mirror of
https://github.com/youssefnoob003/SindriKit
synced 2026-07-07 21:57:09 +00:00
sibouzitoun
b7d3cf717c
- Implemented fully decoupled direct and indirect syscall invocation - Added dynamic PEB-based gadget scanning (syscall; ret / sysenter) - Added x86 & x64 inline MASM stubs with proper stack frame alignment - Introduced SND_USE_DEFAULTS compile-time OpSec macro for lean payload compilation - Extensive documentation across all primitives and examples
Parsers Domain
In-memory interpretation of Windows file formats and runtime environment structures. Split into PE and Env subdomains mirroring include/sindri/parsers/.
Both are included by sindri/parsers.h.
Important
Parsers are read-only interpreters except where explicitly documented (e.g.
snd_pe_apply_relocations,snd_pe_resolve_importswrite into a caller-owned mapped image). They do not load DLLs or allocate OS resources.
Subdomains
| Subdomain | Umbrella | Purpose |
|---|---|---|
| pe/ | sindri/parsers/pe.h |
PE headers, exports, imports, relocations, TLS |
| env/ | sindri/parsers/env.h |
PEB module walking, local PEB access |
How parsers fit the framework
┌─────────────────────────────────────┐
│ Domains (loaders, primitives) │
└──────────────┬──────────────────────┘
│
┌────────────────────┼────────────────────┐
▼ ▼ ▼
snd_pe_parse snd_pe_get_export_* snd_peb_get_module_*
│ │ │
└────────────────────┴────────────────────┘
│
Parsers (PE + Env)
- Reflective loaders — validate, relocate, resolve imports, TLS
- NT/syscall primitives — resolve
Nt*fromntdllwithoutGetProcAddress snd_mod_nt— delegates PEB walk and EAT parse to env + PE parsers
Table of Contents
PE
- pe/README.md — overview and header map
- pe/techniques.md — format, bounds, export/import/reloc mechanics
- pe/api_reference.md — full public PE API
Env
- env/README.md — overview and scope
- env/techniques.md — PEB layout, module walking
- env/api_reference.md — full public env API