mirror of
https://github.com/youssefnoob003/SindriKit
synced 2026-07-07 21:57:09 +00:00
sibouzitoun
1f87b142ba
- Implemented entropy-based pseudo-randomizer in snd_syscall_find_spoof_scan to prevent deterministic telemetry. - Randomized Fat Frame selection using the SSN hash, a static counter, and ASLR-dependent module/stack addresses. - Hardened spoof scanner to reject frames using Frame Registers (UWOP_SET_FPREG) to prevent RtlVirtualUnwind crashes. - Added strict bounds checking to cap Fat Frame sizes at 240 bytes, preventing MASM local stack corruption.Release v1.3.0: Stack Spoofing & Dynamic Fat Frame.
Primitives Domain
Foundation layer for SindriKit. Loaders, injection, and future domains rely on injected OS API tables and execution bridges documented here.
Important
Profile-aware OpSec: Evasive profiles use PEB walking and hash-based resolution (
snd_mod_nt,_sysbackends). Diagnostic profiles use Win32 APIs (snd_mod_win). Match backends to your deployment tier.
Subdomains
| Subdomain | Backends / focus |
|---|---|
| memory/ | snd_mem_win, snd_mem_nt, snd_mem_sys |
| modules/ | snd_mod_win, snd_mod_nt (no _sys) |
| mapping/ | snd_map_win, snd_map_nt, snd_map_sys, KnownDlls |
| process/ | snd_proc_win, snd_proc_nt, snd_proc_sys |
| syscalls/ | SSN resolution pipeline, configurable invoker (direct / indirect / spoofed) |
| execution/ | FFI (snd_ffi_execute), Heaven's Gate |
Contract definitions: include/sindri/primitives/os_api.h
Umbrella include: include/sindri/primitives.h
Table of Contents
- execution/ — dynamic FFI, WoW64 transition; syscall ASM co-located in source
- memory/ — local virtual memory (
win,nt,sys) - modules/ — local module load and export resolution
- mapping/ — section mapping and KnownDlls bootstrap
- process/ — remote process operations (injection consumer)
- syscalls/ — direct kernel invocation, cascading SSN resolvers