mirror of
https://github.com/youssefnoob003/SindriKit
synced 2026-07-07 21:57:09 +00:00
sibouzitoun
aea2eb6cfb
- Implement complete cross-process injection engine via snd_inj_ctx_t - Track explicit remote_entry_point for safe thread hijacking and PE execution - Refactor standalone syscall resolvers into a unified pipeline (scan/sort) - Perfect status code system by purging generic fallbacks in favor of highly-specific, domain-aware error codes - Fix minor pointer validation and parsing bugs in the reflective loader
2.5 KiB
2.5 KiB
Parsers Domain
In-memory interpretation of Windows file formats and runtime environment structures. Split into PE and Env subdomains mirroring include/sindri/parsers/.
Both are included by sindri/parsers.h.
Important
Parsers are read-only interpreters except where explicitly documented (e.g.
snd_pe_apply_relocations,snd_pe_resolve_importswrite into a caller-owned mapped image). They do not load DLLs or allocate OS resources.
Subdomains
| Subdomain | Umbrella | Purpose |
|---|---|---|
| pe/ | sindri/parsers/pe.h |
PE headers, exports, imports, relocations, TLS |
| env/ | sindri/parsers/env.h |
PEB module walking, local PEB access |
How parsers fit the framework
┌─────────────────────────────────────┐
│ Domains (loaders, primitives) │
└──────────────┬──────────────────────┘
│
┌────────────────────┼────────────────────┐
▼ ▼ ▼
snd_pe_parse snd_pe_get_export_* snd_peb_get_module_*
│ │ │
└────────────────────┴────────────────────┘
│
Parsers (PE + Env)
- Reflective loaders — validate, relocate, resolve imports, TLS
- NT/syscall primitives — resolve
Nt*fromntdllwithoutGetProcAddress snd_mod_nt— delegates PEB walk and EAT parse to env + PE parsers
Table of Contents
PE
- pe/README.md — overview and header map
- pe/techniques.md — format, bounds, export/import/reloc mechanics
- pe/api_reference.md — full public PE API
Env
- env/README.md — overview and scope
- env/techniques.md — PEB layout, module walking
- env/api_reference.md — full public env API