"Sandbox" in Windows do-it-yourself (bicycle)?

Question

Windows

Good evening.
Recently I became interested in how the behavior of participants' programs is controlled at various Olympiads? No, it is clear, of course, that by the participants themselves (in case of violation, there is usually a disqualification), but from a program point of view. For example: prohibition of work with the network, file system, processes, etc. Those. you can only read/output to stdin/stdout, allocate some memory and call standard functions (libc).
In eJudge this issue is resolved by adding if'a to all system calls (patch to the kernel). But this is under Linux.
The question is - how do you spell this kind of "sandbox" under Windows? Running from a guest solves a lot of problems, and climbing is quite difficult. But I want a complete solution. Which way to dig, what to read, whether there are documented methods. There are ready-made programs, but I want to assemble at least some kind of bicycle with my own hands.

Answer 1

can use *nix? or do you need wine?

Answer 2

Run as a specific user?
Plus, all decisions are usually saved, so that later you can tear off your hands if something nevertheless crawls through.

Answer 3

It’s a little unclear why reinvent the wheel if there are ready -made free solutions. You - checkers or get there? ;)

Answer 4

No drivers needed. Practical Windows Sandboxing in three parts. ACL is enough for her to restrict almost everything (including Windows networking - pipes and mailslots, for berkeley sockets you will have to use the built-in firewall) - in fact, they were invented for such access control.
Chrome sandbox is a fairly independent project from the rest of chrome. So you can pull out and use for personal purposes.

Answer 5

I won’t say for the Olympics, but Win has one simple method: call interception.
If possible, run AVZ on a system with antivirus installed (especially KAV), look at the list of intercepted calls and draw your conclusions.

Answer 6

Thrinstall.

Answer 7

If completely, completely, then the driver. for each subsystem. But grab everything you can.

Answer 8

I know that NSUTS (Novosibirsk GU system) uses WinKiller. + there under each user the separate user with practically zero rights is created.

Answer 9

For some reason, I thought of a perverted version:
Download the ten-megabyte Windows Research Kernel;
Like eJudge, add if's to all system calls;
Compile the kernel and replace the old ntoskrnl/ntkrnlpa with the new one;
???
PROFIT!

Answer 10

Set up a virtual machine.