mirror of
https://github.com/youssefnoob003/SindriKit
synced 2026-07-07 21:57:09 +00:00
sibouzitoun
da52e28ca5
- Implemented native Call Stack Spoofing with a coordinated JMP-Trampoline - Added dynamic .pdata Exception Directory parsing to discover Fat Frames (>= 120 bytes) - Added x86 & x64 spoofed MASM stubs with synchronized EDR unwinder offset logic
1.6 KiB
1.6 KiB
Primitives Domain
Foundation layer for SindriKit. Loaders, injection, and future domains rely on injected OS API tables and execution bridges documented here.
Important
Profile-aware OpSec: Evasive profiles use PEB walking and hash-based resolution (
snd_mod_nt,_sysbackends). Diagnostic profiles use Win32 APIs (snd_mod_win). Match backends to your deployment tier.
Subdomains
| Subdomain | Backends / focus |
|---|---|
| memory/ | snd_mem_win, snd_mem_nt, snd_mem_sys |
| modules/ | snd_mod_win, snd_mod_nt (no _sys) |
| mapping/ | snd_map_win, snd_map_nt, snd_map_sys, KnownDlls |
| process/ | snd_proc_win, snd_proc_nt, snd_proc_sys |
| syscalls/ | SSN resolution pipeline, configurable invoker (direct / indirect / spoofed) |
| execution/ | FFI (snd_ffi_execute), Heaven's Gate |
Contract definitions: include/sindri/primitives/os_api.h
Umbrella include: include/sindri/primitives.h
Table of Contents
- execution/ — dynamic FFI, WoW64 transition; syscall ASM co-located in source
- memory/ — local virtual memory (
win,nt,sys) - modules/ — local module load and export resolution
- mapping/ — section mapping and KnownDlls bootstrap
- process/ — remote process operations (injection consumer)
- syscalls/ — direct kernel invocation, cascading SSN resolvers