boku7/BokuLoader

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1431 stars · 273 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

BokuLoader is a proof-of-concept User-Defined Reflective Loader (UDRL) for Cobalt Strike written in C and assembly. It recreates, integrates, and enhances Cobalt Strike's evasion features such as reflective callstack spoofing, indirect NT syscalls, and string obfuscation for red team operations.

Use cases

• build a custom user-defined reflective loader for Cobalt Strike beacons
• evade EDR detection with reflective callstack spoofing
• use indirect NT syscalls for memory protection changes
• load beacon DLL without copying PE headers into memory
• resolve DLLs and function symbols without LoadLibraryA or GetProcAddress
• obfuscate strings in the loader with Caesar cipher
• learn red team loader development techniques

When to choose

• you run a Cobalt Strike red team engagement and need stronger evasion than the built-in loader
• you want a reference implementation to build your own in-house UDRL
• you need callstack spoofing, indirect syscalls, and header stomping in one loader

When to avoid

• you do not have a licensed Cobalt Strike installation, since it is a UDRL for that platform
• you need a production-grade, fully supported loader without testing across compiler, OS, and Java versions
• your use case is defensive research unrelated to offensive tooling

Facets

library · maturity active

security cryptography developer-tools security penetration-testing developer-tools windows cpp red-team cobalt-strike reflective-loader evasion offensive-security udrl callstack-spoofing syscalls

Member repositories

For agents

markdown · JSON · MCP: product_card(name="boku7/BokuLoader")