mirror of
https://github.com/youssefnoob003/SindriKit
synced 2026-07-07 21:57:09 +00:00
Release v1.2.0: Indirect Syscalls & Pipeline Decoupling
- Implemented fully decoupled direct and indirect syscall invocation - Added dynamic PEB-based gadget scanning (syscall; ret / sysenter) - Added x86 & x64 inline MASM stubs with proper stack frame alignment - Introduced SND_USE_DEFAULTS compile-time OpSec macro for lean payload compilation - Extensive documentation across all primitives and examples
This commit is contained in:
@@ -57,8 +57,8 @@ Loaders and injection PoCs use KnownDlls to bootstrap clean `ntdll` for syscall
|
||||
|
||||
```
|
||||
include/sindri/loaders/
|
||||
├── reflective/ ← implemented (snd_ldr_pe_ctx_t)
|
||||
└── <technique>/ ← future, technique-specific context + engine + chain
|
||||
├── reflective/ <- implemented (snd_ldr_pe_ctx_t)
|
||||
└── <technique>/ <- future, technique-specific context + engine + chain
|
||||
```
|
||||
|
||||
Each technique owns its context struct, stage enum, engine functions, and chain orchestrator.
|
||||
|
||||
@@ -169,8 +169,12 @@ Typical sequence before `snd_mem_sys` / `snd_proc_sys`:
|
||||
PVOID clean_ntdll = NULL;
|
||||
snd_om_knowndll_map(&snd_map_nt, L"ntdll.dll", &clean_ntdll);
|
||||
snd_syscall_set_ntdll(clean_ntdll);
|
||||
snd_syscall_strategy_set(snd_syscall_resolve_ssn_scan);
|
||||
snd_syscall_strategy_add(snd_syscall_resolve_ssn_sort);
|
||||
snd_syscall_set_resolver(snd_syscall_resolve_ssn_scan);
|
||||
snd_syscall_add_resolver(snd_syscall_resolve_ssn_sort);
|
||||
snd_syscall_set_invoker(snd_syscall_direct_invoke_asm);
|
||||
// or for indirect syscalls:
|
||||
// snd_syscall_set_invoker(snd_syscall_indirect_invoke_asm);
|
||||
// snd_syscall_set_gadget_finder(snd_syscall_find_gadget_scan);
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
Reference in New Issue
Block a user