Introduction In this post I show a simple method to detect Avast’s CyberCapture sandbox. We begin by examining the exports of snxhk.dll, the DLL Avast uses to install its user-mode hooks.
This space serves as a technical blog for software engineering projects, low-level development, systems architecture, and security research.
Use the sidebar categories to navigate topics, check out the featured post for my latest deep-dive, or scroll through the recent logs to explore past codebases and build updates.
Introduction In this post I show a simple method to detect Avast’s CyberCapture sandbox. We begin by examining the exports of snxhk.dll, the DLL Avast uses to install its user-mode hooks.