zakipedio/gadgetsniper

GadgetSniper is a command line tool that scans 64-bit Windows DLL files to find a specific type of instruction pattern used in a technique called call-stack spoofing. That technique lets malicious or red-team software make its call stack look like it came from a trusted, signed program, and doing it convincingly requires finding tiny snippets of existing code, called gadgets, inside real system DLLs that can be reused for this purpose. Rather than searching for byte patterns directly, which can easily produce false matches because x64 instructions are variable length and can overlap in confusing ways, GadgetSniper uses a real instruction decoder called Iced to check every candidate. It only keeps a result if the bytes actually decode as a valid call instruction followed by a jump through one of the eight registers that survive across function calls, such as RBX or R14. This removes phantom matches that a simple byte search would report. The tool is written in C# and targets .NET 8. It scans every executable section of a DLL, not just the main code section, and can recurse through an entire folder of DLLs while skipping files it cannot access and avoiding symlink loops. Each file is scanned independently so one bad or corrupted DLL does not stop the whole run. Results are written to a text report that lists total counts by gadget type followed by details for each file and address where a gadget was found. To use it, someone installs the .NET 8 SDK, clones the repository, and runs a build or publish command to produce either a normal binary or a single self-contained executable that does not need the .NET runtime installed on the target machine. The tool is then run from the command line against a directory, with optional flags for recursive scanning and a custom output file path. The project credits an earlier tool called GadgetHunter as the inspiration for this approach.