1


Does anyone know what is the purpose of RtlCheckSandboxedToken() in ntdll.dll,
i cannot find any documentation, its prototype is:

 
NTSYSAPI
NTSTATUS
NTAPI
RtlCheckSandboxedToken(
    _In_opt_ HANDLE TokenHandle,
    _Out_ PBOOLEAN IsSandboxed
    );

source: https://github.com/processhacker/processhacker/blob/master/phnt/include/ntrtl.h

Is it something like IsDebuggerPresent() for VMs?

Improve this question
  • Without knowing anything further about this function, I'd surmise purely based on its name alone, that it has to do with the sandboxing mechanism of Windows Store apps. Oh and the handle you pass is very likely any plain old access token. – 0xC0000022L♦ Sep 3 '18 at 12:45
1

The following call stack can be found in MrmCoreR.dll:

Microsoft::Resources::MetroAppClientProfile::IsUnsafeLoadPriFileAllowed
Microsoft::Resources::HasCapability
RtlCheckSandboxedToken

Seems like it's used by Metro applications to know if they were run in the sandbox. And RtlCheckSandboxedToken() checks the token if it can be accessed via some specific security descriptor to determine if it's sandboxed.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.