Detecting a Sandbox Environment by Calculating Active Window Titles and Checking a Specific Module

Environment

Related Scripts

Sandbox Detection Process

Sandboxie

• Sandboxie is a Windows sandboxing application that isolates the real system environment from a virtual system at the underlying operating-system level, preventing personal data, programs, and other resources from being affected by unknown programs or risky operations.
• The software is now open source: https://sandboxie-plus.com/

Principle

• Detect a sandbox environment by comparing active window titles (obtain active window titles at different times, calculate the titles using the “ror” rotate-right instruction, and determine that the system is in a sandbox if the calculated results of the two window titles are identical) and checking whether a handle to a specific module (“snxhk.dll”) exists.

Code Implementation

#include <iostream>
#include <string>
#include <windows.h>
#include <unistd.h>
#include "defs.h"
#include <stdint.h>
#define __ROR__(x, y) __rotr__(x, y)
using namespace std;

string GetActiveWindowTitle();
unsigned ror(unsigned val, int size);

int main()
{
    string title_1, title_2;
    string v2;
    uint32 v1, v3, v4, v6;
    int result_1 = 0, result_2 = 0;
    
    title_1 = GetActiveWindowTitle();
    
    cout << "title_1 is %s" << title_1 << endl;

    // ror calculate
    v1 = title_1[0];
    v2 = title_1;
    v3 = 0;

    v3 = v1 + __ROR4__(v3, 13);
    
    cout << "cal v3: " << v3 << endl;
    // v3 = v1 + __rorq(v3, 13);

    sleep(5);

    title_2 = GetActiveWindowTitle();

    cout << "title_2 is %s" << title_2 << endl;

    // ror calculate
    v4 = title_2[0];
    v6 = 0;
    v6 = v1 + __ROR4__(v4, 13);

    cout << "cal v6: " << v6 << endl;

    // compare title_1 and title_2
    if (v3 == v6) {
        result_1 = 1;
    } 

    // determine if snxhk.dll exists
    HMODULE dll = LoadLibrary("snxhk.dll");
    if (dll)
    {
        result_2 = 1;
    }

    cout << "wait 5 seconds to exit program";

    // determine if located in sandbox
    if (result_1 || result_2) {
        cout << "current enviroment is sandbox!";
    } else {
        cout << "current enviroment is not sandbox!";
    }

    sleep(1);

    return 0;
}


string GetActiveWindowTitle()
{
    char wnd_title[256];
    HWND hwnd = GetForegroundWindow();
    GetWindowTextA(hwnd, wnd_title, sizeof(wnd_title));

    return wnd_title;
}

unsigned ror(unsigned val, int size)
{
    unsigned res = val >> size;
    res |= val << (32 - size);
    return res;
}

• This uses the defs.h header file, which can be downloaded from:

  https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h
  

Run the Code to Detect a Sandbox Environment

• Running in a normal environment

• Running in a sandbox environment