mirror of https://github.com/youssefnoob003/SindriKit synced 2026-07-07 21:57:09 +00:00

Files

T

sibouzitoun aea2eb6cfb Release v1.1.0: Process Injection & Architecture Hardening

- Implement complete cross-process injection engine via snd_inj_ctx_t
- Track explicit remote_entry_point for safe thread hijacking and PE execution
- Refactor standalone syscall resolvers into a unified pipeline (scan/sort)
- Perfect status code system by purging generic fallbacks in favor of highly-specific, domain-aware error codes
- Fix minor pointer validation and parsing bugs in the reflective loader

2026-06-28 14:14:54 +01:00

3.1 KiB

Raw Blame History

Loaders Domain

The loaders domain maps and executes code payloads in memory. Each loader technique defines its own context type and stage machine; techniques are organized under subdirectories in include/sindri/loaders/.

Today only Reflective PE Loading is implemented (loaders/reflective/). Additional techniques (e.g. module stomping, transacted hollowing) will add parallel subdirectories with their own context structures — unlike injection, loader contexts are not shared across techniques.

Reflective vs. Injection

Aspect	Loaders	Injection
Context type	Per-technique (`snd_ldr_pe_ctx_t` today)	Shared (`snd_inj_ctx_t`)
Execution target	Local process (by default)	Remote process
Primary API table	`mem_api`, `mod_api`	`proc_api`
PE fixups	Full local pipeline	Local bake + remote write (`snd_inj_classic_pe`)

The Classic PE injection chain (snd_inj_classic_pe) reuses the reflective loader engine for local parse/reloc/import steps, then hands off to the injection domain for remote allocation and thread creation.

Header Map

Header	Role
`sindri/loaders.h`	Umbrella include (reflective today)
`sindri/loaders/reflective.h`	Reflective technique umbrella
`sindri/loaders/reflective/engine.h`	`snd_ldr_pe_ctx_t`, per-stage engine
`sindri/loaders/reflective/chain.h`	`snd_ldr_pe_prepare_image`, execute, detach

KnownDlls Bootstrapping

KnownDlls mapping is not part of the loaders domain. It lives in the mapping/object-manager primitives:

snd_om_knowndll_map() — sindri/primitives/object_manager.h
Mapping backends — snd_map_nt, snd_map_sys — mapping primitives

Loaders and injection PoCs use KnownDlls to bootstrap clean ntdll for syscall resolution before selecting _sys backends.

PoCs

PoC	Entry points	Profile
`pocs/loader_winapi/main.c`	`snd_ldr_pe_prepare_image`, `snd_ldr_pe_execute_image`	`snd_mem_win`, `snd_mod_win`
`pocs/loader_nowinapi/main.c`	same	`snd_mem_nt`, `snd_mod_nt` + syscall bootstrap
`pocs/loader_noCRT_nowinapi/main.c`	same	No CRT; `snd_mem_win`, `snd_mod_nt`, PEB `ntdll` bootstrap

Source map (reflective)

Source	Implements
`src/loaders/reflective/chain.c`	`snd_ldr_pe_prepare_image`, `execute_image`, `detach_image`
`src/loaders/reflective/engine.c`	Per-stage engine, section copy, page protection runs

techniques.md — Reflective PE pipeline, stage machine, protection model
api_reference.md — full reflective loader API

Planned techniques

include/sindri/loaders/
├── reflective/     ← implemented (snd_ldr_pe_ctx_t)
└── <technique>/    ← future, technique-specific context + engine + chain

Each technique owns its context struct, stage enum, engine functions, and chain orchestrator.

Injection domain — snd_inj_classic_pe reuses loader engine
Examples

3.1 KiB Raw Blame History