2026-08-16 23:41:57 -07:00
2026-02-16 11:59:44 -08:00
2026-08-15 15:45:28 -07:00
2026-02-16 11:59:44 -08:00
2026-02-16 11:59:44 -08:00
2026-08-16 18:43:23 -07:00
2026-02-16 11:59:44 -08:00
2026-02-16 13:50:51 -08:00
2026-02-16 11:59:44 -08:00

Reflektor

Reflektor is a Go library and CLI for loading shared libraries from bytes and invoking exported functions.

It exposes a stable root package (reflektor) so other projects can import it directly, while platform-specific loading is handled behind memmod.

Platform Support

OS Architectures Shared Library Format Status Loader Notes
Windows 386, amd64, arm64 PE (.dll) Supported In-memory PE loader
Darwin amd64, arm64 Mach-O (.dylib, bundle) Supported Dyld4 root-image loader with system dependencies registered through public dyld; supports no-cgo builds and avoids temp-file legacy NS APIs.
Linux 386, amd64, arm64 ELF (.so) Supported Pure Go in-memory ELF loader (maps PT_LOAD segments, applies relocations, resolves externals from runtime modules/dlsym); no memfd, no /dev/shm, no temp-file disk writes.
Other - - Unsupported Returns an explicit unsupported-platform error.

Public API

Import path:

import "github.com/sliverarmory/reflektor"

Example:

payload := []byte{}

lib, err := reflektor.LoadLibrary(payload)
if err != nil {
    return err
}
defer lib.Close()

if err := lib.CallExport("StartW"); err != nil {
    return err
}

You can also load from a path:

lib, err := reflektor.LoadLibraryFile("./payload.dylib")

CLI

The CLI is in reflektor/cli and uses Cobra.

Build:

go build -o reflektor ./cli

Usage:

./reflektor <shared-library-path> [--call-export StartW]

--call-export defaults to StartW.

Behavior Notes

  • CallExport is designed for zero-argument exports.
  • Reflektor normalizes common symbol naming differences where possible (for example underscore-prefixed forms).
  • The root reflektor.Library interface is intentionally small: CallExport() and Close().

Test Data And Validation

C test shared libraries are generated from:

  • reflektor/testdata/c/basic.c

The Rust HTTPS fixture is built from reflektor/testdata/rust. It exports StartW, performs a bounded GET https://example.com/ through libcurl on Darwin/Linux or WinHTTP on Windows, and records ok:200 after receiving a non-empty successful response. The fixture is dependency-free Rust (no_std) so it does not require unsupported thread-local runtime state from the in-memory loaders.

Build test shared libraries for the full matrix:

./testdata/build_c_shared_libs.sh

Run tests:

go test ./...

The Rust fixture test requires Cargo with Rust 1.94.0 and outbound HTTPS access. Linux also requires the libcurl development package so the fixture can link against the system TLS client.

Linux cross-arch Docker harness:

  • reflektor/testdata/docker/linux-memmod.Dockerfile
  • reflektor/testdata/docker/run-linux-memmod-matrix.sh

Repository Layout

  • reflektor/reflektor.go: root importable package (reflektor).
  • reflektor/memmod: OS-specific loader backends.
  • reflektor/cli: CLI entrypoint.
  • reflektor/testdata: portable shared-library fixtures and build/test harnesses.
S
Description
Automated archival mirror of github.com/sliverarmory/reflektor
Readme GPL-3.0 1.8 MiB
Languages
Go 98%
Shell 1.2%
Assembly 0.8%