This space serves as a technical log for software engineering projects, low-level development, systems architecture, and security research.
Use the sidebar categories to navigate topics, check out the featured post for my latest deep-dive, or scroll through the recent logs to explore past codebases and build updates.
Introduction In this post, we’ll explore a technique to detect whether an executable is running inside Avast’s CyberCapture sandbox. By detecting the sandbox environment, a payload can alter its behavior to evade analysis and trick the antivirus into classifying the binary as safe.