From f7d17fde33a2ec9800a7499fcafc6a31935111c6 Mon Sep 17 00:00:00 2001 From: sibouzitoun Date: Mon, 29 Jun 2026 16:42:33 +0100 Subject: [PATCH] Fix: loader nowinapi poc wasn't parsing the ntdll before setting it for syscall resolution. --- README.md | 2 +- docs/architecture/README.md | 8 ++++---- pocs/loader_nowinapi/main.c | 23 +++++++++++++++++++---- 3 files changed, 24 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 86418a1..9fa3984 100644 --- a/README.md +++ b/README.md @@ -71,7 +71,7 @@ Just two lines for your tool to inherit all of SindriKit's capabilities: PE pars │ snd_memory_api_t -> alloc · free · protect │ │ snd_module_api_t -> load_library · get_proc_address · ... │ │ snd_process_api_t -> open · alloc_remote · write · protect · thread │ - │ [ future tables ] -> thread · object · ... │ + │ [ future tables ] -> thread · object · ... │ ├──────────────────┬──────────────────────┬──────────────────────────────────┤ │ Win32 Profile │ Native Profile │ Bring Your Own Mechanic │ │ VirtualAlloc │ NtAllocateVirtual │ Driver · ROP · Exotic │ diff --git a/docs/architecture/README.md b/docs/architecture/README.md index 117dae1..0ab16b1 100644 --- a/docs/architecture/README.md +++ b/docs/architecture/README.md @@ -9,19 +9,19 @@ Design patterns, execution models, and telemetry constraints governing SindriKit ``` ┌─────────────────────────────────────────────────────────────┐ -│ Application / implant / PoC │ +│ Application / implant / PoC │ └───────────────────────────┬─────────────────────────────────┘ ▼ ┌─────────────────────────────────────────────────────────────┐ -│ Domains: loaders · injection · (future) evasion │ +│ Domains: loaders · injection · (future) evasion │ └───────────────────────────┬─────────────────────────────────┘ ▼ ┌─────────────────────────────────────────────────────────────┐ -│ Primitives + execution (DI tables, syscalls, FFI) │ +│ Primitives + execution (DI tables, syscalls, FFI) │ └───────────────────────────┬─────────────────────────────────┘ ▼ ┌─────────────────────────────────────────────────────────────┐ -│ Parsers · Common │ +│ Parsers · Common │ └─────────────────────────────────────────────────────────────┘ ``` diff --git a/pocs/loader_nowinapi/main.c b/pocs/loader_nowinapi/main.c index dfe3ff5..723e45e 100644 --- a/pocs/loader_nowinapi/main.c +++ b/pocs/loader_nowinapi/main.c @@ -1,5 +1,3 @@ -#include "sindri/primitives/syscalls.h" - #include #include #include @@ -116,13 +114,30 @@ int main(int argc, char *argv[]) { // First Method: Disk Loading snd_buffer_t ntdll_buf = {0}; + snd_ldr_pe_ctx_t ntdll_ctx = {0}; status = snd_disk_buffer_load("C:\\Windows\\System32\\ntdll.dll", &ntdll_buf); if (SND_FAILED(status)) { goto cleanup; } - ntdll = ntdll_buf.data; + ntdll_ctx.mem_api = &snd_mem_win; + ntdll_ctx.mod_api = &snd_mod_nt; + ntdll_ctx.raw_source = &ntdll_buf; + + status = snd_pe_parse(ntdll_ctx.raw_source, FALSE, &ntdll_ctx.pe); + if (SND_FAILED(status)) { + goto cleanup; + } + + ntdll_ctx.stage = SND_STAGE_PARSED; + + status = snd_ldr_pe_allocate_and_copy_image(&ntdll_ctx); + if (SND_FAILED(status)) { + goto cleanup; + } + + ntdll = ntdll_ctx.target.local_base; // Second Method: PEB Walking /* @@ -146,7 +161,7 @@ int main(int argc, char *argv[]) { snd_syscall_strategy_set(snd_syscall_resolve_ssn_scan); snd_syscall_strategy_add(snd_syscall_resolve_ssn_sort); - ctx.mem_api = &snd_mem_nt; + ctx.mem_api = &snd_mem_sys; ctx.mod_api = &snd_mod_nt; printf("[+] Loading payload into memory: %s\n", file_path);