to upload and execute
- `-Arguments` or `bof_arguments` (optional): Arguments to pass to the BOF

### Argument Types

BOF arguments can be specified using the following format:
- `int16:123` or `-s:123` - 16-bit integer
- `int32:1234` or `-i:1234` - 32-bit integer
- `string:hello` or `-z:hello` - Null-terminated string
- `wchar:hello` or `-Z:hello` - Wide character string
- `base64:abc==` or `-b:abc==` - Base64-encoded binary data

## Examples

```
# Execute a BOF with no arguments
inline_execute -BOF whoami.x64.o

# Execute a BOF with integer argument
inline_execute -BOF listmods.x64.o -Arguments int32:1234

# Execute a BOF with multiple arguments
inline_execute -BOF netstat.x64.o -Arguments int32:4 string:TCP

# Upload and execute a new BOF
inline_execute -BOF custom_bof.x64.o -Arguments int32:5678
```

## Features

- **In-Memory Execution**: BOFs are executed directly in the current process memory without creating new processes
- **COFF Loader**: Full COFF loader implementation supporting x64 BOFs with relocations and symbol resolution
- **Beacon API Compatibility**: Compatible with Cobalt Strike BOF API (BeaconPrintf, BeaconOutput, etc.)
- **Output Capture**: Automatically captures and returns BOF output
- **Argument Parsing**: Supports multiple argument types (int16, int32, string, wchar, base64)

## Output

```
[inline_execute] BOF execution requested
[inline_execute] File ID: abc123...
[inline_execute] Arguments: int32:1234
[BOF Output]
Module Name: ntdll.dll
Base Address: 0x7ffa12340000
Size: 0x1f0000
```

## OPSEC Considerations

- **Process Create Artifact**: BOF execution creates a "Process Create" artifact that is logged
- **Memory Allocation**: BOFs allocate executable memory which may be detected by EDR solutions
- **API Hooking**: Some EDR solutions monitor API calls that BOFs make
- **Symbol Resolution**: External symbol resolution (LoadLibraryA, GetProcAddress) may be logged
- **No New Process**: Unlike `shell` or `execute_assembly`, BOFs execute in-process, reducing some detection vectors

## Technical Details

### COFF Loader

The COFF loader implementation:
- Supports x64 COFF files (IMAGE_FILE_MACHINE_AMD64)
- Handles relocations (IMAGE_REL_AMD64_ADDR64, IMAGE_REL_AMD64_ADDR32NB, IMAGE_REL_AMD64_REL32)
- Resolves internal Beacon API functions
- Resolves external symbols via LoadLibraryA/GetProcAddress
- Maps sections with PAGE_EXECUTE_READWRITE permissions

### Beacon API Compatibility

The following Beacon API functions are supported:
- `BeaconPrintf` - Formatted output
- `BeaconOutput` - Raw output
- `BeaconDataParse` - Parse input data
- `BeaconDataInt`, `BeaconDataShort`, `BeaconDataExtract` - Data extraction
- `BeaconUseToken`, `BeaconRevertToken` - Token manipulation
- `BeaconIsAdmin` - Admin check

## Error Handling

The command handles various error scenarios:
- **File Not Found**: Returns error if BOF file cannot be retrieved from Mythic
- **Invalid COFF**: Returns error if file is not a valid COFF or unsupported architecture
- **Symbol Resolution Failure**: Warns if external symbols cannot be resolved
- **Execution Failure**: Returns error if BOF entry point cannot be found or execution fails

## Related

- [`inline_execute_assembly`](inline_execute_assembly.md) - Execute .NET assemblies in-process
- [`execute_assembly`](execute_assembly.md) - Execute .NET assemblies in remote processes
- [Artifacts Support](../features.md#artifacts-support)

---

**Command Category:** Execution & Control  
**Requires Admin:** No  
**MITRE ATT&CK:** [T1055 - Process Injection](https://attack.mitre.org/techniques/T1055/)