CreateThread interception, to use CreateRemoteThread

sandbox/win/src/sandbox_policy_base.h

Index: sandbox/win/src/sandbox_policy_base.h
diff --git a/sandbox/win/src/sandbox_policy_base.h b/sandbox/win/src/sandbox_policy_base.h
index 6520915b866617c694aabe54d085e6e3ac15a24a..f150affac85d8aba0fdd45306ca7e237143ba9ed 100644
--- a/sandbox/win/src/sandbox_policy_base.h
+++ b/sandbox/win/src/sandbox_policy_base.h
@@ -61,6 +61,8 @@ class PolicyBase final : public TargetPolicy {
   MitigationFlags GetProcessMitigations() override;
   ResultCode SetDelayedProcessMitigations(MitigationFlags flags) override;
   MitigationFlags GetDelayedProcessMitigations() const override;
+  void DisconnectCsrss() override;
+

[Will Harris, 2016/02/05 23:27:00]

nit:remove line

[liamjm (20p), 2016/02/05 23:51:21]

Done.

   void SetStrictInterceptions() override;
   ResultCode SetStdoutHandle(HANDLE handle) override;
   ResultCode SetStderrHandle(HANDLE handle) override;
@@ -145,6 +147,7 @@ class PolicyBase final : public TargetPolicy {
   IntegrityLevel delayed_integrity_level_;
   MitigationFlags mitigations_;
   MitigationFlags delayed_mitigations_;
+  bool is_csrss_connected_;
   // Object in charge of generating the low level policy.
   LowLevelPolicy* policy_maker_;
   // Memory structure that stores the low level policy.