Sindrikit V1.3.0

SindriKit is a Windows evasion toolkit written in C. Building on the indirect syscall execution established in v1.2.0, this release extends the core engine into fully spoofed syscall execution. Version 1.3.0 introduces Call Stack Spoofing, allowing operators to dynamically hide the origin of their syscalls and seamlessly bypass EDR virtual unwinding telemetry.

Core Features (v1.3.0)

• Stack Spoofing: A natively integrated spoofing engine (snd_syscall_spoofed_invoke_asm) that uses a dynamic JMP-Trampoline. When a syscall executes, the return address points to a legitimate API inside kernel32.dll.
• Dynamic Fat Frame Discovery: The snd_syscall_find_spoof_scan engine manually parses the Exception Directory (.pdata) of the natively loaded kernel32.dll to analyze RUNTIME_FUNCTION and UNWIND_INFO structures. It locates functions that allocate massive shadow stacks (>= 120 bytes) to securely encapsulate the Trampoline gadget and syscall arguments, tricking RtlVirtualUnwind into parsing a perfectly intact, legitimate call chain without desynchronization.
• x86/x64 Architecture Support: Fully coordinated inline assembly support (invoke_spoofed_x64.asm and invoke_spoofed_x86.asm). The x64 stub satisfies both the physical CPU execution (returning to the trampoline) and the EDR's virtual unwinding engine (adding the calculated Fat Frame size to locate the spoofed caller), preventing stack misalignment and unwinder crashes.
• Pipeline Data Expansion: Expanded snd_syscall_entry_t and snd_syscall_args_t to include pSpoofAddr and dwSpoofFrameSize, facilitating stack calculations between the C-based .pdata parser and the MASM invocation stubs.

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

---

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.