Foro de elhacker.net

Option Explicit
'NTDLL
Private Declare Function RtlGetCurrentPeb Lib "NTDLL" () As Long
'MSVBVM60
Private Declare Sub GetMem4 Lib "MSVBVM60" (ByVal Addr As Long, ByRef RetVal As Long)
 
'---------------------------------------------------------------------------------------
' Procedure : AmISandboxied
' Author    : Karcrack
' Date      : 13/03/2011
' Purpose   : Know if we are running under Sandboxie
'---------------------------------------------------------------------------------------
'
Public Function AmISandboxied() As Boolean
    Dim lUPP        As Long         '&RTL_USER_PROCESS_PARAMETERS
    Dim lFlags      As Long         'RTL_USER_PROCESS_PARAMETERS.Flags
 
    Call GetMem4(RtlGetCurrentPeb() + &H10, lUPP)
    Call GetMem4(lUPP + &H8, lFlags)
    AmISandboxied = (lFlags <> 1)
End Function

Bien simple, por alguna razon desconocida PEB.RTL_USER_PROCESS_PARAMETERS.Flags es distinto cuando esta siendo ejecutado dentro de Sandboxie ;)

Por si a alguien le interesa el código en ASM que utilicé en los tests:

Main:
        cdq
        mov     edx, [FS:edx+$30]
        mov     edx, [edx+$10]
        mov     edx, [edx+$08]
        dec     edx
        jnz     Sandboxie
        ;Codigo
Sandboxie:
        ret    

Nice  stuff Bro
+ rep from me 

Thank you ntaryl :-* Glad you liked it :)

Hi Karcrack, love ur work :), this one works except for 7 64bit, do u know why ?

@philipjfry99:Maybe in 64bits the PEB structure differs, I can't reproduce the error now so I'll try
to fix it later.