This article explores 'COFF Mixing,' a technique designed to bypass common memory-injected content detections. Traditional methods like shellcode or PICO runners often trigger alerts due to RW/RX memory allocations and suspicious call stacks. By merging functional capabilities with benign code and outputting them as a PE-ready COFF, operators can ensure that execution remains within image-backed memory, significantly reducing the forensic footprint.
The process involves using specification files to merge capabilities with benign libraries, such as mathematical functions, and performing link-time optimizations like symbol stripping and code shuffling (disco). This approach obscures the origin of the execution and produces a legitimate-looking call stack. COFF mixing serves as a stealthy alternative for executable or DLL payloads where traditional memory injection would provide unnecessary indicators of compromise.
Top comments (0)