How Attachment Works

BoxedApp SDK attaches a process to a virtual environment by injecting a helper thread into the target process.
Technically, this is achieved using the Windows API function CreateRemoteThread, which runs code inside the address space of the target process.

Once created, the injected thread initializes all necessary system call interceptors (hooks) inside the target process.
These hooks redirect file system and registry operations so that the process transparently uses the virtual file system and virtual registry of the shared virtual environment instead of the real ones.

When attaching to a child process that is about to be created, BoxedApp SDK initializes the helper thread early in its startup sequence.
After all hooks are set up and the environment is ready, control is transferred to the main thread of the child process, allowing it to run within the shared virtual environment.