Norman Sandbox - a computer inside a computer - how it works?

[jian2587]

I was having this idea of having a computer inside a computer
when I started learning programming quite a long time ago,
particularly useful in tricking viruses into thinking they're wrecking
stuffs in the real environment where in fact they're inside a virtual
computer. Unfortunately, not long then, I found out that there's
already company doing this, but for different purposes.

Now this norman sandbox got me recalled of this virtual computer.
So basically, when the virus make system calls, how could we
intercept it and return false values as to trick it and simulate a
virtual computer environment?

[MartinLiss]

You might try asking your question at AntiOnline.

[jian2587]

thx Martin, will give it a try!

[jian2587]

Norton seems to be also able to intercept ActiveX objects method.
I wonder how they do that?
I was thinking it could probably involve something low-level...like
in ring zero, ummm....VxDs perhaps.

anyway pls guyz and galz in this forum, if any of u know pls post
it here.

[<ABX]

I would lookup windows emulators and see how they work and then make it so you can run it on windows instead of a different OS. You'll need to be good at c++ or a lower level language than vb.

You will also need a very good computer to run both OS at the same time.

[jian2587]

no...that's not wut I meant...
it's rather a sandbox.
You don't've to go to such extent as developing an emulator.
Developing emulator means reinventing the wheel.
A sandbox just let a program run but all the system API calls it
made are intercepted.

Anyone have idea,pls?