Skip to content

Sindrikit V1.4.0

Choose a tag to compare

View all tags
@youssefnoob003 youssefnoob003 released this 13 Jul 18:03
v1.4.0
f8c003c

SindriKit is a Windows evasion toolkit written in C. This fifth major release introduces COFF Object Loading and Injection, enabling stealthy execution of Beacon Object Files (BOFs) locally and remotely.

Major Additions (v1.4.0)

  • COFF Loader Engine (snd_ldr_coff_load): Implemented a complete reflective loader for unlinked COFF object files. The engine supports zero-copy parsing, section allocation, and base relocation.
  • BOF Symbol Resolution (MODULE$Func): The engine dynamically resolves external OS APIs declared via the BOF standard convention. It does this by loading the target module and locating the export, dynamically building IAT entries and x64 trampolines on the fly.
  • Classic COFF Injection (snd_inj_classic_coff): A new high-level orchestrator that fuses a local COFF loading context with the shared remote injection context. The image is baked locally and marshaled across process boundaries alongside packed argument buffers for remote BOF execution.
  • COFF Parser Subdomain: A new robust, bounds-checked parser (include/sindri/parsers/coff/) has been introduced for COFF headers, section headers, symbol tables, and string tables.
  • Test Infrastructure: Expanded the automated test runner to process .obj fixtures. Dedicated BOF integration payloads (test_coff_msgbox.c, test_coff_args.c) were added to validate external symbol resolution and argument parsing.

Warning

No Pre-Compiled Binaries
For Operational Security (OpSec) reasons, no pre-compiled binaries are provided. Please compile the framework and the bundled PoCs directly from source.

SindriKit is built exclusively for educational, research, and authorized Red Teaming purposes.

Assets 2
Loading