Thema: Sandboxie / Shade Sandbox

[SiLæncer]

Sandboxie-Plus is a fork of Sandboxie designed to address various problems as well as adding improved functionality.

Sandboxie allows you to run programs in an isolated and protected space. This protected space will prevent any permanent changes being made to other programs and data to your computer allowing to test, play and utilize them without fear of harming your machine.

Sandboxie-Plus fixes many known issues and security holes of the last official Sandboxie release, adds new functionality, most notably a new Qt-based UI SandMan.exe that is far more advanced than the old MFC based SbieCtrl.exe UI. The security fixes are essential as they effectively close privilege escalation and sandbox escape issues present in the last 5.33.6 official build.

License: Open Source

Release Notes

This build adds a new functionality to use Windows Filtering Platform (WFP) to implement a per sandbox firewall.
This functionality needs to be enabled in the global Sandboxie settings, and the driver needs to be reloaded (or the PC rebooted) for the feature to be activated. Once this is done the firewall rules which can be configured in the network options of each sandbox, will be enforced by the driver.
If the WFP support is not enabled the same rules still can be set and are used, but will be applied only by a set of user mode hooks, unlike the WFP implementation they will apply only to outgoing connections and there are no enforcement guarantees as user mode hooks can be bypassed or disabled by a malicious application.

The rational behind implementing this functionality in user and kernel mode (driver) instead of driver only is twofold for once it allows for debugging of the rule processing code as booth modes use the same code to make decisions based on the preset rules. Second the WFP callouts are global i.e. they are triggered for any process on the system whether its sandboxed or not, in the lather case they don't do anything and the use of a hash map to identify sandboxed programs that require action should provide optimal performance. That said users who run a 3rd party firewall which they may prefer may not want to many firewalls being active at once, while still wanting to use some per sandbox network rules for compatibility and not security reasons.

Also please note that with this build the old "BlockPort=..." functionality is completely dropped, the default port block rules are now implemented by the new user mode firewall component, if you have custom BlockPort entries in your sandboxie ini they will need to be updated by hand to the new format, for example "BlockPort=137,138,139,445" -> "NetworkAccess=Block;Port=137,138,139,445"

The rules are applied based on a specific decision priority:

    A rule for a specified program trumps a rule for all programs except a given one, trumps rules for all programs
    A rule with a Port or IP trumps a rule without
    2a. A rule with ip and port trums a rule with ip or port only
    2b. A rule with one ip trumps a rule with an ip range that is besides that on the same level
    Block rules trump allow rules
    A rule without a protocol means all protocols, a rule with a protocol trumps a rule without if its the only difference

The rule editing UI allows for testing rules, in the row below the rule list one can enter program name, port, ip and protocol to see which rules are in play and which rule will be applied in the end.

When configuring per process network access restrictions and WFP is enabled it is possible to choose between a WFP based approach and the old sandboxie way of blocking the network device end points. The later approach is more absolute, but is know for causing some application to crash.

[close]

Whats new:>>

added

    ability to us theh run unsandboxed option with sandboxie links #614

Fixed

    fixed open template does not load the edit tab #1054
    fixed issue with explore sandboxed #972
    fixed start directory for sandboxed processes #1071
    fixed issue with language auto detection #1018
    fixed issue with multiple files with same name, by always showing the extension #1041
    fixed multiple program grouping issues with the sandman ui #1054
    fixed no disk error #966
    fixed issue with 32bit build using qMake, the /O2 option resulted in a crash in teh QSbieDll.dll #995
    fixed issue with UserSettings introduced in a recent build #1054

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

added

    added clear commands to log sub menus #391
    added option to disable prompt to confirm process termination #514
    added settings to sandboxie-plus.ini "Options/InstantRecovery" to use the recovery window instad of the notification popUp #988
    added ability to rename a non empty sandbox #1100
    added ability to remove a non empty sandbox
    added file browser window to sandman ui to cover the files view functionality of sbie ctrl #578

Changed

    generic error in sbie ui now show the status code as hex and provide a string description when available

fixed

    "del" shortcut to terminate a process did not always work
    fixed group display issue #1094
    fixed issue when using run sandboxed on a file located already in a sandbox #1099

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added option to run a sandbox in session 0
    -- Note: the processes then have a system token, hence its recommended to enable "DropAdminRights=y"
    when the UI is run with admin privileges it now can terminate sandboxed processes in other sessions
    added "StartSystemBox=" option to auto run a box on sbie start/system boot in session 0
    -- Note: box start is done through issuing start.exe /box:[name] auto_run
    add start.exe auto_run command to start all sandboxed auto start locations
    add start.exe /keep_alive command line switch it keeps a process running in the box untill it gracefully terminates
    added "StartCommand=" it starts a complex command through start.exe on box startup
    added menu option to start regedit and load the box reg key

Changed

    changed command prompt icon and string from "terminal" to "command prompt" #1135
    sys tray can now also use the classic icon #963
    reworked box menu layout a bit

fixed

    fixed driver compatybility with windows server 2022 (build 20348) #1143
    fixed issue with creating shortcuts #1134

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added ability to rename groups #1152
    added ability to define a custom order for the sandboxes, you can move using the move context menu, or holding alt + arrow key
    added recovery to list to the recovery window: #988
    added finder to the recovery window

Changed

    updated the BlockPort rule inside Template_BlockPorts to the new NetworkAccess format (by isaak654) #1162
    default for immediate recovery behavioure is now th show the recovery window instzead of using the notifications window #988
    the new run dialog now takes double click #1171
    reworked the recovery window

Fixed

    fixed issue with create group menu #1151
    fixed issue when renaming a box it lost its group association
    fixed issue with Thunderbird build 91+ #1156
    fixed an issue with file disposition handling #1161
    fixed issue with windows 11 22449.1000 #1164
    fixed SRWare Iron template (by Dyras) #1146
    fixed labels position in Classic UI (by isaak654) #1088

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added forced process indicator to process status column #1174
    added "SbieTrace=y" option to trace the interaction between Sandboxie processes and the Sandboxie core components
    when initializing an empty sandbox, MSI debug keys are set to generate the debug output of MSI installer service
    added "DisableComProxy=y" allowing to disable COM proxying through the service
    added "ProcessLimit=..." that allows to limit the max count of processes in a sandbox #1230
    added missing IPC logging

Changed

    reworked SbieSvc ini server to allow settings caching and greatly improve performance
    -- Now comments in the Sandboxie.ini are being preserved as well as the order of all entries
    enabled configuration section list replacement with a hash map to improve configuration performance
    improved progress and status messages for the Plus installer (by mpheath) #1168
    reworked RpcSs start mechanics, sandboxed RpcSs and DcomLaunch can now be run as system, use "RunRpcssAsSystem=y"
    -- note: this is generally not recommended for security reasons but may be needed for compatibility in some scenarios
    reworked WTSQueryUserToken handling to work properly in all scenarios
    reworked configuration value list to use a hash table for better performance

Fixed

    fixed Plus upgrade install in Windows 7 (by mpheath) #1194
    fixed custom autoexec commands being executed on each box start instead of only on the initialization
    fixed a design issue limiting the maximal amount of processes in one box to 511
    fixed handle leaks in the lingering process monitor mechanism
    fixed issue with opening device paths like "\??\FltMgr"
    fixed build issue with an explicit FileDigestAlgorithm option for driver sign (by isaak654) #1210
    fixed issue with resource access log sometimes getting corrupted
    fixed issue with Microsoft Office Click-to-Run #428 #882

removed

    removed support for Microsoft EMET (Enhanced Mitigation Experience Toolkit), as it was EOL in 2018
    removed support for Messenger Plus! Live, as MSN Messenger is EOL since 2013
    disabled Turkish language on Plus UI for inactivity (by isaak654) #1215

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Whats new:>>

This build fixes two issues handling sandboxie.ini introduced in the 0.9.7 build

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added debug switch to disable Sbie console redirection "NoSandboxieConsole=y"
    -- note that this was previously part of "NoSandboxieDesktop=y"
    added Sbie+ version to the log #1277
    added uninstall cleanup of extra files for the Plus installer (by mpheath) #1235
    added set language for Sandman for the Plus installer (by mpheath) #1241
    added EventLog messages with SbieMsg.dll for the Plus installer (by mpheath)
    group expansion state is now saved
    added additional filters to the trace tab

Changed

    reworked and extended RPC logging
    reintroduced the "UseRpcMgmtSetComTimeout=some.dll,n" setting to be used when no "RpcPortBinding" entry is specified
    --- this allows to enable/disable out of box RPC binding independently from the timeout setting
    the "BoxNameTitle" value can now be set explicitly on a per image name basis #1190

Fixed

    fixed inability to delete read-only files from sandboxed explorer #1237
    fixed wrong recovery target in Plus UI #1274
    fixed SBIE2101 issue introduced with 0.9.7a #1279
    fixed sorting in the box picker window #1269
    fixed tray refresh issue #1250
    fixed tray activity display #1221
    fixed recovery window not displaying in taskbar #1195
    fixed dark theme preset not updating in real time #1270
    fixed Microsoft Edge complaining about "FakeAdminRights=y" #1271
    fixed issue with using local template in the global section #1212
    fixed issue with git.exe from MinGW freezing #1238
    fixed issue with search highlighting when using in dark mode

Removed

    removed the ability to sort the trace log as it took too much CPU

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added ability to save trace log to file on Plus UI
    added French language on Plus UI (by clexanis) #1155

Changed

    network traffic trace is now properly logged to the driver log instead of to the kernel debug log
    Plus installer will autostart SandMan.exe after install to fix a taskbar icon issue #3040211
    Classic installer will show the license agreement when updating #1187

Fixed

    fixed template sections not showing in editor #1287
    fixed issue with app ID resulting in some apps showing two button groups in the taskbar #1101
    fixed issue with maximum ini value length on Plus UI #1293
    fixed issue handling an empty Sandboxie.ini that got introduced recently #1292
    fixed issue with "SpecialImages" template (by Coverlin) #1288 #1289
    fixed issue with box emptying #1296
    fixed issues wich some languages #1304
    fixed issue with mounted directories #1302
    added missing translation for qt libraries #1305
    fixed issue with Windows compatibility assistant #1265
    fixed issue with process image specific settigns #1307

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added explicit lines on Plus installer to delete empty shell registry keys at uninstall time (by mpheath) 3f661a8

Fixed

    fixed template sections not showing in editor #1287
    fixed autodelete box content broken in the previous build #1296 #1324
    fixed crash in "Browse Content" window #1313
    fixed issue with icon resolution on Windows 7 #1310
    fixed invalid "No Inet" status in the status column #1312
    fixed Windows Explorer search box not working (by isaak654) #1002
    fixed Waterfox phishing template (by Dyras) #1309
    fixed issue with Chinese translation files on Plus installer (by mpheath) #1317
    fixed autorun registry key path on Plus installer (by mpheath) abd2d44
    fixed memory corruption in SbieSvc.exe

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added checkbox if the user wants SandMan.exe to be started after installation #1318
    added template for Windows 10 virtual desktop manager #1326

Changed

    "OpenClsid=..." is no longer restricted to CLSCTX_LOCAL_SERVER execution contexts only
    -- this allows to run objects with the CLSCTX_INPROC_SERVER flag in the COM helper service
    in the trace view, now multiple types can be selected at once
    a few Plus UI entries were made translatable (by gexgd0419) #1320
    changed default "terminate all boxed processes" key to Shift+Pause (by isaak654) #1337

Fixed

    fixed ini writing issue with SbieCtrl and the new ini handling mechanism #1331
    fixed issue with trace log filtering
    fixed space issue about German language on Plus installer (by mpheath) #1333
    restored Waterfox phishing template entries with a proper fix (by APMichael) #1334

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

added Privacy enhanced mode, sandboxes with "UsePrivacyMode=y" will not allow read access to locations containing user data
-- all locations except generic Windows system paths will need to be opened explicitly for read and/or write access
-- using "NormalFilePath=...", "NormalKeyPath=...", "NormalIpcPath=..." allows to open locations to be readable and sandboxed

added new "App Compartment" mode of operation, it's enabled by adding "NoSecurityIsolation=y" to the box configuration
-- in this mode, security is traded in for compatibility, it should not be used for untrusted applications
-- note: in this mode, file and registry filtering are still in place, hence processes run without administrative privileges
-- it is reasonably safe, all filtering can be disabled with "NoSecurityFiltering=y"

added experimental use of ObRegisterCallbacks to filter object creation and duplication
-- this filtering is independent from the regular SbieDrv's syscall-based filtering, hence it also applies to App Compartments
-- with it enabled, an application running in a compartment will not be able to manipulate processes running outside the sandbox
-- Note: this feature improves the security of unisolated App Compartment boxes
-- to enable this feature, set "EnableObjectFiltering=y" in the global section and reload the driver
-- when globally activated, the filtering can be disabled for individual boxes with "DisableObjectFilter=y"

added "DontOpenForBoxed=n", this option disables the discrimination of boxed processes for open file and open key directives
-- this behaviour does not really improve security anyways, but may be annoying, also app compartments always disable this

added setting to entirely open access to the COM infrastructure

Changed

reworked the resource access path matching mechanism to optionally apply more specific rules over less specific ones
-- for example "OpenFilePath=C:\User\Me\AppData\Firefox takes precedence over "WriteFilePath=C:\User\Me"
-- to enable this new behaviour, add "UseRuleSpecificity=y" to your Sandboxie.ini, this behaviour is always enabled in Privacy enhanced mode
-- added "NormalFilePath=..." to restore default Sandboxie behaviour on a given path
-- added "OpenConfPath=...", which similarly to "OpenPipePath=..." is a "OpenKeyPath=..." variant which applies to executables located in the sandbox
removed option to copy a box during creation, instead the box context menu offers a duplication option
reworked the box creation dialog to offer new box types

Fixed

fixed SBIE1401 notification during Sandboxie Plus uninstall (by mpheath) 68fa37d
fixed memory leak in driver handling FLT_FILE_NAME_INFORMATION (by Therzok) #1371

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

    Added:

    added checkboxes to most major box options lists
    added SumatraPDF templates (by Dyras #1391

    Changed:

    rolled back change to "OpenClsid=..." handling
    made all major lists in the box options editable

    Fixed:

    fixed issue with read only paths introduced in 1.0.0
    fixed BSOD issue introduced in the 1.0.0 build #1389
    fixed multiple BITS notifications while running sandboxed Chromium browsers (by isaak654 ca320ec #1081
    fixed executables selection for "Run Menu" entries (by isaak654 #1379
    fixed SetCursorPos and ClipCursor ignoring DPI awareness (by alvinhochun #1394

    Removed:

    removed Virtual Desktop Manager template (by isaak654 d775807 #1326

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Whats new:>>

    fixed recovery window not refreshing count on reload #1402
    fixed printing issue introdudec in 1.0.1 #1397
    fixed issues with create process #1408

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added mechanism to hook Win32 system calls on windows 10 and later, this should resolve the issue with Chromium HW acceleration
    -- Note: this mechanism does not, yet, work for 32 bit applications running under WoW64
    -- to enable it, add "EnableWin32kHooks=y" to the global ini section, this feature is highly experimental (!)
    -- the hooks will be automatically applied to Chromium GPU processes
    -- to force Win32k hooks for all processes in a selected box add "AlwaysUseWin32kHooks=program.exe,y" #1261 #1395

Fixed

    fixed bug in GetVersionExW making "OverrideOsBuild=..." not working #605 #1426
    fixed issue with some UTF-8 characters when used in the ini file
    fixed isolation issue with Virtual Network Editor #1102

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    Mechanism to hook Win32 system calls now also works for 32 bit applications running under WoW64
    Added customization to Win32k hooking mechanism, as by default only GdiDdDDI* hooks are installed
    -- You can force the installation of other hooks by specifying them with "EnableWin32Hook=..."
    -- or disable the installation of the default hooks with "DisableWin32Hook=..."
    -- Please note that some Win32k hooks may cause BSODs or undefined behaviour. (!)
    -- The most obviously problematic Win32k hooks are blacklisted, this can be bypassed with "IgnoreWin32HookBlacklist=y"
    added debug option "AdjustBoxedSystem=n" to disable the adjustment of service ACLs running with a system token
    added "NoUACProxy=y" option together with the accompanying template, in order to disable UAC proxy
    -- Note: Boxes configured in compartment mode activate this template by default
    added UI option to change default RpcMgmtSetComTimeout preset
    added Plus installer option to start the default browser under Sandboxie through a desktop shortcut
    added more entries to the Plus installer (current translations on Languages.iss file need to be updated)

Changed

    "EnableWin32kHooks=y" is now enabled by default, as no issues were reported in 1.0.3
    -- Note: currently only the GdiDdDDI* hooks are applied, required for Chromium HW acceleration
    Cleaned up low level hooking code a bit
    "RunRpcssAsSystem=y" is now auto applied for boxes in "App Compartment" mode when "RunServicesAsSystem=y" or "MsiInstallerExemptions=y" are present

Fixed

    fixed RPC handling in case a requested open service is not running #1443
    fixed a hooking issue with NdrClientCall2 in 32 bit applications
    fixed issue with start directory to run sandboxed when using SandMan #1436
    fixed issue with recovering from network share locations #1435

[close]

https://github.com/sandboxie-plus/Sandboxie/releases