admin/youssefnoob003-SindriKit
1
0
Fork 0
mirror of https://github.com/youssefnoob003/SindriKit synced 2026-07-07 21:57:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Release v1.2.0: Indirect Syscalls & Pipeline Decoupling

Browse Source 
- Implemented fully decoupled direct and indirect syscall invocation
- Added dynamic PEB-based gadget scanning (syscall; ret / sysenter)
- Added x86 & x64 inline MASM stubs with proper stack frame alignment
- Introduced SND_USE_DEFAULTS compile-time OpSec macro for lean payload compilation
- Extensive documentation across all primitives and examples
This commit is contained in:
sibouzitoun
2026-06-29 19:31:15 +01:00
parent f7d17fde33
commit b7d3cf717c
43 changed files with 727 additions and 173 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/sindri/primitives/syscalls.h
+27 -3
View File
@@ -11,6 +11,10 @@ SND_BEGIN_EXTERN_C
#define SND_MAX_SYSCALLS 500
#define SND_MAX_SYS_NAME_LEN 256
#ifndef SND_USE_DEFAULTS
#define SND_USE_DEFAULTS 0
#endif
/**
* @brief Syscall entry structure holding the address, hash, and syscall number.
*/
@@ -18,6 +22,7 @@ typedef struct {
PVOID pAddress;
DWORD dwHash;
WORD wSystemCall;
PVOID pSyscallAddr;
} snd_syscall_entry_t;
/**
@@ -36,6 +41,9 @@ typedef struct {
PVOID arg9;
PVOID arg10;
PVOID arg11;
// Placed at the end to prevent altering the memory offsets of args 1-11
// inside the existing Direct ASM stub (invoke_x64.asm).
PVOID sys_addr;
} snd_syscall_args_t;
/**
@@ -43,22 +51,37 @@ typedef struct {
* Any custom or future gate can be plugged into the engine if it matches this.
*/
typedef snd_status_t (*snd_syscall_resolver_t)(PVOID ntdll_base, DWORD func_hash, snd_syscall_entry_t *entry_out);
typedef NTSTATUS (*snd_syscall_invoker_t)(snd_syscall_args_t *args);
typedef snd_status_t (*snd_syscall_gadget_finder_t)(snd_syscall_entry_t *entry);
snd_status_t snd_syscall_resolve_ssn_scan(PVOID ntdll, DWORD func_hash, snd_syscall_entry_t *entry_out);
snd_status_t snd_syscall_resolve_ssn_sort(PVOID ntdll, DWORD func_hash, snd_syscall_entry_t *entry_out);
snd_status_t snd_syscall_find_gadget_scan(snd_syscall_entry_t *entry);
#if SND_USE_DEFAULTS
#define SND_SYSCALL_INVOKER_DEFAULT snd_syscall_indirect_invoke_asm
#define SND_SYSCALL_GADGET_FINDER_DEFAULT snd_syscall_find_gadget_scan
#define SND_SYSCALL_RESOLVER_DEFAULT snd_syscall_resolve_ssn_scan
#else
#define SND_SYSCALL_INVOKER_DEFAULT NULL
#define SND_SYSCALL_GADGET_FINDER_DEFAULT NULL
#define SND_SYSCALL_RESOLVER_DEFAULT NULL
#endif
/**
* @brief Sets the primary syscall resolution strategy using a function pointer.
* @param resolver The resolver function to use as the primary strategy.
*/
void snd_syscall_strategy_set(snd_syscall_resolver_t resolver);
void snd_syscall_set_resolver(snd_syscall_resolver_t resolver);
/**
* @brief Adds a fallback syscall resolution strategy to the pipeline.
* @param resolver The fallback resolver function to add.
* @return SND_OK on success, or an error if the pipeline is full.
*/
snd_status_t snd_syscall_strategy_add(snd_syscall_resolver_t resolver);
snd_status_t snd_syscall_add_resolver(snd_syscall_resolver_t resolver);
void snd_syscall_set_invoker(snd_syscall_invoker_t invoker);
void snd_syscall_set_gadget_finder(snd_syscall_gadget_finder_t finder);
/**
* @brief Sets the global base address of the ntdll.dll module.
@@ -81,7 +104,8 @@ snd_status_t snd_syscall_resolve(DWORD func_hash, snd_syscall_entry_t *entry_out
* @param args Pointer to the syscall arguments structure.
* @return The NTSTATUS returned by the syscall.
*/
extern NTSTATUS snd_syscall_invoke_asm(snd_syscall_args_t *args);
extern NTSTATUS snd_syscall_direct_invoke_asm(snd_syscall_args_t *args);
extern NTSTATUS snd_syscall_indirect_invoke_asm(snd_syscall_args_t *args);
SND_END_EXTERN_C