Sandbox Engine

Uses the standard splice approach: overwrite the first five bytes of a target function with a relative JMP to a hook handler, keeping the original bytes for the trampoline, built both with Microsoft Detours and a hand-rolled implementation to understand what Detours is doing automatically. Hooked functions include NtCreateFile, NtReadFile, RegSetValueExW, CreateProcessW, and several socket-level calls, each logging arguments and a captured call stack to a structured event stream.

The call stack capture turned out to matter more than expected, it distinguishes whether a hooked call came from the target's own code or from a loaded DLL, a meaningful distinction when analyzing packed binaries. Also implemented a reflective loader variant avoiding WriteProcessMemory entirely, staging the DLL via NtMapViewOfSection for cleaner memory forensics.