# boku7/bokuloader architecture

> Architecture diagram of the GitHub repository boku7/bokuloader, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/boku7/bokuloader
- Repository: https://github.com/boku7/bokuloader

## Overview

BokuLoader is a proof-of-concept Cobalt Strike reflective loader. The documented user workflow is to import its Aggressor script into Cobalt Strike and use it when generating an x64 beacon; at runtime, the loader prepares a virtual beacon image and resolves its imports and relocations. Its documented capabilities also include configurable allocation, indirect syscalls, call-stack spoofing, and optional IAT hooks. The map reflects the excerpts and README; unsampled implementation details are represented only where documented.

Main entry points: [`src/BokuLoader.c`](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c) (Reflective Loader), [`dist/BokuLoader.cna`](https://github.com/boku7/bokuloader/blob/main/dist/BokuLoader.cna) (Aggressor Script), [`src/BokuLoader.h`](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.h) (Loader Types)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_integration["Cobalt Strike Integration"]
  node_aggressor["Aggressor Script<br/>[BokuLoader.cna]"]
  node_beacon["Beacon Build"]
end

subgraph group_loader["Reflective Loading"]
  node_loader["Reflective Loader<br/>[BokuLoader.c]"]
  node_image["Virtual Image Setup<br/>[BokuLoader.c]"]
  node_imports["Import Resolution<br/>[BokuLoader.c]"]
  node_relocations["Relocation Processing<br/>[BokuLoader.c]"]
  node_memory["Memory Allocation<br/>[BokuLoader.c]"]
end

subgraph group_evasion["Evasion Features"]
  node_syscalls["Indirect Syscalls<br/>[BokuLoader.c]"]
  node_spoofing["Stack Spoofing<br/>[BokuLoader.c]"]
  node_iat["IAT Hooks<br/>[BokuLoader.c]"]
end

subgraph group_internals["Loader Internals"]
  node_api_resolver["API Resolution<br/>[BokuLoader.c]"]
  node_definitions["Loader Types<br/>[BokuLoader.h]"]
end

node_operator(("Operator"))

node_operator -->|"imports"| node_aggressor
node_aggressor -->|"configures"| node_beacon
node_beacon -->|"uses"| node_loader
node_loader -->|"prepares"| node_image
node_loader -->|"allocates"| node_memory
node_loader -->|"resolves"| node_imports
node_loader -->|"applies"| node_relocations
node_memory -->|"uses"| node_syscalls
node_loader -->|"uses"| node_spoofing
node_imports -->|"supports"| node_iat
node_loader -->|"resolves APIs"| node_api_resolver
node_loader -->|"uses types"| node_definitions

click node_aggressor "https://github.com/boku7/bokuloader/blob/main/dist/BokuLoader.cna"
click node_loader "https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c"
click node_image "https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c"
click node_imports "https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c"
click node_relocations "https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c"
click node_memory "https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c"
click node_syscalls "https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c"
click node_spoofing "https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c"
click node_iat "https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c"
click node_api_resolver "https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c"
click node_definitions "https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.h"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_aggressor,node_beacon toneBlue
class node_loader,node_image,node_imports,node_relocations,node_memory toneAmber
class node_syscalls,node_spoofing,node_iat toneMint
class node_api_resolver,node_definitions toneRose
class node_operator toneIndigo
```

## Components

### Cobalt Strike Integration

- [Aggressor Script](https://github.com/boku7/bokuloader/blob/main/dist/BokuLoader.cna): `dist/BokuLoader.cna`
- **Beacon Build**

### Reflective Loading

- [Reflective Loader](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c): `src/BokuLoader.c`
- [Virtual Image Setup](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c): `src/BokuLoader.c`
- [Import Resolution](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c): `src/BokuLoader.c`
- [Relocation Processing](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c): `src/BokuLoader.c`
- [Memory Allocation](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c): `src/BokuLoader.c`

### Evasion Features

- [Indirect Syscalls](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c): `src/BokuLoader.c`
- [Stack Spoofing](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c): `src/BokuLoader.c`
- [IAT Hooks](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c): `src/BokuLoader.c`

### Loader Internals

- [API Resolution](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.c): `src/BokuLoader.c`
- [Loader Types](https://github.com/boku7/bokuloader/blob/main/src/BokuLoader.h): `src/BokuLoader.h`

### Other components

- **Operator**

## Connections

- Operator → Aggressor Script: imports (evidence: `README.md`)
- Aggressor Script → Beacon Build: configures (evidence: `README.md`)
- Beacon Build → Reflective Loader: uses (evidence: `README.md`)
- Reflective Loader → Virtual Image Setup: prepares (evidence: `src/BokuLoader.c`)
- Reflective Loader → Memory Allocation: allocates (evidence: `src/BokuLoader.c`)
- Reflective Loader → Import Resolution: resolves (evidence: `src/BokuLoader.c`)
- Reflective Loader → Relocation Processing: applies (evidence: `src/BokuLoader.c`)
- Memory Allocation → Indirect Syscalls: uses (evidence: `src/BokuLoader.c`)
- Reflective Loader → Stack Spoofing: uses (evidence: `src/BokuLoader.c`)
- Import Resolution → IAT Hooks: supports (evidence: `src/BokuLoader.c`)
- Reflective Loader → API Resolution: resolves APIs (evidence: `src/BokuLoader.c`)
- Reflective Loader → Loader Types: uses types (evidence: `src/BokuLoader.c`)