diversenok

typedef enum _SE_SAFE_OPEN_PROMPT_EXPERIENCE_RESULTS {
    SeSafeOpenExperienceNone = 0x00,
    SeSafeOpenExperienceCalled = 0x01,
    SeSafeOpenExperienceAppRepCalled = 0x02,
    SeSafeOpenExperiencePromptDisplayed = 0x04,
    SeSafeOpenExperienceUAC = 0x08,
    SeSafeOpenExperienceUninstaller = 0x10,
    SeSafeOpenExperienceIgnoreUnknownOrBad = 0x20,
    SeSafeOpenExperienceDefenderTrustedInstaller = 0x40,
    SeSafeOpenExperienceMOTWPresent = 0x80,

diversenok

This is a simple program that checks whether image relocations will be applied in kernel or user mode for a particular DLL. Requires PHNT headers to compile.

diversenok

SbieSvc Thread Leak Demo

The program calls NtImpersonateThread in a loop. Since Sandboxie does not implement this function, each function call triggers it to log a message and leak a thread handle.

You can find the binary below.

diversenok

#include <phnt_windows.h>
#include <phnt.h>
#include <stdio.h>

#define PHNT_VERSION PHNT_WIN7

BOOL IsSuccess(NTSTATUS Status, LPCWSTR Where)
{
    if (!NT_SUCCESS(Status))
        wprintf_s(L"%s faild with 0x%0.8x", Where, Status);