I am having issues with a particular game, detecting the presence of the games being run inside sandboxie (An application for running programs inside a sandbox) with the goal of running multiple instances of the game on the same computer.
The game employs techniques to detect the presence of sandboxie, and I've found information regarding this issue online to be scarce, however it seems to be down to the detection of the presence of "SbieDll.dll" in the module list of the games process. I thought about this logically and assume they are using something like the PEB_LDR_DATA structure to iterate through each of the modules and flag if the string matches "SbieDll.dll".
So there's a couple of issues with what I need to do, sandboxie is a closed source program, so I can't simply edit the name of the DLL.
So I have two questions in regard to this the first being:
What should I be doing to prevent the application from breaking when I hex edit the new name in? Should I be searching for something else beside SbieDll.dll to replace?
The second being, what other techniques may the game be employing to detect the presence of sandboxie? And if so are there any other ways I can hide that the game is in fact run by sandboxie?
I've tried to rename all instances of SbieDll.dll in all sandboxie replaced executable's and modules with a hex editor (HXD) to a filename of the same name length (Eg 1234567.dll) and also edited the PE headers using PE explorer to remove all traces of "sandboxie" from the application, however this seems to break sandboxie itself throwing the exception:
"Initialization of the dynamic link library C:\Program Files\Sandboxie\SbieDll.dll failed. The process is terminating abnormally"
I expect the game to be able to run in sandboxie with no issues.