Add 'bin' argument type (base64-encoded), update README, fix 'hexilify' typo

Cargo.toml

@@ -49,3 +49,4 @@ windows-sys = { version = "0.48.0", features = [
     "Win32_Security",
     "Win32_System_Diagnostics_Debug"
 ] }
+base64 = "0.22.1"

README.md

@@ -13,7 +13,7 @@ Coffee: A COFF loader made in Rust
 Usage: coffee.exe [OPTIONS] --bof-path <BOF_PATH> [-- <ARGS>...]
 
 Arguments:
-  [ARGS]...  Arguments to the BOF passed after the "--" delimiter, supported types are: str, wstr, int, short
+  [ARGS]...  Arguments to the BOF passed after the "--" delimiter, supported types are: str, wstr, int, short, bin
 
 Options:
   -b, --bof-path <BOF_PATH>      Path to the Beacon Object File (BOF)
@@ -31,8 +31,9 @@ Arguments for the BOF can be passed after the `--` delimiter. Each argument must
 - `wstr` - A wide null-terminated string
 - `int` - A signed 32-bit integer
 - `short` - A signed 16-bit integer
+- `bin` - A base64-encoded binary blob
 
-## Example
+## Examples
 
 Using the `dir.x64.o` BOF from the [trustedsec/CS-Situational-Awareness-BOF](https://github.com/trustedsec/CS-Situational-Awareness-BOF) repository and passing arguments to the BOF:
 
@@ -40,6 +41,12 @@ Using the `dir.x64.o` BOF from the [trustedsec/CS-Situational-Awareness-BOF](htt
 coffee.exe --bof-path .\dir.x64.o -- wstr:"C:\\Windows\\System32"
 ```
 
+Using the `ntcreatethread.x64.o` BOF from the [trustedsec/CS-Remote-OPs-BOF](https://github.com/trustedsec/CS-Remote-OPs-BOF) repository and passing a PID and the shellcode to execute as base64-encoded binary data.
+
+```bash
+coffee.exe --bof-path .\ntcreatethread.x64.o -- int:1337 bin:/EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdCLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpV////11IugEAAAAAAAAASI2NAQEAAEG6MYtvh//Vu+AdKgpBuqaVvZ3/1UiDxCg8BnwKgPvgdQW7RxNyb2oAWUGJ2v/VY2FsYy5leGUA
+```
+
 ## Usage as library
 
 ```bash

src/loader/beacon_pack.rs

@@ -76,6 +76,18 @@ impl BeaconPack {
         self.buffer.write_u16::<LittleEndian>(0).unwrap();
         self.size += ((s_bytes.len() * 2) + 2) as u32 + 4;
     }
+
+    /// `add_bin` adds binary data to the buffer
+    ///
+    /// # Panics
+    /// Panics if the buffer cannot be written as binary data
+    pub fn add_bin(&mut self, bin: &[u8]) {
+        self.buffer
+            .write_u32::<LittleEndian>(bin.len() as u32)
+            .unwrap();
+        self.buffer.write_all(bin).unwrap();
+        self.size += (bin.len() as u32) + 4;
+    }
 }
 
 impl Default for BeaconPack {

src/main.rs

@@ -5,6 +5,7 @@
 use std::fmt::Write;
 use std::path::PathBuf;
 
+use base64::{prelude::BASE64_STANDARD, Engine};
 use clap::Parser;
 use color_eyre::Result;
 use tracing::{debug, info};
@@ -32,13 +33,13 @@ struct Args {
     #[clap(default_value = "1")]
     verbosity: Option<u8>,
 
-    /// Arguments to the BOF passed after the "--" delimiter, supported types are: str, wstr, int, short
+    /// Arguments to the BOF passed after the "--" delimiter, supported types are: str, wstr, int, short, bin
     #[clap(last = true)]
     arguments: Vec<String>,
 }
 
-/// Unhexilify a string of hexadecimal characters to pass as arguments to the BOF
-fn unhexilify_args(value: &str) -> Result<Vec<u8>> {
+/// Unhexlify a string of hexadecimal characters to pass as arguments to the BOF
+fn unhexlify_args(value: &str) -> Result<Vec<u8>> {
     assert!(value.len() % 2 == 0, "Invalid argument hexadecimal string");
 
     let bytes: Result<Vec<u8>, _> = (0..value.len())
@@ -80,6 +81,12 @@ fn hexlify_args(args: Vec<String>) -> String {
                     panic!("Invalid short value");
                 }
             }
+            "bin" => {
+                let bin_value = BASE64_STANDARD
+                    .decode(argument_value)
+                    .expect("Invalid binary value, please provide as base64");
+                beacon_pack.add_bin(&bin_value);
+            }
             _ => panic!("Invalid argument type"),
         }
     }
@@ -130,7 +137,7 @@ fn main() -> Result<()> {
     let coff_buffer = std::fs::read(&args.bof_path)?;
 
     // Unhexlify the arguments
-    let unhexilified = unhexilify_args(arguments.as_str())?;
+    let unhexilified = unhexlify_args(arguments.as_str())?;
     debug!("Unhexilified arguments: {:?}", unhexilified);
 
     // Execute the BOF