admin/youssefnoob003-SindriKit
1
0
Fork 0
mirror of https://github.com/youssefnoob003/SindriKit synced 2026-07-07 21:57:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Release v1.3.0: Stack Spoofing & Dynamic Fat Frames

Browse Source 
- Implemented native Call Stack Spoofing with a coordinated JMP-Trampoline
- Added dynamic .pdata Exception Directory parsing to discover Fat Frames (>= 120 bytes)
- Added x86 & x64 spoofed MASM stubs with synchronized EDR unwinder offset logic
This commit is contained in:
sibouzitoun
2026-07-06 16:59:33 +01:00
parent b7d3cf717c
commit da52e28ca5
21 changed files with 498 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+11
View File
@@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
---
## [1.3.0] - 2026-07-06
Fourth major release. The framework introduces Call Stack Spoofing to defeat EDR virtual unwinding telemetry.
### Major Additions
- **Advanced Stack Spoofing (`snd_syscall_spoofed_invoke_asm`)**: Implemented full Call Stack Spoofing natively into the execution pipeline using a dynamic JMP-Trampoline.
- **Dynamic Fat Frame Discovery (`snd_syscall_find_spoof_scan`)**: Automatically parses the Exception Directory (`.pdata`) of `kernel32.dll` to locate functions with massive shadow stack allocations (>= 120 bytes). Embeds the syscall return gadget inside this frame, tricking `RtlVirtualUnwind` into parsing a perfectly intact, legitimate call chain without desynchronization.
- **Pipeline Overhaul**: Added `pSpoofAddr` and `dwSpoofFrameSize` to `snd_syscall_entry_t`. Added `snd_syscall_set_spoof_finder` to configure the spoof engine.
---
## [1.2.0] - 2026-06-29
Third major release. The framework introduces indirect syscalls and significantly improves the execution pipeline's flexibility and operator experience.