Skip to content

Sindrikit V1.2.0

Choose a tag to compare

View all tags
@youssefnoob003 youssefnoob003 released this 29 Jun 18:34
v1.2.0
b7d3cf7

SindriKit is a Windows evasion toolkit written in C. Building on the cross-process execution established in v1.1.0, this release extends the core engine into decoupled indirect syscall execution. Version 1.2.0 introduces a highly evasive syscall invocation pipeline, allowing operators to seamlessly switch between direct and indirect syscall execution without rewriting core logic.

Core Features (v1.2.0)

  • Indirect Syscall Invocation: A fully decoupled syscall engine supporting both direct inline execution and indirect gadget jumping. Operators can dynamically choose to bounce their execution flow through legitimate NTDLL memory, defeating EDR call-stack telemetry and user-mode API hooking simultaneously.
  • Dynamic Gadget Finder: The snd_syscall_find_gadget_scan seamlessly scans the natively loaded ntdll.dll inside the PEB to dynamically locate OS-transition stubs (syscall; ret on x64, or the sysenter transition on x86) preventing issues with disk-loaded or unmapped images.
  • x86/x64 Architecture Support: Full inline assembly support (invoke_indirect_x64.asm and invoke_indirect_x86.asm), correctly aligning shadow spaces and strictly adhering to calling conventions (like 16-byte stack alignment on x64) to prevent instability upon return.
  • Compile-Time OpSec Agility: Introduced SND_USE_DEFAULTS, a CMake flag that securely configures the execution pipeline out-of-the-box. Handled as a compile-time macro rather than C pointers, it successfully severs the dependency tree, ensuring that unused scanners and ASM stubs are completely stripped out by the linker when the flag is disabled.
  • Pipeline Convergence Overhaul: The older, monolithic snd_syscall_strategy_set mechanic is fully retired in favor of an independent, two-tier architecture: the SSN Resolver (Scan vs Sort) and the Invoker (Direct vs Indirect).

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

What's Next

With our decoupled syscall pipeline now hardened for complete evasion, future updates will shift focus to extending our execution and defensive capabilities:

  • Advanced Injection Vectors (APC Queuing, Thread Hijacking, Process Hollowing)
  • Defensive Evasion (ETW Patching, AMSI bypasses, Stack Spoofing, Sleep Obfuscation)

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.

Assets 2
Loading