BoxedApp SDK

[iamasbcx]

#pragma once
#include "windows.h"


typedef void(__stdcall* fuBoxedAppSDK_SetContext)(LPCSTR szContext);
typedef BOOL(__stdcall* fuBoxedAppSDK_Init)();
typedef BOOL(__stdcall* fuBoxedAppSDK_SetBxSdkRawData)(PVOID pData, DWORD dwSize);
typedef void(__stdcall* fuBoxedAppSDK_Exit)();
typedef HANDLE(__stdcall* fuBoxedAppSDK_CreateVirtualFileW)(LPCWSTR szPath, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile);
typedef DWORD(__stdcall* fuBoxedAppSDK_DeleteFileFromVirtualFileSystemW)(LPCWSTR szPath);
typedef void(__stdcall* fuBoxedAppSDK_EnableOption)(DWORD dwOptionIndex, BOOL bEnable);
typedef void(__stdcall* fuBoxedAppSDK_RemoteProcess_EnableOption)(DWORD dwProcessId, DWORD dwOptionIndex, BOOL bEnable);
typedef BOOL(__stdcall* fuBoxedAppSDK_AttachToProcess)(HANDLE hProcess);
typedef BOOL(__stdcall* fuBoxedAppSDK_DetachFromProcess)(HANDLE hProcess);
typedef void(__stdcall* fuBoxedAppSDK_EmulateBoxedAppSDKDLL)();
typedef BOOL(__stdcall* fuBoxedAppSDK_SetBxSdk64DllPathW)(LPCWSTR szPath);
typedef BOOL(__stdcall* fuBoxedAppSDK_SetBxSdk32DllPathW)(LPCWSTR szPath);
typedef void(__stdcall* fuBoxedAppSDK_EnableDebugLog)(BOOL bEnable);

//typedef void* (*MyMalloc)(size_t size);
//typedef void (*MyMfree)(void* p);


void InitBoxedAppSDK();

//
//#define SuperNew(ptr) Newmalloc(ptr);
//#define SuperNewType(FotType) (FotType*)Newmalloc(sizeof(FotType));
//#define SuperDelete(ptr) if(ptr) { Deletefree(ptr); ptr=NULL;}

[iamasbcx]

BoxedAppSDK_CreateVirtualFileW writes the dll to the virtual directory and then loads the DLL normally.

[EvanMcBroom]

Hey @iamasbcx! Thank you for recommending BoxedApp, that may help some people's use case and I'm glad it works well for you.

Although it is similar software to this repo, it has extra considerations for developers. These include:

• Its paid software
• There may be licensing issues with using it in some projects
• Its more effort to audit if an issue occurs since its closed source
• Its a 3rd party SDK that would need extra integration to use in projects

The main goal of this repo is to be a reference implementation for testing and to demonstrate how to reimplement the concepts in your own project. That being said, I have tried to remove the above considerations if someone wanted to use it in their project as-is:

• The repo is free to use
• Its a MIT license which should not have any issues, but I'm open to changing that license if needed
• You can audit the source code since its publicly available
• Although it can also be used as a 3rd party SDK, I've attempted to make it simple to add to existing CMake projects

All that being said, it still may be easier for some people to use BoxedApp. It really depends on the developers needs for their project.

As a side note, I have not used BoxedApp before but I reviewed the information on their website. I'd be willing to bet their SDK internally implements their virtual file system and virtual registry using Microsoft's transactional file system and registry APIs. Even if that isn't their approach (or they don't want to confirm that) a virtual file system and registry can be implemented as they described with the transaction APIs.

Knowing that, there are open source alternatives to BoxedApp that demonstrate the same concepts. One example of that for the file system is diversenok's TransactionManager project. An example of the basic concept for the registry can be seen in this gist which effectively creates a "virtual registry key" via a registry transaction to pass a check in Microsoft's FMAPI API. For the other core features they describe, creating a process from an in-memory EXE via a transaction is well described in Tal Liberman's and Eugene Kogan's 2017 presentation on Process Doppelgänging, and loading a module from an in-memory DLL via a transaction is described in the blog for this repo (on Medium and GitHub) and is demonstrated in this repo as the "Module Doppelgänging" technique. Using these projects as a reference, their SDK features can be reimplemented as needed by developers without needing to purchase a license or accept any license their software may require.