Execution-BOF

July 27, 2025 ยท View on GitHub

BOFs for inline execution

execute-assembly

Perform in process .NET assembly execution

execute-assembly <path> [params]

The defaults are set as follows in execute-assembly/inlineExecute-Assembly.c to change them, edit and recompile.

	char* appDomain = "test";
	char* pipeName = "test";
	char* slotName = "test";
	BOOL amsi = 1;
	BOOL etw = 1;
	BOOL revertETW = 1;
	BOOL mailSlot = 0;
	ULONG entryPoint = 1;

noconsolation

This is a Beacon Object File (BOF) that executes unmanaged PEs inline and retrieves their output without allocating a console (i.e. spawning conhost.exe). More details

Credits