MmMapIoSpace Returns NULL: Tracing the Real Kernel Mechanism Through ntoskrnl.exe

2026-07-29
MmMapIoSpace Returns NULL: Tracing the Real Kernel Mechanism Through ntoskrnl.exe image

Tracing exactly why MmMapIoSpace returns NULL on Windows 11 past the commonly cited cache-aliasing explanation and into undocumented page table ownership checks inside MiFillSystemPtes and MiGetPageTablePfnBuddyRaw.

Read more

SMAP is Pre-Disarmed: How a Stack Pivot That Shouldn't Work Revealed a Kernel-Wide Design Compromise

2026-08-11
SMAP is Pre-Disarmed: How a Stack Pivot That Shouldn't Work Revealed a Kernel-Wide Design Compromise image

I built a fake stack in user-mode memory and pivoted the kernel into it. SMAP should have thrown a #PF and blue-screened the box. Instead, I got SYSTEM. This is the three-experiment proof that Windows leaves its own guard down.

Read more

SindriKit 1.5.0: The SND_MORPH Mutation Engine

2026-07-20
SindriKit 1.5.0: The SND_MORPH Mutation Engine image

SindriKit 1.5.0 introduces structural and instruction-level polymorphism via the SND_MORPH engine to eradicate static signatures on every build.

Read more

SindriKit 1.4.0: Stealth Execution with COFF Object Loading and Injection

2026-07-13
SindriKit 1.4.0: Stealth Execution with COFF Object Loading and Injection image

How SindriKit's new COFF loader and injection orchestrator enable seamless execution of Beacon Object Files (BOFs) both locally and remotely.

Read more

SindriKit 1.3.0: Defeating EDR Telemetry with Dynamic Stack Spoofing

2026-07-06
SindriKit 1.3.0: Defeating EDR Telemetry with Dynamic Stack Spoofing image

How SindriKit implements dynamic Fat Frame discovery and JMP-Trampolines to defeat RtlVirtualUnwind and call-stack telemetry.

Read more

SindriKit 1.2.0: Decoupling Syscalls & Call-Stack Evasion

2026-06-29
SindriKit 1.2.0: Decoupling Syscalls & Call-Stack Evasion image

Indirect syscalls land in SindriKit: dynamic gadget scanning, decoupled execution invokers, and compile-time OpSec macros.

Read more

SindriKit 1.1.0: Injection Without Rewriting Your Implant

2026-06-28
SindriKit 1.1.0: Injection Without Rewriting Your Implant image

Classic remote injection lands in SindriKit: shellcode in a handful of lines, full PE mapping in one chain call, and a cleaner syscall resolver pipeline.

Read more

SindriKit: Offensive Development Deserves Better Architecture

2026-06-20
SindriKit: Offensive Development Deserves Better Architecture image

Offensive C development is an unmaintainable mess (well in most cases). SindriKit applies years of software engineering to the problem.

Read more
*