mirror of
https://github.com/youssefnoob003/SindriKit
synced 2026-07-07 21:57:09 +00:00
sibouzitoun
aea2eb6cfb
- Implement complete cross-process injection engine via snd_inj_ctx_t - Track explicit remote_entry_point for safe thread hijacking and PE execution - Refactor standalone syscall resolvers into a unified pipeline (scan/sort) - Perfect status code system by purging generic fallbacks in favor of highly-specific, domain-aware error codes - Fix minor pointer validation and parsing bugs in the reflective loader
Syscall Primitives
Direct syscall invocation bypasses hooked ntdll.dll stubs by resolving System Service Numbers (SSNs) and executing the syscall instruction from custom ASM stubs.
Header: include/sindri/primitives/syscalls.h
Implementation: src/primitives/execution/syscalls/
Warning
Bootstrap required: Call
snd_syscall_set_ntdll()and configure at least one strategy viasnd_syscall_strategy_set()beforesnd_syscall_resolve()._sysmemory/process/mapping backends depend on this pipeline.
How _sys primitives use syscalls
snd_mem_sys / snd_proc_sys / snd_map_sys
│
▼
snd_syscall_resolve(func_hash) ← cascading strategy chain
│
▼
snd_syscall_invoke_asm(&args) ← x64/x86 ASM stub
Function hashes come from sindri_hashes.h (build-generated, e.g. SND_HASH_NTALLOCATEVIRTUALMEMORY).
Resolution strategies
| Function | Source | Approach |
|---|---|---|
snd_syscall_resolve_ssn_scan |
syscalls_scan.c |
Read SSN from stub bytes; neighbor scan if hooked |
snd_syscall_resolve_ssn_sort |
syscalls_sort.c |
Build sorted Zw* export table; index = SSN |
Typical registration — scan first, sort as fallback:
snd_syscall_strategy_set(snd_syscall_resolve_ssn_scan);
snd_syscall_strategy_add(snd_syscall_resolve_ssn_sort);
Custom resolvers matching snd_syscall_resolver_t can be added to the chain (max 4 strategies).
Table of Contents
- pipeline.md — lifecycle from bootstrap to kernel transition
- engines.md — scan vs sort resolver internals
- api_reference.md — full public API
Related documentation
- Execution domain — shared
src/primitives/execution/layout - Mapping — KnownDlls bootstrap for clean
ntdll - Primitives domain