Add curated lab samples

samples/README.md

@@ -0,0 +1,455 @@
+# StackSentry Sample Corpus
+
+This folder contains a curated lab corpus for validating StackSentry detections. These files are intentionally suspicious and should be executed only in a controlled VM or malware-analysis lab.
+
+Run every command from the repository root after building StackSentry.
+
+Source build:
+
+```powershell
+.\build.ps1
+```
+
+The call stack values below are representative StackSentry stack summaries captured at the sensitive DLL-load event. ASLR, Windows build, loaded modules, and timeout timing can change offsets and occasionally the exact lower frames, but the suspicious pattern should remain the same.
+
+## Recommended Starting Commands
+
+First safe pass:
+
+```powershell
+.\build\StackSentry64.exe /run sample.exe /quick /no-target-output /timeout 5000
+```
+
+Strong default for suspicious loaders:
+
+```powershell
+.\build\StackSentry64.exe /run sample.exe /max /no-target-output /timeout 10000
+```
+
+Anti-evasion hunting bundle:
+
+```powershell
+.\build\StackSentry64.exe /run sample.exe /max /hunt /no-target-output /timeout 15000
+```
+
+Hidden proxy/gadget origin:
+
+```powershell
+.\build\StackSentry64.exe /run sample.exe /max /regtrace /no-target-output /timeout 10000
+```
+
+Network API use attribution is explicit and not part of `/hunt`:
+
+```powershell
+.\build\StackSentry64.exe /run sample.exe /max /hunt /network-use-trace /no-target-output /timeout 30000
+```
+
+Remote loader that injects into another process:
+
+```powershell
+.\build\StackSentry64.exe /run loader.exe /max /follow-remote /regtrace /no-target-output /timeout 15000
+```
+
+Keep the target alive after timeout for debugger inspection:
+
+```powershell
+.\build\StackSentry64.exe /run target.exe /max /no-target-output /timeout 10000 /keep-alive
+```
+
+Full stack in one line, without repeated-frame compression:
+
+```powershell
+.\build\StackSentry64.exe /run target.exe /max /inline-stack /no-target-output /timeout 10000
+```
+
+Full stack frame-by-frame with module offsets:
+
+```powershell
+.\build\StackSentry64.exe /run target.exe /max /full-stack /no-target-output /timeout 10000
+```
+
+## Files
+
+| File | Purpose |
+| --- | --- |
+| `sample_00_pic_runner.exe` | Runs a PIC payload passed after `--`. |
+| `sample_01_pic_loadlibrary_proxy_runner.exe` | Runs a PIC payload after preloading `nvwgf2umx.dll` as a local gadget carrier. |
+| `payload_01_pic_loadlibrary_proxy.bin` | PIC LoadLibrary proxy payload used with `sample_01_pic_loadlibrary_proxy_runner.exe`. |
+| `sample_02_ldrloaddll_direct.exe` | Direct `LdrLoadDll` origin-trace test. |
+| `sample_03_text_section_proxy.exe` | Shellcode/proxy execution from executable image `.text`. |
+| `sample_04_text_section_code_cave.exe` | Code-cave gadget / modified image detection test. |
+| `sample_05_dll_payload_host.exe` | Host that loads `LoadInText.dll`, then runs a DLL-mode payload. |
+| `LoadInText.dll` | Dependency for `sample_05_dll_payload_host.exe`; keep this exact name. |
+| `sample_06_veh_context_origin.exe` | VEH-context origin-correlation test. |
+| `sample_07_silentmoon_direct.exe` | SilentMoonwalk-style stack spoofing, one-shot DLL load. |
+| `sample_08_silentmoon_synthetic.exe` | Synthetic stack variant intended to remove the obvious unbacked tail frame. |
+| `payload_09_silentmoon_rdi.bin` | Donut/RDI payload for SilentMoonwalk coverage. |
+| `payload_10_silentmoon_rdi_synthetic.bin` | Donut/RDI synthetic-stack payload for stronger stack-spoofing coverage. |
+| `sample_11_silentmoon_rdi_threaded.exe` | Threaded SilentMoonwalk/RDI harness. |
+| `payload_12_byoud_rdi.bin` | Donut/RDI BYOUD payload. |
+| `byoud.dll` | Dependency for the BYOUD payload; keep this exact name. |
+| `sample_13_massdriver_dispatch.exe` | MassDriver-like cross-thread function dispatch test. |
+| `sample_14_threadpool_chain.exe` | Threadpool callback-chain proxy test. |
+| `sample_15_remote_victim.exe` | Remote-injection victim process. |
+| `sample_16_remote_shellcode_injector.exe` | Injector for `sample_15_remote_victim.exe`; pass the victim PID. |
+| `sample_17_network_reuse_probe.exe` | Reuses an already-loaded network DLL from private executable memory. |
+| `nvwgf2umx.dll` | Support DLL used by gadget-search payloads on machines without a suitable local module. |
+
+## Exact Test Commands
+
+### 1. PIC LoadLibrary Proxy Payload
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_01_pic_loadlibrary_proxy_runner.exe /max /regtrace /no-target-output /timeout 25000 -- .\samples\payload_01_pic_loadlibrary_proxy.bin
+```
+
+Expected DLL-load stack:
+
+```text
+wininet:
+  kernelbase.dll|kernelbase.dll|nvwgf2umx.dll|ntdll.dll|ntdll.dll|kernel32.dll|ntdll.dll
+```
+
+Expected attribution:
+
+```text
+source: register_trace_thread_start kind=thread_start_origin
+origin: Unbacked
+```
+
+### 2. Direct LdrLoadDll
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_02_ldrloaddll_direct.exe /max /regtrace /no-target-output /timeout 9000
+```
+
+Expected DLL-load stack:
+
+```text
+wininet.dll:
+  Unbacked
+```
+
+Expected attribution:
+
+```text
+source: execution_guard kind=proxy_transfer
+origin: sample_02_ldrloaddll_direct.exe
+```
+
+### 3. Image .text Proxy
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_03_text_section_proxy.exe /max /hunt /no-target-output /timeout 13000
+```
+
+Expected DLL-load stack:
+
+```text
+wininet:
+  kernelbase.dll|kernelbase.dll|nvwgf2umx.dll|ntdll.dll|ntdll.dll|kernel32.dll|ntdll.dll
+```
+
+Expected attribution:
+
+```text
+source: register_trace_thread_start kind=thread_start_origin
+origin: sample_03_text_section_proxy.exe
+```
+
+### 4. Image Code Cave / Modified Module
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_04_text_section_code_cave.exe /max /hunt /no-target-output /timeout 13000
+```
+
+Expected DLL-load stack:
+
+```text
+wininet:
+  kernelbase.dll|kernelbase.dll|BackedModified
+```
+
+Expected attribution:
+
+```text
+source: temporal_image_stomp kind=image_stomp_origin
+modified module: ucrtbased.dll or another writable code-cave target
+```
+
+### 5. DLL-Mode Payload Host
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_05_dll_payload_host.exe /max /regtrace /no-target-output /timeout 13000
+```
+
+Expected DLL-load stack:
+
+```text
+wininet:
+  kernelbase.dll|kernelbase.dll|nvwgf2umx.dll|ntdll.dll|ntdll.dll|kernel32.dll|ntdll.dll
+```
+
+Expected attribution:
+
+```text
+source: execution_guard kind=proxy_transfer
+origin: LoadInText.dll
+```
+
+### 6. VEH Context Origin
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_06_veh_context_origin.exe /regtrace /no-target-output /timeout 13000
+```
+
+This sample uses a VEH exception path to redirect `RIP` before the proxy DLL load. `/regtrace` tracks the dynamic executable transition and correlates the redirected RIP back to the origin that disappears from the final DLL-load stack.
+
+Expected DLL-load stack:
+
+```text
+wininet:
+  kernelbase.dll|kernelbase.dll|nvwgf2umx.dll|ntdll.dll|ntdll.dll|kernel32.dll|ntdll.dll
+```
+
+Expected attribution:
+
+```text
+source: veh_context kind=veh_rip_origin
+origin: VEH redirected RIP that is absent from the final DLL-load stack
+```
+
+### 7. SilentMoonwalk Direct
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_07_silentmoon_direct.exe /max /stack-audit /regtrace /no-target-output /timeout 9000
+```
+
+Expected DLL-load stack:
+
+```text
+wininet.dll:
+  kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|kernel32.dll|ntdll.dll
+```
+
+Expected detection:
+
+```text
+rules: stack_audit_return_frame_without_matching_call, sensitive_dll_load_origin_hidden_by_register_trace
+source: execution_guard kind=proxy_transfer
+```
+
+### 8. SilentMoonwalk Synthetic Stack
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_08_silentmoon_synthetic.exe /max /stack-audit /regtrace /no-target-output /timeout 9000
+```
+
+Expected DLL-load stack:
+
+```text
+ws2_32.dll:
+  kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|kernel32.dll|ntdll.dll
+```
+
+Expected detection:
+
+```text
+rules: return_address_without_plausible_callsite, stack_audit_return_frame_without_matching_call
+source: execution_guard kind=proxy_transfer
+```
+
+### 9. SilentMoonwalk RDI Payload
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_00_pic_runner.exe /max /stack-audit /regtrace /no-target-output /timeout 12000 -- .\samples\payload_09_silentmoon_rdi.bin
+```
+
+Expected DLL-load stacks:
+
+```text
+wininet.dll:
+  kernelbase.dll|kernelbase.dll|Unbacked
+
+mscoree.dll:
+  kernelbase.dll|kernelbase.dll|Unbacked
+
+ws2_32.dll:
+  kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|Unbacked
+```
+
+The `wininet.dll` and `mscoree.dll` loads usually come from the Donut/RDI bootstrap. The `ws2_32.dll` load is the SilentMoonwalk test stage.
+
+### 10. SilentMoonwalk RDI Synthetic Stack
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_00_pic_runner.exe /max /stack-audit /regtrace /memory-audit /no-target-output /timeout 12000 -- .\samples\payload_10_silentmoon_rdi_synthetic.bin
+```
+
+Expected DLL-load stacks:
+
+```text
+wininet.dll:
+  kernelbase.dll|kernelbase.dll|Unbacked
+
+mscoree.dll:
+  kernelbase.dll|kernelbase.dll|Unbacked
+
+ws2_32.dll:
+  kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|kernel32.dll|ntdll.dll
+```
+
+This is one of the strongest screenshot samples because the final `ws2_32.dll` stack can look fully backed while StackSentry still attributes the hidden origin.
+
+### 11. Threaded SilentMoonwalk/RDI Harness
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_11_silentmoon_rdi_threaded.exe /max /stack-audit /regtrace /memory-audit /no-target-output /timeout 12000
+```
+
+Expected DLL-load stacks:
+
+```text
+wininet.dll:
+  kernelbase.dll|kernelbase.dll|Unbacked
+
+mscoree.dll:
+  kernelbase.dll|kernelbase.dll|Unbacked
+
+ws2_32.dll:
+  kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|kernelbase.dll|Unbacked
+```
+
+### 12. BYOUD RDI / Unwind Metadata Spoofing
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_00_pic_runner.exe /max /hunt /no-target-output /timeout 30000 -- .\samples\payload_12_byoud_rdi.bin
+```
+
+Expected bootstrap DLL-load stacks:
+
+```text
+wininet.dll:
+  kernelbase.dll|kernelbase.dll|Unbacked
+
+mscoree.dll:
+  kernelbase.dll|kernelbase.dll|Unbacked
+```
+
+Expected BYOUD target-stage DLL-load stack when the payload reaches the network DLL call:
+
+```text
+ws2_32.dll:
+  kernelbase.dll|kernelbase.dll|ntdll.dll|kernelbase.dll|kernel32.dll|ntdll.dll
+```
+
+Expected BYOUD findings:
+
+```text
+rules: byoud_runtime_function_unwind_hijack
+rules: byoud_unwind_info_tampered
+source: byoud_register_trace kind=byoud_hidden_loader_origin
+origin: byoud hidden loader context
+```
+
+`byoud_unwind_section_protection_changed` may also appear when the monitor observes the protection transition around unwind metadata, but the core proof for this sample is the runtime-function / unwind-info divergence plus the `ws2_32.dll` load attributed through `byoud_register_trace`.
+
+The BYOUD stage is more timing-sensitive than the smaller samples. If only the bootstrap loads appear, rerun with a longer timeout.
+
+### 13. MassDriver-Style Thread Message Dispatch
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_13_massdriver_dispatch.exe /max /dispatch-trace /regtrace /no-target-output /timeout 12000
+```
+
+Expected DLL-load stack:
+
+```text
+wininet.dll:
+  kernelbase.dll|kernelbase.dll|sample_13_massdriver_dispatch.exe|kernel32.dll|ntdll.dll
+```
+
+Expected dispatch trace:
+
+```text
+source: thread_message_dispatch kind=function_proxy_dispatch
+requester: Unbacked
+worker caller: sample_13_massdriver_dispatch.exe
+function: LoadLibraryA
+argument: wininet.dll
+```
+
+### 14. Threadpool Callback Chain
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_14_threadpool_chain.exe /max /threadpool-chain-trace /no-target-output /timeout 12000
+```
+
+Expected DLL-load stack:
+
+```text
+winhttp.dll:
+  kernelbase.dll|kernelbase.dll|wininet.dll|kernelbase.dll|ntdll.dll|kernelbase.dll|ntdll.dll|ntdll.dll|kernel32.dll|ntdll.dll
+```
+
+Expected attribution:
+
+```text
+source: threadpool_chain_context kind=threadpool_chain_context
+origin: sample_14_threadpool_chain.exe
+visible caller: wininet.dll or another clean gadget module
+```
+
+This sample requires `/threadpool-chain-trace`. `/hunt` does not enable the threadpool chain hooks by default, so a run without this flag may show the DLL load in external tools while StackSentry stays quiet.
+
+### 15. Remote Follow
+
+Start the victim first, capture its PID, then run the injector under StackSentry:
+
+```powershell
+$victim = Start-Process .\samples\sample_15_remote_victim.exe -PassThru
+.\build\StackSentry64.exe /run .\samples\sample_16_remote_shellcode_injector.exe /max /follow-remote /regtrace /no-target-output /timeout 18000 -- $($victim.Id)
+```
+
+Expected remote-follow telemetry:
+
+```text
+remote_follow:OpenProcess:<victim pid>
+remote_follow:NtCreateThreadEx:<victim pid>
+remote_follow:SetThreadContext:<victim pid>
+remote_follow:ResumeThread:<victim pid>
+```
+
+Optional DLL-load stack in the instrumented victim, when the injected payload reaches the network DLL load:
+
+```text
+wininet:
+  kernelbase.dll|kernelbase.dll|nvwgf2umx.dll|ntdll.dll|ntdll.dll|kernel32.dll|ntdll.dll
+```
+
+Clean up the victim if it is still running:
+
+```powershell
+Stop-Process -Id $victim.Id -Force
+```
+
+### 16. Network DLL Reuse From Private Executable Memory
+
+```powershell
+.\build\StackSentry64.exe /run .\samples\sample_17_network_reuse_probe.exe /max /network-use-trace /no-target-output /timeout 8000
+```
+
+Expected network-use stack:
+
+```text
+ws2_32.dll!getaddrinfo:
+  Unbacked
+```
+
+Expected detection:
+
+```text
+rules: network_api_called_from_unbacked_executable_memory
+caller: Unbacked
+```
+