admin/youssefnoob003-SindriKit
1
0
Fork 0
mirror of https://github.com/youssefnoob003/SindriKit synced 2026-07-07 21:57:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix: Stop trying to execute LdrLoadDll from unmapped NTDLLs

Browse Source 
Decouples native_load_library from the global NTDLL state. Calling LdrLoadDll on a raw disk image obviously segfaults because the loader locks aren't initialized. Always walking the PEB for this fixes it.
This commit is contained in:
sibouzitoun
2026-06-22 20:17:44 +01:00
parent 5e26626615
commit 04be820979
6 changed files with 12 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/domains/loaders/techniques.md
+1 -1
View File
@@ -57,7 +57,7 @@ When operating in native mode, SindriKit needs a clean `ntdll.dll` to extract SS
At boot, the Session Manager (`smss.exe`) creates pre-mapped, read-only section objects for core system DLLs under the `\KnownDlls` Object Manager directory. These sections are snapshots taken before any userland security software is initialized. Opening `\KnownDlls\ntdll.dll` via `NtOpenSection` and mapping it into the current process with `NtMapViewOfSection` yields a pristine image whose text section has never been touched by EDR hooks.
The base address of this clean mapping is then fed directly to `snd_set_ntdll()` (from `sindri/primitives/ntdll.h`), ensuring that all subsequent SSN resolution and native module lookups operate on unmodified stubs.
The base address of this clean mapping is then fed directly to `snd_set_ntdll()` (from `sindri/primitives/ntdll.h`), ensuring that all subsequent SSN resolution operate on unmodified stubs.
```c
PVOID clean_ntdll = NULL;