{"id":25909654,"url":"https://github.com/rpdevjesco/shadowvm","last_synced_at":"2026-05-12T06:36:28.521Z","repository":{"id":277722610,"uuid":"933306693","full_name":"RPDevJesco/ShadowVM","owner":"RPDevJesco","description":"user-space process VM","archived":false,"fork":false,"pushed_at":"2025-02-26T21:15:31.000Z","size":39,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-02-26T22:23:29.306Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/RPDevJesco.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-02-15T16:40:27.000Z","updated_at":"2025-02-26T21:15:34.000Z","dependencies_parsed_at":"2025-02-15T17:39:39.644Z","dependency_job_id":null,"html_url":"https://github.com/RPDevJesco/ShadowVM","commit_stats":null,"previous_names":["rpdevjesco/shadowvm"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RPDevJesco%2FShadowVM","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RPDevJesco%2FShadowVM/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RPDevJesco%2FShadowVM/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RPDevJesco%2FShadowVM/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/RPDevJesco","download_url":"https://codeload.github.com/RPDevJesco/ShadowVM/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241629714,"owners_count":19993711,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-03-03T08:18:18.831Z","updated_at":"2025-11-30T11:05:23.877Z","avatar_url":"https://github.com/RPDevJesco.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ShadowVM: Advanced Windows Security Isolation System\n\n## Overview\n\nShadowVM is a sophisticated security isolation and monitoring system designed for Windows environments, providing advanced protection mechanisms for executing potentially untrusted code or applications. The project implements multiple layers of security to create a robust, comprehensive containment and monitoring solution.\n\n## Key Components\n\n### 1. Security System Architecture\n\nThe system is built around three primary components:\n\n- **Resource Monitor**: Tracks and logs system resource access\n- **Jail Layer**: Provides process and resource containment\n- **ShadowVM**: Implements low-level code and syscall monitoring\n\n### 2. Resource Monitoring\n\nThe Resource Monitor offers extensive tracking of system resources, including:\n- File System Access\n- Network Operations\n- Memory Usage\n- Registry Interactions\n- Process Creation\n- DLL Loading\n\n#### Key Features:\n- Configurable resource tracking\n- Suspicious activity detection\n- Detailed logging\n- Performance metrics collection\n\n### 3. Jail Layer\n\nThe Jail Layer creates an isolated environment for process execution with:\n- Filesystem sandboxing\n- Network access control\n- Resource limit enforcement\n- Process isolation using Windows Job Objects\n\n### 4. ShadowVM Virtualization\n\nShadowVM provides a sophisticated code execution environment with:\n- Memory sandbox allocation\n- Code pattern matching\n- Syscall interception\n- Execution monitoring\n- Suspicious code detection\n\n## Technical Implementation\n\n### Hooking Mechanism\n\nThe system uses a custom hook implementation that:\n- Intercepts system API calls\n- Logs resource access\n- Enables fine-grained monitoring\n- Supports dynamic hook installation/removal\n\n### Security Layers\n\nCombines multiple security techniques:\n1. **Resource Monitoring**: Tracks and logs all system interactions\n2. **Process Isolation**: Restricts process capabilities\n3. **Code Execution Monitoring**: Detects and prevents suspicious code patterns\n\n## Use Cases\n\n- Malware analysis\n- Untrusted code execution\n- Sandboxed application testing\n- Security research\n- Controlled environment deployment\n\n## Security Principles\n\n- Least Privilege\n- Complete Monitoring\n- Proactive Threat Detection\n- Granular Access Control\n\n## Build Requirements\n\n- Windows SDK\n- C99 Compiler (MSVC recommended)\n- CMake 3.30+\n\n## Compilation\n\n```bash\nmkdir build\ncd build\ncmake ..\nmake\n```\n\n## Usage Example\n\n```c\n// Initialize security system\nSecuritySystem* system = security_init(\"security.log\");\n\n// Add security layers\nadd_jail_layer(system, \"test_jail\", \"C:\\\\sandbox\\\\\");\nadd_shadowvm_layer(system, 1024 * 1024);  // 1MB sandbox\n\n// Execute command in secure environment\nsecurity_execute(system, \"potentially_risky_program.exe\");\n\n// Cleanup\nsecurity_cleanup(system);\n```\n\n## Limitations\n\n- Windows-specific implementation\n- Performance overhead due to extensive monitoring\n- Requires administrative privileges for full functionality\n\n## Disclaimer\n\nThis is a research-grade security isolation system. While robust, it should not be considered a complete security solution without additional hardening.\n\n## Future Improvements\n\n- Cross-platform support\n- More sophisticated pattern matching\n- Enhanced machine learning-based threat detection\n- Expanded resource tracking\n\n\nApplications now run within a unified container with ShadowVM.\n![image](https://github.com/user-attachments/assets/75a036f2-d75d-4f2a-8041-bee0311c03d9)\n\nHere is how ShadowVM is viewed in the process manager.\n![image](https://github.com/user-attachments/assets/29662ad8-6cda-4e33-a2c7-26e09da89386)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frpdevjesco%2Fshadowvm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frpdevjesco%2Fshadowvm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frpdevjesco%2Fshadowvm/lists"}