Sibouzitoun

Published a 4-part series on Windows 11 kernel exploitation (HEVD). Moves from classic stack overflows to data-only LPE primitives. Covers SMEP bypasses, thread state repair, LFH grooming (feng shui), npfs.sys weaponization, and DKOM token swapping. #malware #cybersecurity #windows

EDRs love static-fingerprinting your implants. So I added the SND_MORPH mutation engine to SindriKit v1.5.0 to deal with that. Full write-up & source: https://sibouzitoun.tech/articles/sindrikit-v1o5/ #Infosec #cybersecurity #malware #opensource

Released SindriKit v1.3.0. This update integrates native Call Stack Spoofing into the execution pipeline to handle thread telemetry. The engine dynamically parses the Exception Directory (.pdata) of loaded modules to find "Fat Frames" (>=120 bytes stack allocation) matching the constraints expected by RtlVirtualUnwind. It includes an entropy mechanism to constantly randomize the spoofed functions. Kept the focus entirely on DX. Enabling stack spoofing is just a function pointer set before execution. Full write-up: https://sibouzitoun.tech/articles/sindrikit-v1o3/ #Infosec #cybersecurity #malware #opensource