reflektor

README

Reflektor

Reflektor is a Go library and CLI for loading shared libraries from bytes and invoking exported functions.

It exposes a stable root package (reflektor) so other projects can import it directly, while platform-specific loading is handled behind memmod.

Platform Support

OS	Architectures	Shared Library Format	Status	Loader Notes
Windows	386, amd64, arm64	PE (.dll)	Supported	In-memory PE loader
Darwin	amd64, arm64	Mach-O (.dylib, bundle)	Supported	Dyld4 root-image loader with system dependencies registered through public dyld; supports no-cgo builds and avoids temp-file legacy NS APIs.
Linux	386, amd64, arm64	ELF (.so)	Supported	Pure Go in-memory ELF loader (maps PT_LOAD segments, applies relocations, resolves externals from runtime modules/dlsym); no memfd, no /dev/shm, no temp-file disk writes.
Other	-	-	Unsupported	Returns an explicit unsupported-platform error.

Public API

Import path:

import "github.com/sliverarmory/reflektor"

Example:

payload := []byte{}

lib, err := reflektor.LoadLibrary(payload)
if err != nil {
    return err
}
defer lib.Close()

if err := lib.CallExport("StartW"); err != nil {
    return err
}

You can also load from a path:

lib, err := reflektor.LoadLibraryFile("./payload.dylib")

CLI

The CLI is in /Users/moloch/git/reflektor/cli and uses Cobra.

Build:

go build -o reflektor ./cli

Usage:

./reflektor <shared-library-path> [--call-export StartW]

--call-export defaults to StartW.

Behavior Notes

• CallExport is designed for zero-argument exports.
• Reflektor normalizes common symbol naming differences where possible (for example underscore-prefixed forms).
• The root reflektor.Library interface is intentionally small: CallExport() and Close().

Test Data And Validation

C test shared libraries are generated from:

• /Users/moloch/git/reflektor/testdata/c/basic.c

The Rust HTTPS fixture is built from /Users/moloch/git/reflektor/testdata/rust. It exports StartW, performs a bounded GET https://example.com/ through libcurl on Darwin/Linux or WinHTTP on Windows, and records ok:200 after receiving a non-empty successful response. The fixture is dependency-free Rust (no_std) so it does not require unsupported thread-local runtime state from the in-memory loaders.

Build test shared libraries for the full matrix:

./testdata/build_c_shared_libs.sh

Run tests:

go test ./...

The Rust fixture test requires Cargo with Rust 1.94.0 and outbound HTTPS access. Linux also requires the libcurl development package so the fixture can link against the system TLS client.

Linux cross-arch Docker harness:

• /Users/moloch/git/reflektor/testdata/docker/linux-memmod.Dockerfile
• /Users/moloch/git/reflektor/testdata/docker/run-linux-memmod-matrix.sh

Repository Layout

• /Users/moloch/git/reflektor/reflektor.go: root importable package (reflektor).
• /Users/moloch/git/reflektor/memmod: OS-specific loader backends.
• /Users/moloch/git/reflektor/cli: CLI entrypoint.
• /Users/moloch/git/reflektor/testdata: portable shared-library fixtures and build/test harnesses.

Documentation

Index

• Variables
• type Library
  • func LoadLibrary(data []byte) (*Library, error)
  • func LoadLibraryFile(path string) (*Library, error)
  • func (library *Library) CallExport(name string) error
  • func (library *Library) Close() error

Variables

var ErrLibraryClosed = errors.New("reflektor: library is closed")

Types

type Library

type Library struct {
	// contains filtered or unexported fields
}

func LoadLibrary

func LoadLibrary(data []byte) (*Library, error)

LoadLibrary loads a shared library image from memory.

func LoadLibraryFile

func LoadLibraryFile(path string) (*Library, error)

LoadLibraryFile loads a shared library image from disk into memory.

func (*Library) CallExport

func (library *Library) CallExport(name string) error

CallExport resolves and calls a zero-argument exported function.

func (*Library) Close

func (library *Library) Close() error

Close releases library resources.