Skip to content

VeroFess/SbieHide

Repository files navigation

SbieHide

A plugin written for sandboxie-plus, which is used to fight the detection of sbiedll.dll

How to use?

Compile this plug-in or download pre-compiled files from Release

You should ensure file name of this plug-in contains the string 'sbiehide', otherwise it will not hide itself.

Open the configuration file of sandboxie-plus and add the following configuration to the sandbox which need to hide from inner program:

InjectDll64=Path\to\64\SbieHide.dll
InjectDll=Path\to\32\SbieHide.dll

About some applications are still detected sbiedll.dll

First of all, you should not use this plug-in for bypass anti-cheating,

The behavior of this plug-in is very similar to some cheat, which may cause your account banned!

Secondly, this module cannot fight the detection of the kernel layer. Related confrontation needs to write in a driver, and doing so in the kernel will make Microsoft Patchguard unhappy.

Finally, please bring a sample in issue, and I will try to correct this problem.


The detection that has been passed

  • Peb->InLoadOrderModuleList
  • Peb->InMemoryOrderModuleList
  • Peb->InInitializationOrderModuleList
  • Peb->HashLinks
  • NtQueryVirtualMemory [MemoryBasicInformation|MemoryMappedFilenameInformation|MemoryRegionInformation|MemoryImageInformation|MemoryRegionInformationEx|MemoryEnclaveImageInformation|MemoryBasicInformationCapped]
  • NtQueryObject [ObjectNameInformation]
  • NtQueryInformationFile [FileNameInformation|FileAllInformation]
  • NtQuerySection [SectionOriginalBaseInformation]

LICENSE

SbieHide is licensed under the MIT License. Dependencies are under their respective licenses.