rasta-mouse / atomic-bofs

What is atomic-bofs?

Atomic-bofs lets you run Beacon Object Files (BOFs) standalone, without a C2 framework like Cobalt Strike. Written in C, it provides a harness that loads COFF binaries into memory, handles packed arguments via simple config files, and executes entrypoints on x86 or x64 Windows targets. It's built for atomic test units—repeatable, isolated runs akin to Atomic Red Team github tests but focused on BOF execution, solving the pain of framework dependency for quick validation.

Why is it gaining traction?

It stands out by decoupling BOF testing from C2 overhead, using Crystal Palace for packing args and embedding COFF bytes directly—no recompiles needed for tweaks. Developers dig the hook support for evasion, like intercepting Win32 APIs in third-party BOFs (e.g., TrustedSec's whoami), plus cross-arch builds via straightforward Makefiles. In a world of atomic test sites and github atomic red tools, this delivers frictionless, framework-agnostic BOF runs.

Who should use this?

Red team operators scripting atomic tests outside engagements, security researchers validating BOF payloads like atomic test_and_set primitives, or pentesters customizing github atomic agent behaviors. Ideal for those building atomic red team github suites or tweaking BOFs for evasion without full Cobalt Strike setups.

Verdict

Grab it if you're deep in BOF dev—solid for niche atomic test needs despite 21 stars signaling early maturity and basic docs. Low 0.699999988079071% credibility score reflects limited adoption, but examples and harness make it a practical starter for targeted testing.

(178 words)