Skip to content

Sindrikit V1.1.0

Choose a tag to compare

View all tags
@youssefnoob003 youssefnoob003 released this 28 Jun 13:24
v1.1.0
aea2eb6

SindriKit is a Windows evasion toolkit written in C. Building on the Dependency Injection architecture established in v1.0, this release extends the core engine into cross-process domains. Version 1.1.0 introduces a complete process injection engine that composes with the existing reflective loader, allowing full PE deployment across process boundaries without rewriting core logic.

Core Features (v1.1.0)

  • Remote Process Injection: An injection engine supporting both shellcode and full PE delivery. Operations are governed by the a state machine to strictly track cross-process execution through discrete stages.
  • Loader & Injector Composability: Inter op between the local reflective loader (snd_ldr_pe_ctx_t) and the shared injection context. Operators can map and resolve PEs locally with direct syscalls, then seamlessly deploy the baked image into remote targets.
  • Targeted Entry Execution: The injection state safely tracks and triggers thread execution precisely at the dynamically relocated remote_entry_point, eliminating blind shellcode jumps and inaccurate thread starts.
  • Syscall Pipeline Convergence: The scattered resolvers (Hell's Gate, Halo's Gate, Tartarus) has been refactored into a unified, two-tier priority pipeline. Register snd_syscall_resolve_ssn_scan (direct extraction) with a seamless fallback to snd_syscall_resolve_ssn_sort (export table sorting).
  • Process & Mapping Primitives: New OS abstractions (snd_process_api_t and snd_mapping_api_t) allow cross-process mechanics to swap freely between standard Win32 APIs and direct syscalls with a single pointer change.
  • Enhanced Safe Execution States: Hardened internal logic to prevent dangling pointers and guarantee correct state rollback during failing import and PE parsing procedures, ensuring absolute stability against aggressive EDR mitigations.

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

What's Next

With cross-process execution established as a unified domain, future updates will build upon this foundation to introduce:

  • Advanced Injection Vectors (APC Queuing, Thread Hijacking, Process Hollowing)
  • Defensive Evasion (ETW Patching, AMSI bypasses, Stack Spoofing, Sleep Obfuscation)

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.

Assets 2
Loading