https://github.com/rpdevjesco/shadowvm
user-space process VM
https://github.com/rpdevjesco/shadowvm
Last synced: 2 months ago
JSON representation
user-space process VM
- Host: GitHub
- URL: https://github.com/rpdevjesco/shadowvm
- Owner: RPDevJesco
- Created: 2025-02-15T16:40:27.000Z (over 1 year ago)
- Default Branch: master
- Last Pushed: 2025-02-26T21:15:31.000Z (over 1 year ago)
- Last Synced: 2025-02-26T22:23:29.306Z (over 1 year ago)
- Language: C
- Size: 38.1 KB
- Stars: 1
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# ShadowVM: Advanced Windows Security Isolation System
## Overview
ShadowVM is a sophisticated security isolation and monitoring system designed for Windows environments, providing advanced protection mechanisms for executing potentially untrusted code or applications. The project implements multiple layers of security to create a robust, comprehensive containment and monitoring solution.
## Key Components
### 1. Security System Architecture
The system is built around three primary components:
- **Resource Monitor**: Tracks and logs system resource access
- **Jail Layer**: Provides process and resource containment
- **ShadowVM**: Implements low-level code and syscall monitoring
### 2. Resource Monitoring
The Resource Monitor offers extensive tracking of system resources, including:
- File System Access
- Network Operations
- Memory Usage
- Registry Interactions
- Process Creation
- DLL Loading
#### Key Features:
- Configurable resource tracking
- Suspicious activity detection
- Detailed logging
- Performance metrics collection
### 3. Jail Layer
The Jail Layer creates an isolated environment for process execution with:
- Filesystem sandboxing
- Network access control
- Resource limit enforcement
- Process isolation using Windows Job Objects
### 4. ShadowVM Virtualization
ShadowVM provides a sophisticated code execution environment with:
- Memory sandbox allocation
- Code pattern matching
- Syscall interception
- Execution monitoring
- Suspicious code detection
## Technical Implementation
### Hooking Mechanism
The system uses a custom hook implementation that:
- Intercepts system API calls
- Logs resource access
- Enables fine-grained monitoring
- Supports dynamic hook installation/removal
### Security Layers
Combines multiple security techniques:
1. **Resource Monitoring**: Tracks and logs all system interactions
2. **Process Isolation**: Restricts process capabilities
3. **Code Execution Monitoring**: Detects and prevents suspicious code patterns
## Use Cases
- Malware analysis
- Untrusted code execution
- Sandboxed application testing
- Security research
- Controlled environment deployment
## Security Principles
- Least Privilege
- Complete Monitoring
- Proactive Threat Detection
- Granular Access Control
## Build Requirements
- Windows SDK
- C99 Compiler (MSVC recommended)
- CMake 3.30+
## Compilation
```bash
mkdir build
cd build
cmake ..
make
```
## Usage Example
```c
// Initialize security system
SecuritySystem* system = security_init("security.log");
// Add security layers
add_jail_layer(system, "test_jail", "C:\\sandbox\\");
add_shadowvm_layer(system, 1024 * 1024); // 1MB sandbox
// Execute command in secure environment
security_execute(system, "potentially_risky_program.exe");
// Cleanup
security_cleanup(system);
```
## Limitations
- Windows-specific implementation
- Performance overhead due to extensive monitoring
- Requires administrative privileges for full functionality
## Disclaimer
This is a research-grade security isolation system. While robust, it should not be considered a complete security solution without additional hardening.
## Future Improvements
- Cross-platform support
- More sophisticated pattern matching
- Enhanced machine learning-based threat detection
- Expanded resource tracking
Applications now run within a unified container with ShadowVM.
Here is how ShadowVM is viewed in the process manager.
