Sindrikit V1.5.0

SindriKit is a Windows evasion toolkit written in C. This major release introduces the Pre-Compilation Polymorphic Mutation Engine (SND_MORPH), enabling automated source-level and instruction-level polymorphism to eliminate static signatures across C source files, assembly stubs, and internal data structures before the final compilation pass.

Major Additions (v1.5.0)

• Polymorphic Build Pipeline (SND_MORPH): Implemented a staging engine controlled via CMake. When enabled, the orchestrator automatically clones the codebase into a temporary directory, applies mutation passes sequentially, and redirects the compiler pipeline to generate a structurally unique binary every single build.
• C Source Mutator & Call Graph Splitting (junk_c.py): Injects volatile-backed opaque predicates and diverse control-flow shapes (switches, loops, and conditions) that survive dead-code elimination passes. Features a localized generator that inserts randomized, math-heavy dead functions to drastically complicate basic block analysis and call graph mapping.
• Metamorphic Assembly Engine (masm_mutate.py): Introduces instruction-level polymorphism for hand-written MASM stubs. The engine uses strict flag-neutral instruction substitutes (such as register-isolated lea and mov alterations) combined with multi-byte functional NOP interleaving to alter binary code signatures safely without corrupting status flags (EFLAGS) or conditional jumps.
• Pragma-Driven Structural Polymorphism (struct_shuffle.py): Dynamically scrambles the internal memory layout and variable offsets of framework structures isolated by opt-in sentinel macros (SND_SHUFFLE_START / SND_SHUFFLE_END). The parser safely tracks atomic blocks and nested scopes to randomize alignment layouts while preventing compilation breaks.

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source using the CMake pipeline.

---

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.

Sindrikit V1.4.0

SindriKit is a Windows evasion toolkit written in C. This fifth major release introduces COFF Object Loading and Injection, enabling stealthy execution of Beacon Object Files (BOFs) locally and remotely.

Major Additions (v1.4.0)

• COFF Loader Engine (snd_ldr_coff_load): Implemented a complete reflective loader for unlinked COFF object files. The engine supports zero-copy parsing, section allocation, and base relocation.
• BOF Symbol Resolution (MODULE$Func): The engine dynamically resolves external OS APIs declared via the BOF standard convention. It does this by loading the target module and locating the export, dynamically building IAT entries and x64 trampolines on the fly.
• Classic COFF Injection (snd_inj_classic_coff): A new high-level orchestrator that fuses a local COFF loading context with the shared remote injection context. The image is baked locally and marshaled across process boundaries alongside packed argument buffers for remote BOF execution.
• COFF Parser Subdomain: A new robust, bounds-checked parser (include/sindri/parsers/coff/) has been introduced for COFF headers, section headers, symbol tables, and string tables.
• Test Infrastructure: Expanded the automated test runner to process .obj fixtures. Dedicated BOF integration payloads (test_coff_msgbox.c, test_coff_args.c) were added to validate external symbol resolution and argument parsing.

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

---

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.

Sindrikit V1.3.1

SindriKit is a Windows evasion toolkit written in C. This is an OpSec and stability patch for the v1.3.0 Stack Spoofing release, addressing deterministic telemetry patterns and preventing potential unwinder desynchronization.

OpSec Enhancements (v1.3.1)

• Fat Frame Entropy: In previous versions, the spoof scanner would deterministically pick the first valid Fat Frame it found in kernel32.dll. If an implant made 10 syscalls in a row, all 10 call stacks would appear to originate from the exact same function. To defeat statistical telemetry analysis, snd_syscall_find_spoof_scan now utilizes an internal entropy calculation (derived from the target function's SSN hash, a static counter, and ASLR-dependent memory addresses) to skip a randomized number of valid frames. This dynamically shifts the spoofed call stack on every execution.
• RtlVirtualUnwind Hardening: The scanner now actively rejects any Fat Frames whose .pdata specifies the use of a Frame Register (UWOP_SET_FPREG). Because our MASM stub relies on standard RSP-based unwinding, using a Frame Register-based Fat Frame would cause RtlVirtualUnwind to read a garbage register value and crash the virtual stack trace.
• Stack Overflow Prevention: Fat Frame sizes are now strictly capped to 240 bytes. This guarantees that when the virtual unwinder calculates the caller's return address offset, the offset will safely remain within the 256-byte local stack allocation provisioned by the invoke_spoofed_x64.asm MASM stub.

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

---

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.

Sindrikit V1.3.0

SindriKit is a Windows evasion toolkit written in C. Building on the indirect syscall execution established in v1.2.0, this release extends the core engine into fully spoofed syscall execution. Version 1.3.0 introduces Call Stack Spoofing, allowing operators to dynamically hide the origin of their syscalls and seamlessly bypass EDR virtual unwinding telemetry.

Core Features (v1.3.0)

• Stack Spoofing: A natively integrated spoofing engine (snd_syscall_spoofed_invoke_asm) that uses a dynamic JMP-Trampoline. When a syscall executes, the return address points to a legitimate API inside kernel32.dll.
• Dynamic Fat Frame Discovery: The snd_syscall_find_spoof_scan engine manually parses the Exception Directory (.pdata) of the natively loaded kernel32.dll to analyze RUNTIME_FUNCTION and UNWIND_INFO structures. It locates functions that allocate massive shadow stacks (>= 120 bytes) to securely encapsulate the Trampoline gadget and syscall arguments, tricking RtlVirtualUnwind into parsing a perfectly intact, legitimate call chain without desynchronization.
• x86/x64 Architecture Support: Fully coordinated inline assembly support (invoke_spoofed_x64.asm and invoke_spoofed_x86.asm). The x64 stub satisfies both the physical CPU execution (returning to the trampoline) and the EDR's virtual unwinding engine (adding the calculated Fat Frame size to locate the spoofed caller), preventing stack misalignment and unwinder crashes.
• Pipeline Data Expansion: Expanded snd_syscall_entry_t and snd_syscall_args_t to include pSpoofAddr and dwSpoofFrameSize, facilitating stack calculations between the C-based .pdata parser and the MASM invocation stubs.

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

---

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.

Sindrikit V1.2.0

SindriKit is a Windows evasion toolkit written in C. Building on the cross-process execution established in v1.1.0, this release extends the core engine into decoupled indirect syscall execution. Version 1.2.0 introduces a highly evasive syscall invocation pipeline, allowing operators to seamlessly switch between direct and indirect syscall execution without rewriting core logic.

Core Features (v1.2.0)

• Indirect Syscall Invocation: A fully decoupled syscall engine supporting both direct inline execution and indirect gadget jumping. Operators can dynamically choose to bounce their execution flow through legitimate NTDLL memory, defeating EDR call-stack telemetry and user-mode API hooking simultaneously.
• Dynamic Gadget Finder: The snd_syscall_find_gadget_scan seamlessly scans the natively loaded ntdll.dll inside the PEB to dynamically locate OS-transition stubs (syscall; ret on x64, or the sysenter transition on x86) preventing issues with disk-loaded or unmapped images.
• x86/x64 Architecture Support: Full inline assembly support (invoke_indirect_x64.asm and invoke_indirect_x86.asm), correctly aligning shadow spaces and strictly adhering to calling conventions (like 16-byte stack alignment on x64) to prevent instability upon return.
• Compile-Time OpSec Agility: Introduced SND_USE_DEFAULTS, a CMake flag that securely configures the execution pipeline out-of-the-box. Handled as a compile-time macro rather than C pointers, it successfully severs the dependency tree, ensuring that unused scanners and ASM stubs are completely stripped out by the linker when the flag is disabled.
• Pipeline Convergence Overhaul: The older, monolithic snd_syscall_strategy_set mechanic is fully retired in favor of an independent, two-tier architecture: the SSN Resolver (Scan vs Sort) and the Invoker (Direct vs Indirect).

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

What's Next

With our decoupled syscall pipeline now hardened for complete evasion, future updates will shift focus to extending our execution and defensive capabilities:

• Advanced Injection Vectors (APC Queuing, Thread Hijacking, Process Hollowing)
• Defensive Evasion (ETW Patching, AMSI bypasses, Stack Spoofing, Sleep Obfuscation)

---

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.

Sindrikit V1.1.0

SindriKit is a Windows evasion toolkit written in C. Building on the Dependency Injection architecture established in v1.0, this release extends the core engine into cross-process domains. Version 1.1.0 introduces a complete process injection engine that composes with the existing reflective loader, allowing full PE deployment across process boundaries without rewriting core logic.

Core Features (v1.1.0)

• Remote Process Injection: An injection engine supporting both shellcode and full PE delivery. Operations are governed by the a state machine to strictly track cross-process execution through discrete stages.
• Loader & Injector Composability: Inter op between the local reflective loader (snd_ldr_pe_ctx_t) and the shared injection context. Operators can map and resolve PEs locally with direct syscalls, then seamlessly deploy the baked image into remote targets.
• Targeted Entry Execution: The injection state safely tracks and triggers thread execution precisely at the dynamically relocated remote_entry_point, eliminating blind shellcode jumps and inaccurate thread starts.
• Syscall Pipeline Convergence: The scattered resolvers (Hell's Gate, Halo's Gate, Tartarus) has been refactored into a unified, two-tier priority pipeline. Register snd_syscall_resolve_ssn_scan (direct extraction) with a seamless fallback to snd_syscall_resolve_ssn_sort (export table sorting).
• Process & Mapping Primitives: New OS abstractions (snd_process_api_t and snd_mapping_api_t) allow cross-process mechanics to swap freely between standard Win32 APIs and direct syscalls with a single pointer change.
• Enhanced Safe Execution States: Hardened internal logic to prevent dangling pointers and guarantee correct state rollback during failing import and PE parsing procedures, ensuring absolute stability against aggressive EDR mitigations.

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

What's Next

With cross-process execution established as a unified domain, future updates will build upon this foundation to introduce:

• Advanced Injection Vectors (APC Queuing, Thread Hijacking, Process Hollowing)
• Defensive Evasion (ETW Patching, AMSI bypasses, Stack Spoofing, Sleep Obfuscation)

---

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.

SindriKit v1.0.1 (Hotfix)

SindriKit v1.0.1 (Hotfix)

A rapid patch to address an edge-case in payload execution discovered shortly after the v1.0.0 drop. All users should pull this version as their new baseline.

Bugs Fixed

• Native Loader State: Resolved an access violation in native_load_library when executing complex payloads or resolving stateful APIs (e.g., MessageBox via user32.dll).
• Under the Hood: The framework previously relied on the global NTDLL getter for this operation, causing a segfault if the engine was running off an unmapped disk or KnownDlls image (due to uninitialized OS loader locks). This function now correctly isolates its state and forces a dynamic PEB walk to execute LdrLoadDll safely.

(Note: No other core primitives, signatures, or APIs were modified in this patch).

SindriKit v1.0.0 (Initial Public Release)

SindriKit is a Windows evasion toolkit written in C. This first release provides the core engine, focusing on a Dependency Injection architecture that separates offensive techniques from underlying OS execution mechanics. By programming against a unified API abstraction, operators can switch execution profiles (e.g., standard Win32 APIs vs. direct syscalls) without modifying their core payload logic.

Core Features (v1.0)

• Syscall Resolution: Dynamic SSN resolution with a cascading fallback pipeline supporting Hell's Gate, Halo's Gate, Tartarus' Gate, and VelesReek.
• Kernel-State Bootstrapping: Maps unhooked system modules directly from the \KnownDlls Object Manager directory to provide clean execution bases.
• Algorithm Agility: Compile-time API hashing (DJB2 or FNV1A). Hashing algorithms can be swapped across the entire project via a single CMake variable.
• PE Parser: A custom, bounds-checked PE32/PE32+ parser with explicit state tracking (is_mapped) for handling raw and memory-mapped files safely.
• Dynamic FFI: Custom MASM assembly bridges for executing arbitrary functions while adhering to strict x64 and x86 calling conventions.
• Reflective Loader (PoC Domain): A fully functional 8-stage in-memory PE loader built on the framework, capable of executing entirely via direct syscalls with zero Win32 API surface.
• State-Tracked Contexts: Offensive operations are governed by discrete state machines, enabling tasks to be paused safely (e.g., for sleep obfuscation) and cleanly resumed.

Build and OpSec Constraints

• Strict Compilation: The build system enforces /W4 /WX to catch implicit truncations and pointer mismatches at compile time.
• SILENT Tier: Compiling with SND_ENABLE_DEBUG=OFF removes all state-machine prints and error contexts, ensuring no framework strings end up in the .rdata section.
• CRT Independence: The SND_CRTLESS=ON flag builds the engine without the C Standard Library, relying on compiler-intrinsic fallbacks.

Documentation

Full documentation on the architecture, build constraints, and PoC walkthroughs is available in the Documentation Index in the repository root.

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

What's Next

The v1.0 engine serves as the base for future updates, which will introduce dedicated domains for:

• Process Injection (Hollowing, Thread Hijacking, APC Queuing)
• Defensive Evasion (ETW Patching, AMSI bypasses, Stack Spoofing, Sleep Obfuscation)

---

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.