This article explores "COFF Mixing," a technique designed to evade memory-based detections by merging capability code with benign code into a standard Windows Portable Executable (PE). Traditional memory-injected content, such as shellcode or Beacon Object Files (BOFs), often leaves distinct indicators of compromise (IOCs) like unbacked RX memory or suspicious call stacks. By linking capabilities directly into an image-backed COFF, developers can bypass these common memory analysis hurdles.
The author demonstrates how to use specification files and the cpl utility to merge object files, strip identifying symbols, and utilize the +disco option for function shuffling. This approach effectively hides the malicious capability within legitimate mathematical libraries or other benign codebases, making static and dynamic analysis significantly more complex for security researchers by ensuring execution occurs within legitimate image-backed memory segments.
Top comments (0)