About
=====

This is a demonstration of a component contract for long-running BOFs. See:

https://aff-wg.org/2026/06/10/a-long-running-bof-component-contract/

Project
=======

examples/
	Two example Long-running Beacon Object Files. 

	wakeup    - pops a message box, prints a message after the user presses OK
	idlewatch - prints a message when the user goes idle and becomes active again

external/
	External .spec and code dependencies, taken from the Tradecraft Garden
	https://tradecraftgarden.org/tradecraft.html

include/lrbof.h
	header file for long-running BOF projects

src/
	Source code for an LR-BOF implementation and demo harness

Environment
===========

1. Setup a WSL environment as described at:

https://tradecraftgarden.org/wslsetup.html

2. Download Crystal Palace and extract it somewhere

https://tradecraftgarden.org/crystalpalace.html

Compiling
=========

make clean
make all

Running
=======

1. Link one or more LR-BOFs to the demo harness

/path/to/crystalpalace/piclink demo.spec x64 demo.bin %BOFS="examples/bin/idlewatch.x64.o, examples/bin/wakeup.x64.o"

2. Launch DebugView from Sysinternals (this is where output goes)

3. Run demo.bin in a shellcode runner

path\to\crystalpalace\demo\run.x64 demo.bin

License
=======

(c) 2026 Raphael Mudge, Adversary Fan Fiction Writers Guild
Released under the 3-clause BSD license

See LICENSE.txt for more information.

Acknowledgements
================

This project's design is based on Asynchronous PICOs published by Marcos Gonzalez Hermida:

https://www.nccgroup.com/research/async-picos-and-custom-beacon-wakeups-in-cobalt-strike/

