Release v1.2.0: Indirect Syscalls & Pipeline Decoupling

- Implemented fully decoupled direct and indirect syscall invocation
- Added dynamic PEB-based gadget scanning (syscall; ret / sysenter)
- Added x86 & x64 inline MASM stubs with proper stack frame alignment
- Introduced SND_USE_DEFAULTS compile-time OpSec macro for lean payload compilation
- Extensive documentation across all primitives and examples
This commit is contained in:
sibouzitoun
2026-06-29 19:31:15 +01:00
parent f7d17fde33
commit b7d3cf717c
43 changed files with 727 additions and 173 deletions
+3 -3
View File
@@ -12,8 +12,8 @@ Keeping these separate reflects the code layout:
```
include/sindri/parsers/
├── pe/ buffer-backed PE format parsing
└── env/ live process environment structures
├── pe/ <- buffer-backed PE format parsing
└── env/ <- live process environment structures
```
NT layout definitions (`SND_PEB`, `SND_LDR_DATA_TABLE_ENTRY`, etc.) live in `include/sindri/internal/nt/peb.h`. Env parsers consume these layouts; they do not duplicate Windows SDK headers to avoid pulling in monitored imports.
@@ -50,7 +50,7 @@ Loaded modules are tracked in three linked lists inside `SND_PEB_LDR_DATA`:
```
InLoadOrderModuleList
InMemoryOrderModuleList used by SindriKit
InMemoryOrderModuleList <- used by SindriKit
InInitializationOrderModuleList
```