[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-93193":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":15,"stars7d":15,"stars30d":16,"stars90d":15,"forks30d":15,"starsTrendScore":15,"compositeScore":17,"rankGlobal":10,"rankLanguage":10,"license":18,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":19,"hasPages":19,"topics":21,"createdAt":10,"pushedAt":10,"updatedAt":26,"readmeContent":27,"aiSummary":28,"trendingCount":15,"starSnapshotCount":15,"syncStatus":14,"lastSyncTime":29,"discoverSource":30},93193,"SindriKit","youssefnoob003\u002FSindriKit","youssefnoob003","A foundational C library for building operationally credible offensive capabilities","",null,"C",59,3,2,0,8,42.61,"MIT License",false,"main",[22,23,24,25],"cybersecurity","exploit-development","infosec","windows-internals","2026-07-22 04:02:08","\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Fbanner.png\" width=\"100%\">\n\u003C\u002Fp>\n\n\u003Ch1 align=\"center\">SindriKit\u003C\u002Fh1>\n\n\u003Cp align=\"center\">\n  \u003Cstrong>Offensive Development Deserves Better Architecture.\u003C\u002Fstrong>\u003Cbr>\n  \u003Cem>A C library for building offensive capabilities.\u003C\u002Fem>\n\u003C\u002Fp>\n\n---\n\n## Core Concept\n\nMost offensive utilities hardcode their execution mechanics inside the technique's logic. A reflective loader doesn't just map an image; it maps it using a specific, hardcoded chain of `VirtualAlloc` or native NTAPI calls. When an EDR starts monitoring that specific chain, you are forced to rewrite the entire tool.\n\nSindriKit solves this by enforcing a separation of concerns via interface abstraction tables:\n\n1. **The Technique Logic:** (e.g., loaders, injections, patchers) deals with state tracking and data orchestration. It has no knowledge of how memory is allocated or how threads are created.\n2. **The Execution Mechanics:** (e.g., Win32 API, Native NTAPI, Direct Syscalls) are inside independent API tables and injected into the technique at runtime.\n\nBy shifting execution mechanics to runtime function pointers, you can swap your entire strategy from Win32 calls to raw direct syscalls with a single line of code—without changing your payload execution logic.\n\n---\n\n## Design Architecture\n\n* **Decoupled Execution Profiles:** Swap underlying memory, module, and thread manipulation behaviors via function pointer tables without breaking the calling technique.\n* **Cascading Syscall Fallbacks:** Pluggable SSN resolvers (`snd_syscall_resolve_ssn_scan`, `snd_syscall_resolve_ssn_sort`) with a priority chain — swap or extend strategies without touching domain code.\n* **Compile-Time Obfuscation:** String and API hashing algorithms (DJB2, FNV1A) can be swapped globally via CMake. Compiling automatically randomizes the global seed to alter static signatures.\n* **Release Builds:** A silent tier strips all diagnostic strings, file descriptors, and tracking frames from the final binary, reducing your static footprint to bare primitives.\n\n---\n\n## Integrating SindriKit\n\n```cmake\ncmake_minimum_required(VERSION 3.16)\nproject(MyTool C ASM_MASM)\n\nset(SND_BUILD_PAYLOADS  OFF    CACHE BOOL   \"\")\nset(SND_ENABLE_DEBUG    OFF    CACHE BOOL   \"\")\nset(SND_HASH_ALGO      \"DJB2\"  CACHE STRING \"\")\nset(SND_RANDOMIZE_SEED  ON     CACHE BOOL   \"\")\n\nadd_subdirectory(libs\u002FSindriKit)\n\nadd_executable(my_tool src\u002Fmain.c)\ntarget_link_libraries(my_tool PRIVATE sindri::engine)\n```\n\n```sh\ncmake -B build && cmake --build build --config Release\n```\n\nJust two lines for your tool to inherit all of SindriKit's capabilities: PE parsing, syscall resolution, reflective loading...\n\n---\n\n## The Engine\n\n### API Abstraction Layer\n\n```\n        ┌────────────────────────────────────────────────────────────────────────────┐\n        │                          ANY OFFENSIVE INTENT                              │\n        │    Loader · Injector · Spoofer · Patcher · Bypasser · Harvester · ...      │\n        ├────────────────────────────────────────────────────────────────────────────┤\n        │                     SINDRIKIT API ABSTRACTION LAYER                        │\n        │      snd_memory_api_t  ->  alloc · free · protect                          │\n        │      snd_module_api_t  ->  load_library · get_proc_address · ...           │\n        │      snd_process_api_t ->  open · alloc_remote · write · protect · thread  │\n        │      [ future tables ] ->  thread · object · ...                           │\n        ├──────────────────┬──────────────────────┬──────────────────────────────────┤\n        │   Win32 Profile  │    Native Profile    │    Bring Your Own Mechanic       │\n        │  VirtualAlloc    │  NtAllocateVirtual   │  Driver · ROP · Exotic           │\n        │  LoadLibraryA    │  PEB Walk + EAT      │  Operator-defined functions      │\n        └──────────────────┴──────────────────────┴──────────────────────────────────┘\n```\n\nIn practice, this means every domain follows the same contract:\n\n```c\n\u002F\u002F Reflective loader\nsnd_ldr_pe_ctx_t ctx = {0};\nctx.raw_source = &payload;\nctx.mem_api    = &snd_mem_win;   \u002F\u002F or snd_mem_nt \u002F snd_mem_sys\nctx.mod_api    = &snd_mod_win;   \u002F\u002F or snd_mod_nt\nsnd_ldr_pe_prepare_image(&ctx);\nsnd_ldr_pe_execute_image(&ctx);\n\n\u002F\u002F Classic injection\nsnd_inj_ctx_t inj = {0};\ninj.target_pid = 1337;\ninj.payload    = &shellcode;\ninj.proc_api   = &snd_proc_sys;  \u002F\u002F or snd_proc_win \u002F snd_proc_nt\nsnd_inj_classic_shell(&inj);\nsnd_inj_cleanup(&inj);\n```\n\n### Cascading Syscall Pipeline\n\nSindriKit treats syscall resolution as an injectable mechanic, stacking strategies in priority order. The engine falls through until one succeeds:\n\n```c\nsnd_syscall_set_ntdll(clean_ntdll);\nsnd_syscall_set_resolver(snd_syscall_resolve_ssn_scan);\nsnd_syscall_add_resolver(snd_syscall_resolve_ssn_sort);\nsnd_syscall_set_invoker(snd_syscall_direct_invoke_asm);\n\u002F\u002F or for indirect syscalls:\n\u002F\u002F snd_syscall_set_invoker(snd_syscall_indirect_invoke_asm);\n\u002F\u002F snd_syscall_set_gadget_finder(snd_syscall_find_gadget_scan);\n```\n\nThe invoker is decoupled from SSN resolution — switch between direct and indirect syscalls without modifying domain code. Indirect invocation jumps to a legitimate NTDLL gadget, keeping the syscall return address within `ntdll.dll`.\n\n### Compile-Time Algorithm Agility\n\nEvery API name and module string is removed from the final binary at compile time via a single CMake variable:\n\n```cmake\nset(SND_HASH_ALGO \"FNV1A\")  # or DJB2 recomputes everything automatically\nset(SND_RANDOMIZE_SEED ON)  # generates a fresh 32-bit seed on next configure\n```\n\nEach hash is computed with a randomly generated seed (if `SND_RANDOMIZE_SEED=ON`). Static footprint shifts completely between compilations without touching a line of C.\n\n### Architecture-Aware Dynamic FFI\n\nA custom MASM assembly bridge for arbitrary runtime function invocation. x64 builds follow the Microsoft x64 calling convention precisely (shadow space, register argument placement, stack alignment). x86 builds push arguments in reverse order with support for both `cdecl` and `stdcall` targets.\n\n### Bounds-Checked PE Parser\n\nA unified PE32\u002FPE32+ parser with an `is_mapped` flag that correctly handles both raw on-disk images and memory-mapped views. Every data directory access is validated against tracked buffer bounds before dereferencing. Export resolution supports forwarder chains up to depth 4 with hash-based lookup.\n\nTested against:\n- 40+ core test combinations targeting edge-case EXEs, DLLs, bad arguments, missing exports, and TLS callbacks across x86 and x64.\n- 100+ dynamic PE mutations generated by the `pe_mutator` module: zeroed section names, integer overflows, invalid `e_lfanew` bounds, mangled imports.\n- Full Corkami corpus: cleanly loads valid samples, cleanly rejects malformed ones without crashing across 99% of the samples.\n\n### State-Tracked Domain Contexts\n\nEvery offensive operation is managed through a discrete context structure with stage enumeration. Operations can be paused between stages for sleep obfuscation or staged deployment, resumed cleanly, and inspected for the exact failure point down to the subsystem and reason.\n\n---\n\n## The API Design Philosophy\n\nBootstrap the syscall pipeline once (typical pattern):\n\n```c\nPVOID clean_ntdll = NULL;\nsnd_om_knowndll_map(&snd_map_nt, L\"ntdll.dll\", &clean_ntdll);\nsnd_syscall_set_ntdll(clean_ntdll);\nsnd_syscall_set_resolver(snd_syscall_resolve_ssn_scan);\nsnd_syscall_add_resolver(snd_syscall_resolve_ssn_sort);\nsnd_syscall_set_invoker(snd_syscall_direct_invoke_asm);\n\u002F\u002F or for indirect syscalls:\n\u002F\u002F snd_syscall_set_invoker(snd_syscall_indirect_invoke_asm);\n\u002F\u002F snd_syscall_set_gadget_finder(snd_syscall_find_gadget_scan);\n```\n\nThe invoker is decoupled from SSN resolution — switch between direct and indirect syscalls without modifying domain code. Indirect invocation jumps to a legitimate NTDLL gadget, keeping the syscall return address within `ntdll.dll`.\n\nSwap execution profile with one assignment:\n\n```c\nctx.mem_api = &snd_mem_win;   \u002F\u002F diagnostic\nctx.mem_api = &snd_mem_nt;    \u002F\u002F NT stubs via PEB + EAT\nctx.mem_api = &snd_mem_sys;   \u002F\u002F direct syscalls (pipeline required)\n```\n\nModule resolution follows the same pattern (`snd_mod_win` vs `snd_mod_nt`). There is no syscall-backed module backend — imports use PEB walk + EAT even in full `_sys` profiles.\n\n---\n\n## Build Tiers\n\n### Debug Tier — `SND_ENABLE_DEBUG=ON`\n\nFor local development. `snd_status_t` expands to include `file`, `line`, and a 128-byte `context` string buffer. `SND_ERR_CTX` and `SND_DEBUG_PRINT` emit state machine transitions, parsed PE field values, and syscall resolution outcomes. Use `SND_USE_PRINTF=ON` to route output to `stdout` instead of the debug console.\n\n### Silent Tier — `SND_ENABLE_DEBUG=OFF`\n\nThe standard deployment configuration for operational binaries. Every diagnostic string, file reference, and line number compiles away completely. `snd_status_t` collapses to two integers. Nothing else.\n\n```cmake\nset(SND_ENABLE_DEBUG   OFF   CACHE BOOL   \"\")\nset(SND_BUILD_PAYLOADS OFF   CACHE BOOL   \"\")\nset(SND_RANDOMIZE_SEED ON    CACHE BOOL   \"\")\nset(SND_USE_DEFAULTS   ON    CACHE BOOL   \"\")\nset(SND_HASH_ALGO    \"DJB2\"  CACHE STRING \"\")\nadd_subdirectory(vendor\u002FSindriKit)\ntarget_link_libraries(my_tool PRIVATE sindri::engine)\n```\n\n---\n\n## Documentation\n\nFull reference under [`docs\u002F`](docs\u002FREADME.md):\n\n- **[Getting Started](docs\u002Fgetting_started\u002F)** — CMake, build tiers, DI bootstrap, first loader\u002Finjection workflow\n- **[Architecture](docs\u002Farchitecture\u002F)** — Dependency injection, state machines, status system\n- **[Primitives](docs\u002Fdomains\u002Fprimitives\u002F)** — Memory, modules, process, mapping, syscalls, execution (FFI)\n- **[Loaders](docs\u002Fdomains\u002Floaders\u002F)** — Reflective PE pipeline\n- **[Injection](docs\u002Fdomains\u002Finjection\u002F)** — Classic shellcode and PE injection\n- **[Parsers](docs\u002Fparsers\u002F)** — PE and env (PEB) subdomains\n- **[Common](docs\u002Fcommon\u002F)** — CRT-free helpers, buffers, hashing, status\n- **[Examples & PoCs](docs\u002Fexamples\u002F)** — `loader_winapi`, `loader_nowinapi`, `inject_pe`, `inject_shell`, `heavens_gate`\n- **[Tests](docs\u002Ftests\u002F)** — Integration runner, PE mutator\n\n*Planned: **[Evasion](docs\u002Fdomains\u002Fevasion\u002F)** domain.*\n\n---\n\n## Disclaimer\n\n**SindriKit is built for educational, research, and authorized Red Teaming purposes only.** For the full legal disclaimer and information regarding OpSec considerations, see the [Security Policy](SECURITY.md).\n\n---\n\n## Support the Project\n\nSindriKit is open-source and built for the community. If this framework saved you development time or assisted in your research, consider supporting independent offensive R&D:\n\n* **BTC:** `bc1qsm7dsdsqmlwcw3f7uarxgx0mlu8tlxnyd7y2gz`\n\n---\n\n## License\n\n[MIT](LICENSE)\n\n---\n\n\u003Cp align=\"center\">\n  \u003Cimg src=\"assets\u002Ftitle.png\" width=\"100%\">\n\u003C\u002Fp>\n","SindriKit 是一个面向红队与漏洞利用开发的 C 语言基础库，旨在提升攻击性工具的可维护性与绕过能力。其核心通过接口抽象表实现技术逻辑（如反射加载、进程注入）与执行机制（Win32 API、NTAPI、直接系统调用）的解耦，支持运行时动态切换执行路径；提供级联系统调用号解析、编译期字符串\u002FAPI哈希（DJB2\u002FFNV1A）、种子随机化及静默发布构建等安全增强特性。适用于需长期演进、对抗EDR\u002FAV检测的Windows平台渗透工具开发场景。","2026-07-12 02:30:09","CREATED_QUERY"]