通过计算活动窗口标题和检查指定模块以检测沙箱环境

环境说明

相关脚本

沙箱检测过程

Sandboxie

• Sandboxie,是一款从底层操作系统层面,将真实系统环境与虚拟系统隔离,以防止个人数据、程序等不受未知程序或有风险操作影响的Windows端沙盘/沙箱软件。
• 目前当前软件已经开源：https://sandboxie-plus.com/

原理

• 通过比较活动窗口标题（获取不同时间段下的活动窗口标题，使用 “ror” 右移指令对标题进行运算，如果 2 个窗口标题计算结果相同则判断自身处于沙箱环境）和检查是否存在指定模块（“snxhk.dll”）句柄来检测沙箱环境

代码实现

#include <iostream>
#include <string>
#include <windows.h>
#include <unistd.h>
#include "defs.h"
#include <stdint.h>
#define __ROR__(x, y) __rotr__(x, y)
using namespace std;

string GetActiveWindowTitle();
unsigned ror(unsigned val, int size);

int main()
{
    string title_1, title_2;
    string v2;
    uint32 v1, v3, v4, v6;
    int result_1 = 0, result_2 = 0;
    
    title_1 = GetActiveWindowTitle();
    
    cout << "title_1 is %s" << title_1 << endl;

    // ror calculate
    v1 = title_1[0];
    v2 = title_1;
    v3 = 0;

    v3 = v1 + __ROR4__(v3, 13);
    
    cout << "cal v3: " << v3 << endl;
    // v3 = v1 + __rorq(v3, 13);

    sleep(5);

    title_2 = GetActiveWindowTitle();

    cout << "title_2 is %s" << title_2 << endl;

    // ror calculate
    v4 = title_2[0];
    v6 = 0;
    v6 = v1 + __ROR4__(v4, 13);

    cout << "cal v6: " << v6 << endl;

    // compare title_1 and title_2
    if (v3 == v6) {
        result_1 = 1;
    } 

    // determine if snxhk.dll exists
    HMODULE dll = LoadLibrary("snxhk.dll");
    if (dll)
    {
        result_2 = 1;
    }

    cout << "wait 5 seconds to exit program";

    // determine if located in sandbox
    if (result_1 || result_2) {
        cout << "current enviroment is sandbox!";
    } else {
        cout << "current enviroment is not sandbox!";
    }

    sleep(1);

    return 0;
}


string GetActiveWindowTitle()
{
    char wnd_title[256];
    HWND hwnd = GetForegroundWindow();
    GetWindowTextA(hwnd, wnd_title, sizeof(wnd_title));

    return wnd_title;
}

unsigned ror(unsigned val, int size)
{
    unsigned res = val >> size;
    res |= val << (32 - size);
    return res;
}

• 其中用到了defs.h头文件，其下载地址为：

  https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h
  

运行代码对沙箱环境进行检测

• 普通环境运行

• 沙箱环境下运行