• nop-4
  • New member
  • Offline
  • Registered: 2011-07-05
  • Posts: 8
  • User Karma: 0

Topic: how Sandbox it works?

Hi all!Who can tell how works mechanisms of  sandbox? How can this be accomplished?

Last edited by nop-4 (2011-10-27 11:24:04)

  • Registered: 2011-09-30
  • Posts: 11

Re: how Sandbox it works?

Hi. I can suppose (I don't know whether my opinion is right, really) that sandbox technique is just using opcode tables. I mean every opcode member has a pointer to it's handler. Shortly it's software emulation of code, but it's not complete - I mean branch instructions - processor doesn't really execute the code, so not all instructions get defined.
How to deal with it? You can just detect it and stop doing suspicious things - that's all, to my mind.

Last edited by fasmotol (2011-10-27 13:25:51)

  • nop-4
  • New member
  • Offline
  • Registered: 2011-07-05
  • Posts: 8
  • User Karma: 0

Re: how Sandbox it works?

I think it is difficult to implement.
hooks may be used?

  • Registered: 2011-09-30
  • Posts: 11

Re: how Sandbox it works?

No. No hooks. I'm sure cause at rootkits.su subj has been discussed, so really it's just software emulation, nothing more.
It's not difficult to code, but sandboxes are dumb. The quality of emulation like that is very low.