From 989e4bfc0948591d1648b06467decde3a50562b2 Mon Sep 17 00:00:00 2001
From: moloch-- <875022+moloch--@users.noreply.github.com>
Date: Thu, 15 Oct 2026 12:59:09 -0600
Subject: [PATCH] Exercise FirefoxDump with latest Sliver BOF action

---
 .github/sliver-bof-e2e.yml      | 34 +++++++++++++++++++++++++++++++++
 .github/workflows/reflektor.yml | 11 ++++++++++-
 tests/reflektor/README.md       |  6 ++++++
 3 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 .github/sliver-bof-e2e.yml

diff --git a/.github/sliver-bof-e2e.yml b/.github/sliver-bof-e2e.yml
new file mode 100644
index 0000000..252ed0e
--- /dev/null
+++ b/.github/sliver-bof-e2e.yml
@@ -0,0 +1,34 @@
+schema: sliver-bof-e2e/v1
+
+sliver:
+  version: b19e383111dbf8b04096806b249f6238274edff4
+
+defaults:
+  bof_executor: reflektor
+  entrypoint: go
+  modes: [session, beacon]
+  command_timeout: 2m
+
+suites:
+  - name: windows-amd64
+    target: {os: windows, arch: amd64}
+    tests:
+      # A nonempty invalid mode returns before SQLite or profile access.
+      - name: invalid-mode
+        object: tests/reflektor/artifacts/firefoxdump.x64.o
+        args:
+          - {type: string, value: sliver-bof-e2e-invalid-mode}
+        expect:
+          output:
+            equals: "[!] Invalid mode. Use --mode /all or --mode /cookies.\n"
+
+  - name: windows-386
+    target: {os: windows, arch: '386'}
+    tests:
+      - name: invalid-mode
+        object: tests/reflektor/artifacts/firefoxdump.x86.o
+        args:
+          - {type: string, value: sliver-bof-e2e-invalid-mode}
+        expect:
+          output:
+            equals: "[!] Invalid mode. Use --mode /all or --mode /cookies.\n"
diff --git a/.github/workflows/reflektor.yml b/.github/workflows/reflektor.yml
index 1a75c34..2c7cf6b 100644
--- a/.github/workflows/reflektor.yml
+++ b/.github/workflows/reflektor.yml
@@ -90,7 +90,7 @@ jobs:
     needs:
       - build
     runs-on: windows-2025
-    timeout-minutes: 15
+    timeout-minutes: 180
     strategy:
       fail-fast: false
       matrix:
@@ -149,3 +149,12 @@ jobs:
           finally {
             Pop-Location
           }
+
+      # The smoke harness above refuses to run if any Firefox profile root
+      # exists on this same Windows runner. The manifest also uses an invalid
+      # option that returns before the BOF reads profiles.
+      - name: Exercise Sliver session and beacon BOF execution
+        uses: sliverarmory/sliver-test-bof@b38a09a226bf861a1e56e9dbe07838fe99138582
+        with:
+          manifest: .github/sliver-bof-e2e.yml
+          target: windows/${{ matrix.goarch }}
diff --git a/tests/reflektor/README.md b/tests/reflektor/README.md
index 042be79..180309d 100644
--- a/tests/reflektor/README.md
+++ b/tests/reflektor/README.md
@@ -30,3 +30,9 @@ callbacks. It does **not** test NSS loading, SQLite rows, DPAPI, master-password
 handling, or decryption of actual Firefox data. Those operations cannot be
 covered by a package CI job without introducing credential-like fixtures and a
 substantially larger trusted runtime surface.
+
+After this smoke test passes on each Windows runner, the same workflow runs
+`sliver-test-bof` against Sliver session and beacon implants. Its manifest sends
+only a nonempty invalid mode, which the BOF rejects before loading SQLite or
+accessing Firefox profiles. This checks the Sliver/Reflektor BOF and argument
+path without extracting profile data.