The current implementation of GetBaseAddress in the sandbox uses the initial thread context and relies on undocumented behavior that RCX or EAX just happen to point to the entry point of the executable. We've observed in the production that there's errors in launch resulting in ERROR_NOACCESS, it's possible that this is due to the base address being incorrect and we fail to copy parameters to the new process using WriteProcessMemory. Also we've observed failures to set the lowbox token, one of the ways this could happen is if some third party code is starting the process temporarily (say to inject its hooks). If that's the case then the thread context could contain almost anything, and annoyingly it could be just down to a race condition that it works or it doesn't.

I propose that we replace the implementation with one which walks the virtual memory map of the new process until we find the image section for the exe file. This shouldn't result in any significant performance hit as the memory map of the new process should be sparse. Also this is entirely documented, we can use QueryFullProcessImageName and GetMappedFileName to find the corresponding image section.