BOF support

The Havoc agent supports in-memory execution of object files, commonly known as Beacon Object Files or BOFs.

Python modules

From python, you can pack data as you normally do in Cobalt Strike. You can find several examples of how to do this in this repository.

Get the output of a BOF in python

Also, you can run an object file and obtain the result with a callback, like so:

def my_callback(demonID, worked, output):
    print('hi there! I am the python callback of the "locale" BOF')
    print(f'demonID: {demonID}')
    print(f'did the BOF run ok?: {worked}')
    if worked:
        print('here you have the output :)')
        print(output)
        print('bye!')

def locale( demonID, *param ):
    TaskID : str    = None
    demon  : Demon  = None

    demon  = Demon( demonID )

    return demon.InlineExecuteGetOutput( my_callback, "go", "ObjectFiles/locale.x64.o", b'' )