There are two approaches, the quantitative and the qualitative.
The quantitative consists of fuzzing the input to the sandboxing driver. Use a fuzzing framework like Peach, Sulley or other to fuzz that input and look for crashes or file operations outside the sandbox.
The qualitative approach involves reverse engineering and understand the sandboxing mechanism. Then try to combine that understanding with different features Windows provides and different levels of privilege other components might have. The sandbox might restrict file and network operations but will it restrict injecting into a different process?
- Manipulating other processes and the system to write outside the sandbox
- Using native system routines
- Loading drivers and writing to devices like
- Loading DLLs with
- Unhooking or confusing hooking mechanisms
- Using symbolic links to confuse the sandbox
- Using alternate data streams
- Performing directory traversals
- Using environment variables like