Exercise FirefoxDump with latest Sliver BOF action

.github/sliver-bof-e2e.yml

@@ -0,0 +1,34 @@
+schema: sliver-bof-e2e/v1
+
+sliver:
+  version: b19e383111dbf8b04096806b249f6238274edff4
+
+defaults:
+  bof_executor: reflektor
+  entrypoint: go
+  modes: [session, beacon]
+  command_timeout: 2m
+
+suites:
+  - name: windows-amd64
+    target: {os: windows, arch: amd64}
+    tests:
+      # A nonempty invalid mode returns before SQLite or profile access.
+      - name: invalid-mode
+        object: tests/reflektor/artifacts/firefoxdump.x64.o
+        args:
+          - {type: string, value: sliver-bof-e2e-invalid-mode}
+        expect:
+          output:
+            equals: "[!] Invalid mode. Use --mode /all or --mode /cookies.\n"
+
+  - name: windows-386
+    target: {os: windows, arch: '386'}
+    tests:
+      - name: invalid-mode
+        object: tests/reflektor/artifacts/firefoxdump.x86.o
+        args:
+          - {type: string, value: sliver-bof-e2e-invalid-mode}
+        expect:
+          output:
+            equals: "[!] Invalid mode. Use --mode /all or --mode /cookies.\n"

.github/workflows/reflektor.yml

@@ -90,7 +90,7 @@ jobs:
     needs:
       - build
     runs-on: windows-2025
-    timeout-minutes: 15
+    timeout-minutes: 180
     strategy:
       fail-fast: false
       matrix:
@@ -149,3 +149,12 @@ jobs:
           finally {
             Pop-Location
           }
+
+      # The smoke harness above refuses to run if any Firefox profile root
+      # exists on this same Windows runner. The manifest also uses an invalid
+      # option that returns before the BOF reads profiles.
+      - name: Exercise Sliver session and beacon BOF execution
+        uses: sliverarmory/sliver-test-bof@b38a09a226bf861a1e56e9dbe07838fe99138582
+        with:
+          manifest: .github/sliver-bof-e2e.yml
+          target: windows/${{ matrix.goarch }}

tests/reflektor/README.md

@@ -30,3 +30,9 @@ callbacks. It does **not** test NSS loading, SQLite rows, DPAPI, master-password
 handling, or decryption of actual Firefox data. Those operations cannot be
 covered by a package CI job without introducing credential-like fixtures and a
 substantially larger trusted runtime surface.
+
+After this smoke test passes on each Windows runner, the same workflow runs
+`sliver-test-bof` against Sliver session and beacon implants. Its manifest sends
+only a nonempty invalid mode, which the BOF rejects before loading SQLite or
+accessing Firefox profiles. This checks the Sliver/Reflektor BOF and argument
+path without extracting profile data.