Skip to content

Sindrikit V1.3.1

Choose a tag to compare

View all tags
@youssefnoob003 youssefnoob003 released this 07 Jul 10:30
v1.3.1
1f87b14

SindriKit is a Windows evasion toolkit written in C. This is an OpSec and stability patch for the v1.3.0 Stack Spoofing release, addressing deterministic telemetry patterns and preventing potential unwinder desynchronization.

OpSec Enhancements (v1.3.1)

  • Fat Frame Entropy: In previous versions, the spoof scanner would deterministically pick the first valid Fat Frame it found in kernel32.dll. If an implant made 10 syscalls in a row, all 10 call stacks would appear to originate from the exact same function. To defeat statistical telemetry analysis, snd_syscall_find_spoof_scan now utilizes an internal entropy calculation (derived from the target function's SSN hash, a static counter, and ASLR-dependent memory addresses) to skip a randomized number of valid frames. This dynamically shifts the spoofed call stack on every execution.
  • RtlVirtualUnwind Hardening: The scanner now actively rejects any Fat Frames whose .pdata specifies the use of a Frame Register (UWOP_SET_FPREG). Because our MASM stub relies on standard RSP-based unwinding, using a Frame Register-based Fat Frame would cause RtlVirtualUnwind to read a garbage register value and crash the virtual stack trace.
  • Stack Overflow Prevention: Fat Frame sizes are now strictly capped to 240 bytes. This guarantees that when the virtual unwinder calculates the caller's return address offset, the offset will safely remain within the 256-byte local stack allocation provisioned by the invoke_spoofed_x64.asm MASM stub.

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.

Assets 2
Loading