wtf is geolocation_bof?

GeolocationBOF is a small program written in C that runs inside Cobalt Strike, a tool used by security professionals during penetration tests. Its purpose is to figure out the physical location of a Windows computer by asking the operating system for GPS or Wi-Fi based coordinates. The tool tries a newer Windows API first, and if that fails it falls back to an older one. The program works directly in memory, which the author describes as running without "fork and run." This is a technical detail about how Cobalt Strike executes code on a target machine. Running in this way avoids starting a separate process, which matters during security assessments because it draws less attention from monitoring software. To get location data, the tool changes several Windows registry settings. These settings control whether apps are allowed to access location information. Some changes only affect the current user, while others, such as enabling the location service and overriding privacy policies, require administrator privileges. The tool also temporarily starts a Windows service called "lfsvc," which handles location requests on the system. The author notes that all registry changes are reverted after the program finishes. The output is straightforward: it prints the latitude, longitude, and accuracy radius in meters. However, results depend on the target having location services available and enabled. If privacy settings or administrator policies block location access entirely, the tool may return nothing. Admin context is required to grant permissions if they are not already present. The README is sparse but honest about limitations. There is no built-in evasion or stealth beyond the in-process execution method. Users are expected to handle their own operational security. To compile the tool, you clone the repository and run "make." To use it, you import a script into Cobalt Strike and run the command "geolocation_bof."