Topic created on: December 10, 2007 15:00 CST by Valentin .

Hi

I would like to build something similar to Anubis or Norman Sandbox on a real machine (to avoid vm and debugger detection). My idea is to build something which  logs API calls like NtCreateFile or RegSetValue into a textfile. In order to avoid debugger detection my idea is to replace the orginal dlls with proxy dlls.

Since I am no expert in RE my questions would be:
1. Does this make any sense?
2. Is there any freeware/open source solutions which can help to accomplish this?
3. Are there other techniques I should consider? Maybe a neat python libary ...

Greetings
Valentin