mirror of
https://github.com/youssefnoob003/SindriKit
synced 2026-07-07 21:57:09 +00:00
sibouzitoun
b7d3cf717c
- Implemented fully decoupled direct and indirect syscall invocation - Added dynamic PEB-based gadget scanning (syscall; ret / sysenter) - Added x86 & x64 inline MASM stubs with proper stack frame alignment - Introduced SND_USE_DEFAULTS compile-time OpSec macro for lean payload compilation - Extensive documentation across all primitives and examples
Env Parser
Runtime interpretation of Windows process environment structures — primarily the PEB and loader module lists. Headers under include/sindri/parsers/env/, aggregated by include/sindri/parsers/env.h.
NT layouts (SND_PEB, SND_LDR_DATA_TABLE_ENTRY, …) live in include/sindri/internal/nt/peb.h. The env parser uses these layouts without Win32 API calls.
Header map
| Header | Role |
|---|---|
peb.h |
Local PEB access, module list walking (string and hash) |
Source map
| Source | Implements |
|---|---|
src/parsers/env/peb.c |
PEB module resolution |
Scope
| Area | Status | Notes |
|---|---|---|
| PEB module walking | Implemented | snd_peb_get_module_base, snd_peb_get_module_base_hash |
| Local PEB accessor | Implemented | snd_peb_get_local (segment register read) |
| TEB access | Planned | Thread Environment Block helpers |
| Process parameters | Planned | Command line, image path, environment block |
Table of Contents
- techniques.md — PEB layout, module list walking, hash lookup
- api_reference.md — full public env API
Related documentation
- Parsers domain
- PE parser — EAT parsing used with env resolvers
- Internal NT layouts