Structured collection of sandbox programs including tests (fs, net access, permissions, process groups [if available]) and system setup programs. No VM stuff.
BSD Zero Clause License
0
stars
0
forks
source link
static kernel API call filtering (seccomp and alternatives on other OSes) #5
unclear: can kernel32 or ntdll calls be patched, ie as admin or system user by providing empty stubs? idea would be to spawn suspended, patch out stubs with debug API and do the same subsequently for spawned child processes.
requires stubs patching being possisble
requires watching for subset of ntdll calls possible
requires debug API be able to follow child processes
unclear: can kernel32 or ntdll calls be patched, ie as admin or system user by providing empty stubs? idea would be to spawn suspended, patch out stubs with debug API and do the same subsequently for spawned child processes.