How boku7/bokuloader works
BokuLoader is a proof-of-concept Cobalt Strike reflective loader. The documented user workflow is to import its Aggressor script into Cobalt Strike and use it when generating an x64 beacon; at runtime, the loader prepares a virtual beacon image and resolves its imports and relocations. Its documented capabilities also include configurable allocation, indirect syscalls, call-stack spoofing, and optional IAT hooks. The map reflects the excerpts and README; unsampled implementation details are represented only where documented.
Main entry points: BokuLoader.c Reflective Loader · BokuLoader.cna Aggressor Script · BokuLoader.h Loader Types
Components 13
Cobalt Strike Integration
- Aggressor Script
dist/BokuLoader.cna - Beacon Build
Reflective Loading
- Reflective Loader
src/BokuLoader.c - Virtual Image Setup
src/BokuLoader.c - Import Resolution
src/BokuLoader.c - Relocation Processing
src/BokuLoader.c - Memory Allocation
src/BokuLoader.c
Evasion Features
- Indirect Syscalls
src/BokuLoader.c - Stack Spoofing
src/BokuLoader.c - IAT Hooks
src/BokuLoader.c
Loader Internals
- API Resolution
src/BokuLoader.c - Loader Types
src/BokuLoader.h
Other components
- Operator
Connections 12
- Operator → Aggressor Script: imports
README.md - Aggressor Script → Beacon Build: configures
README.md - Beacon Build → Reflective Loader: uses
README.md - Reflective Loader → Virtual Image Setup: prepares
src/BokuLoader.c - Reflective Loader → Memory Allocation: allocates
src/BokuLoader.c - Reflective Loader → Import Resolution: resolves
src/BokuLoader.c - Reflective Loader → Relocation Processing: applies
src/BokuLoader.c - Memory Allocation → Indirect Syscalls: uses
src/BokuLoader.c - Reflective Loader → Stack Spoofing: uses
src/BokuLoader.c - Import Resolution → IAT Hooks: supports
src/BokuLoader.c - Reflective Loader → API Resolution: resolves APIs
src/BokuLoader.c - Reflective Loader → Loader Types: uses types
src/BokuLoader.c