mirror of
https://github.com/youssefnoob003/SindriKit
synced 2026-07-07 21:57:09 +00:00
sibouzitoun
b7d3cf717c
- Implemented fully decoupled direct and indirect syscall invocation - Added dynamic PEB-based gadget scanning (syscall; ret / sysenter) - Added x86 & x64 inline MASM stubs with proper stack frame alignment - Introduced SND_USE_DEFAULTS compile-time OpSec macro for lean payload compilation - Extensive documentation across all primitives and examples
1.6 KiB
1.6 KiB
Primitives Domain
Foundation layer for SindriKit. Loaders, injection, and future domains rely on injected OS API tables and execution bridges documented here.
Important
Profile-aware OpSec: Evasive profiles use PEB walking and hash-based resolution (
snd_mod_nt,_sysbackends). Diagnostic profiles use Win32 APIs (snd_mod_win). Match backends to your deployment tier.
Subdomains
| Subdomain | Backends / focus |
|---|---|
| memory/ | snd_mem_win, snd_mem_nt, snd_mem_sys |
| modules/ | snd_mod_win, snd_mod_nt (no _sys) |
| mapping/ | snd_map_win, snd_map_nt, snd_map_sys, KnownDlls |
| process/ | snd_proc_win, snd_proc_nt, snd_proc_sys |
| syscalls/ | SSN resolution pipeline, configurable invoker (direct / indirect) |
| execution/ | FFI (snd_ffi_execute), Heaven's Gate |
Contract definitions: include/sindri/primitives/os_api.h
Umbrella include: include/sindri/primitives.h
Table of Contents
- execution/ — dynamic FFI, WoW64 transition; syscall ASM co-located in source
- memory/ — local virtual memory (
win,nt,sys) - modules/ — local module load and export resolution
- mapping/ — section mapping and KnownDlls bootstrap
- process/ — remote process operations (injection consumer)
- syscalls/ — direct kernel invocation, cascading SSN resolvers