WinShield: AppContainer Sandbox & Behavioral Monitor A sophisticated Windows security sandbox designed to isolate untrusted processes and perform deep behavioral analysis. This project represents my transition from Programmer to Engineer, applying core principles of Operating Systems, System Design, and Network Security into a functional security tool.
🚀 Why I Built This? "From a Programmer to an Engineer." While a programmer focuses on writing, testing, and optimizing code (OOP, DSA, Complexity), an Engineer builds complex software systems by integrating theoretical knowledge with practical architecture. As a second-year CS student, I built this to synthesize my learning in: • Operating Systems: Process lifecycles, Job Objects, and Tokens. • Computer Architecture: Memory management and IAT Patching. • Network Security: Packet interception and WFP. • System Analysis & Design: Orchestrating multi-threaded subsystems.
The system is divided into three primary tiers that manage the lifecycle and security of a scoped process.
1. Isolation System
Creates a "prison" for the process to ensure it cannot impact the host OS: Process Isolation: Utilizes Job Objects for resource limits and Restricted Tokens with low Integrity Levels. Registry Virtualization: Intercepts registry calls and redirects them to a fake store (JSON), preventing unauthorized configuration changes. Network Capability Control: Implements a "default-deny" policy for network access.
2. Behavioral Monitoring System
A dual-layered approach to tracking process activity: System Call Tracking: Uses IAT (Import Address Table) Patching and DLL Injection to hook APIs and monitor how the program interacts with the OS. Event Tracking (ETW & WFP): Leverages Event Tracking for Windows and Windows Filtering Platform to capture network traffic packets and process creation events.
3. Sandbox Manager
The "Brain" of the application: Manages the process life cycle from creation to termination. Orchestrates communication between the Isolation and Monitoring engines. Controls multi-threaded execution to ensure monitoring doesn't bottleneck the scoped process.
The project follows a modular, object-oriented design: SandboxManager: The central orchestrator handling security privileges and job execution. ScopedJob: Wraps the Win32 Job Object and monitors for resource limit violations. Tracker Interface: A polymorphic base for SystemBasedTracker, NetworkTracker, and ProcessActivityTracker. Isolator: A composite class managing ProcessIsolator, NetworkCapController, and RegistryConfigIsolator.
Prerequisites OS: Windows 10/11 Permissions: Administrator privileges are required to manage Job Objects and inject DLLs. Compiler: MSVC (Visual Studio 2022 recommended).
How to Run Clone the repository. Build the solution in Release/x64 mode. Launch the compiled .exe as an Administrator. Enter the full path of the target application you wish to sandbox (e.g., C:\path\to\target.exe).