mirror of https://github.com/youssefnoob003/SindriKit synced 2026-07-07 21:57:09 +00:00

Files

T

sibouzitoun aea2eb6cfb Release v1.1.0: Process Injection & Architecture Hardening

- Implement complete cross-process injection engine via snd_inj_ctx_t
- Track explicit remote_entry_point for safe thread hijacking and PE execution
- Refactor standalone syscall resolvers into a unified pipeline (scan/sort)
- Perfect status code system by purging generic fallbacks in favor of highly-specific, domain-aware error codes
- Fix minor pointer validation and parsing bugs in the reflective loader

2026-06-28 14:14:54 +01:00

2.2 KiB

Raw Blame History

PoC: heavens_gate

Location: pocs/heavens_gate/

Demonstrates transitioning from a 32-bit WoW64 process into native 64-bit execution using the 0x33 segment selector (Heaven's Gate). Executes 64-bit shellcode and retrieves the 64-bit return value in RAX.

What it demonstrates

WoW64 environment detection (snd_is_wow64)
64-bit execution from a 32-bit host via snd_hg_execute_64
Native x64 compile rejection at runtime

Walkthrough

1. Validate environment

Requires x86 build on a 64-bit Windows host under WoW64:

#if defined(_WIN64)
    return SND_STATUS_ARCH_MISMATCH;
#elif defined(_WIN32)
    if (!snd_is_wow64()) {
        return SND_STATUS_ARCH_MISMATCH;
    }
#endif

2. Allocate 64-bit shellcode

Demo shellcode loads a magic value into RAX and returns:

mov rax, 0x1122334455667788
ret

unsigned char shellcode64[] = {
    0x48, 0xB8, 0x88, 0x77, 0x66, 0x55, 0x44, 0x33, 0x22, 0x11,
    0xC3
};

PVOID pExec = VirtualAlloc(NULL, sizeof(shellcode64),
                             MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
memcpy(pExec, shellcode64, sizeof(shellcode64));

Note

Win32 allocation for demo simplicity. Production use would use snd_mem_* backends.

3. Execute via Heaven's Gate

UINT64       result = 0;
snd_status_t status = snd_hg_execute_64(
    (UINT64)(ULONG_PTR)pExec,
    0, NULL, &result
);
// result == 0x1122334455667788 on success

Note

The PoC prints failure messages but main returns SND_SUCCESS (0) on the WoW64 path regardless of snd_hg_execute_64 outcome. Use debug output or patch main for status-driven exit codes.

Building

Requires an x86 toolchain target:

cmake -B build -A Win32 -DSND_BUILD_PAYLOADS=ON
cmake --build build --config Release

Output: build/pocs/heavens_gate/Release/heavens_gate.exe

Excluded when SND_CRTLESS=ON (only loader_noCRT_nowinapi builds).

OpSec impact

Bypasses 32-bit userland hooks during the transition. The PoC uses visible VirtualAlloc for the demo shellcode buffer.

2.2 KiB Raw Blame History