What is bingusldr?

BingusLdr is a specialized loader for the Cobalt Strike red team framework, built as a research project to demonstrate a technique called CET compatible stack spoofing. Cobalt Strike is a commercial tool security professionals use to simulate real world attacks against their own organizations so defenses can be tested and improved, and a loader like this one is the small piece of code responsible for getting a payload running in memory. The project is built with a companion toolkit called Crystal Palace, which BingusLdr relies on to assemble the loader. Alongside stack spoofing, which is meant to make the program's call history look normal to security monitoring tools that check for tampering, the project also includes EAF compatible API resolution, heap masking, and image masking, all techniques aimed at making the loaded program harder for endpoint security software to flag as suspicious. The author has written a companion blog post that explains the stack spoofing technique in more depth. To build BingusLdr you need the mingw-w64 compiler toolchain, along with the Crystal Palace link tool and a library file called libtcg placed in specific folders the project expects. For use with Cobalt Strike, running make produces the loader, and the crystalpalace.jar file needs to be placed in the Cobalt Strike client directory along with importing the provided bingus.cna script. The project can also be built to load an arbitrary DLL of your choosing instead of a Cobalt Strike payload by passing that DLL's path to the build command. The README lists several related projects and a security research article as references, showing this work builds on a broader body of published research into how loaders and stack spoofing techniques interact with modern security defenses. No license file is mentioned in the README.