什么是沙箱
当防病毒软件在称为“沙箱”的虚拟环境中运行某些应用程序时，从 Windows 内核的角度来看，这个沙箱是如何精确工作的？
写这样的沙箱很难吗？
When anti-viruses run some application in a virtual environment called a "sandbox", how does this sandbox precisely work from the Windows kernel point of view?
Is it hard to write such a sandbox?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
从较高层次来看，此类沙箱是内核驱动程序，它们拦截对 API 的调用，并使用挂钩修改这些 API 返回的结果。不过，整个沙盒解决方案的幕后工作原理可能很容易写满几本书。
至于难度，这可能是您可能写过的最难的事情之一。您不仅必须为操作系统内核提供的大多数内容提供钩子，而且还必须防止应用程序访问其他进程的内存空间，您必须有一种方法来保存程序所做的更改的状态，以便该程序没有意识到它正在沙箱下运行。您必须在内核模式下完成所有这些工作，这实际上限制了您使用 C，并迫使您处理不同类型的内存，例如分页池和非分页池。哦，您必须非常快速地完成所有这些操作，以便用户觉得在您的沙箱内运行应用程序是值得的。大多数用户都无法容忍 50% 以上的性能下降。
At a high level such sandboxes are kernel drivers which intercept calls to APIs, and modify the results those APIs return using hooking. How an entire sandboxing solution works under the hood though, could easily fill several books.
As for difficulty, it's probably one of the harder things you could ever possibly write. Not only do you have to provide hooks for most everything the operating system kernel provides, but you have to prevent the application from accessing the memory space of other processes, you have to have a way to save the state of the changes a program makes so that the program does not realize it's running under a sandbox. You have to do all of this in Kernel mode, which effectively limits you to using C, and forces you to deal with different kinds of memory, e.g. paged pool and nonpaged pool. Oh, and you have to do all of this very fast, so that the user feels it's worthwhile to run applications inside your sandbox. 50+% performance hits won't be tolerated by most users.