Thema: Sandboxie / Shade Sandbox

[SiLæncer]

Sandboxie-Plus is a fork of Sandboxie designed to address various problems as well as adding improved functionality.

Sandboxie allows you to run programs in an isolated and protected space. This protected space will prevent any permanent changes being made to other programs and data to your computer allowing to test, play and utilize them without fear of harming your machine.

Sandboxie-Plus fixes many known issues and security holes of the last official Sandboxie release, adds new functionality, most notably a new Qt-based UI SandMan.exe that is far more advanced than the old MFC based SbieCtrl.exe UI. The security fixes are essential as they effectively close privilege escalation and sandbox escape issues present in the last 5.33.6 official build.

License: Open Source

Changelog

Added

    added option to alter reported Windows version "OverrideOsBuild=7601" for Windows 7 SP1
    the trace log can now be structured like a tree with processes as root items and threads as branches

Changed

    SandboxieCrypto now always migrates the CatRoot2 files in order to prevent locking of real files
    greatly improved trace log performance
    MSI Server can now run with the "FakeAdminRights=y" and "DropAdminRights=y" options
    -- special service allowance for the MSI Server can be disabled with "MsiInstallerExemptions=n"
    changed SCM access check behaviour; non elevated users can now start services with a user token
    -- elevation is now only required to start services with a system token
    reworked the trace log mechanism to be more verbose
    reworked RPC mechanism to be more flexible

Fixed

    fixed issues with some installers introduced in 5.48.0
    fixed "add user to sandbox" in the Plus UI
    FIXED SECURITY ISSUE: the HostInjectDll mechanism allowed for local privilege escalation (thanks hg421)
    Classic UI no longer allows to create a sandbox with an invalid or reserved device name

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added "UseSbieWndStation=y" to emulate CreateDesktop for selected processes, not only for Firefox and Chrome
    added option to drop the console host process integrity, now you can use "DropConHostIntegrity=y"
    added option to easily add local templates

Changed

    reworked window hooking mechanism to improve performance
    -- resolves issues with file save dialogs taking 30+ sec to open
    -- this fix greatly improves the win32 GUI performance of sandboxed processes
    reworked RPC resolver to be ini configurable
    -- the following options are now deprecated:
    --- "UseRpcMgmtSetComTimeout=some.dll,n", so use "RpcPortBinding=some.dll,*,TimeOut=y"
    --- "OpenUPnP=y", "OpenBluetooth=y", "OpenSmartCard=n" use the new templates instead
    -- See the Templates.ini for usage examples

Fixed

    fixed process-specific hooks being applied to all processes in a given sandbox
    fixed issue with messages and templates sometimes not being properly displayed in the SandMan UI
    fixed issue with compatibility settings not being applied properly
    fixed auto delete issue that got introduced with 0.7.1
    fixed issue with NtSetInformationFile, FileDispositionInformation resulting in Opera installer failing
    fixed issue with MacType introduced in the 0.7.2 build
    fixed global sandboxed windows hooks not working when window rename option is disabled
    fixed issue with saving local templates
    fixed issue when using runas to start a process that was created outside of the Sandboxie supervision
    -- since the runas facility is not accessible by default, this did not constitute a security issue
    -- to enable runas functionality, add "OpenIpcPath=\RPC Control\SECLOGON" to your Sandboxie.ini
    -- please take note that doing so may open other yet unknown issues
    fixed a driver compatibility issue with Windows 10 32 bit Insider Preview Build 21337
    fixed issues with driver signature for windows 7

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added "UseSbieWndStation=y" to emulate CreateDesktop for selected processes, not only for Firefox and Chrome
    added option to drop the console host process integrity, now you can use "DropConHostIntegrity=y"
    added option to easily add local templates
    added option to disable file migration prompt
    added UI options for variouse security isolation features
    added missing functionality to set template values in the plus UI

Changed

    reworked window hooking mechanism to improve performance
    -- resolves issues with file save dialogs taking 30+ sec to open
    -- this fix greatly improves the win32 GUI performance of sandboxed processes
    reworked RPC resolver to be ini configurable
    -- the following options are now deprecated:
    --- "UseRpcMgmtSetComTimeout=some.dll,n", so use "RpcPortBinding=some.dll,*,TimeOut=y"
    --- "OpenUPnP=y", "OpenBluetooth=y", "OpenSmartCard=n" use the new templates instead
    -- See the Templates.ini for usage examples
    Align default settings of AutoRecover and Favorites to the Plus version (thanks isaak654)
    list of email clients and browsers is now centralized on Dll_GetImageType

Fixed

    fixed process-specific hooks being applied to all processes in a given sandbox
    fixed issue with messages and templates sometimes not being properly displayed in the SandMan UI
    fixed issue with compatibility settings not being applied properly
    fixed auto delete issue that got introduced with 0.7.1
    fixed issue with NtSetInformationFile, FileDispositionInformation resulting in Opera installer failing
    fixed issue with MacType introduced in the 0.7.2 build
    fixed global sandboxed windows hooks not working when window rename option is disabled
    fixed issue with saving local templates
    fixed issue when using runas to start a process that was created outside of the Sandboxie supervision
    -- since the runas facility is not accessible by default, this did not constitute a security issue
    -- to enable runas functionality, add "OpenIpcPath=\RPC Control\SECLOGON" to your Sandboxie.ini
    -- please take note that doing so may open other yet unknown issues
    fixed a driver compatibility issue with Windows 10 32 bit Insider Preview Build 21337
    fixed issues with driver signature for windows 7
    fixed minor issue with logging internet blocks
    fixed issue with file recovery when located on a network share
    fixed ui issue with CallTrace
    fixed crated sandbox links gettign double extension
    fixed misplaced labels in the classic ui (thanks isaak654)
    fixed separator line in Sbiectrl (thanks isaak654)

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    with "OpenClipboard=n" clipboard access for a sandbox can be now disabled

Changed

    now by default the OpenBluetooth template is enabled to enable compatybility with unity games
    "PreferExternalManifest=program.exe,y" can now be set on a per process basis

Fixed

    fixed compiled issues with the most recent vs2019 update
    fixed issue with vivaldi browser
    fixed some issues with box options in the plus ui
    fixed some issues with hw acceleration in chromium based browsers
    the stop all command now issues "kmdutill scandll" first to solve issues when the SbieDll.Dll is in use
    workaround for electorn apps, by forcing a additional commandline argument on the gpu renderer process

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    Sandboxie now applies by default "Close...=!,..." directives to non-excluded images if they are located in a sandbox
    -- added 'AlwaysCloseForBoxed=n' to disable this behaviour as it may not be always desired, and it doesn't provide extra security
    added process image information to Sandman UI
    localized template categories in the Plus UI
    added "DisableResourceMonitor=y" to disable resource access monitor for selected boxes
    added option to show trace entries only for the selected sandbox
    added "UseVolumeSerialNumbers=y" that allows drive letters to be suffixed with the volume SN in the \drive\ sandbox location
    -- it helps to avoid files mixed together on multiple pendrives using the same letter
    -- note: this option is not compatible with the recovery function of the Classic UI, only SandMan UI is fully compatible

Changed

    portable cleanup message now has y/n/c options
    consolidated Proc_CreateProcessInternalW and Proc_CreateProcessInternalW_RS5 to remove duplicate code
    the ElevateCreateProcess fix, as sometimes applied by the Program Compatibility Assistant, will no longer be emulated by default
    -- use 'ApplyElevateCreateProcessFix=y' or 'ApplyElevateCreateProcessFix=program.exe,y' to enable it
    trace log gets disabled only when it has no entries and the logging is stopped

Fixed

    fixed APC issue with the new global hook emulation mechanism and WoW64 processes
    fixed IPv6 issues with BlockPort options
    fixed an issue with CheatEngine when "OpenWinClass=*" was specified
    fixed memory corruption in SbieDrv
    fixed crash issue with process elevation on CreateProcess calls
    fixed process elevation when running in the built-in administrator account
    fixed template preview resetting unsaved entries in box options window

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Fixed

fixed an issue with driver verifier and user handles
fixed driver memory leak of FLT_FILE_NAME_INFORMATION objects
fixed broken clipboard introduced in 5.50.0
fixed dcom launch issue on windows 7 32 bit introduced in 5.50.0

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Fixed

properly fixed an issue with Driver Verifier and user handles
fixed an issue with CreateWindow function introduced with 0.8.0
fixed issue with outdated BoxDisplayOrder entries being retained

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added global hotkey to terminate all boxed processes (by default Ctrl+Break)
    the Run Sandboxed dialog can now be handled by the Sandman UI.
    added "AllowBoxedJobs=y" allowing boxed processes to use nested jobs on Windows 8 and later
    -- note: this allows Chrome and other programs to use the job system for additional isolation
    added librewolf.exe to the list of Firefox derivatives #927
    added run regedit sandboxed menu command
    added new support settings tab to Sandman UI for updates and stuff
    added code integrity verification to Sbie service and UI
    added template for Vivaldi Notes (by isaak654) #948

Changed

    Replaced the Process List used by the driver with a much faster Hash Map implementation
    -- Note: this change provides an almost static system call speed of 1.2us irregardless of the running process count
    -- The old list, with 100 programs running required: 4.5µs; with 200: 12µs; and with 300: 18µs per syscall
    -- Note: some of the slowdown was affecting also non sandboxed applications due to how the driver handles certain callbacks
    Replaced the per-process Thread List used by the driver with a much faster Hash Map implementation
    Replaced configuration section list with a hash map to improve configuration performance, and increased line limit to 100000
    -- not yet enabled in production build
    the presence of default box is only checked on connect
    the portable dir dialog now shows the directory #924
    when terminated boxed processes now we first try doing that by terminating the job object
    the driver now by default can terminate problematic processes without the help of the service
    box delete routine now retries up to 10 times to fix #954
    Replaced the Process List used by the service with a much faster Hash Map implementation
    Replaced the per-process Thread List used by the service with a much faster Hash Map implementation

Fixed

    fixed faulty initialization in SetServiceStatus (by flamencist) #921
    fixed buttons position in Classic UI settings (by isaak654) #914
    fixed missing password length check in the Sandman UI #925
    fixed issues opening job objects by name
    fixed missing permission check when reopening job object handles (thanks Diversenok)
    fixed issue with some Chromium 90+ hooks affecting PDF plugin in derived browsers #930 #817
    fixed issues with reconnecting broken LPC ports used for communication with SbieSvc
    fixed minor setting issue #957
    fixed minor UI issue with resource access COM settings #958
    fixed an issue with NtQueryKey using NtQueryObject instead #951
    fixed crash in key.c when failing to resolve key paths
    added workaround for topmost modality issue #873
    -- the notification window is not only topmost for 5 seconds
    fixed an issue deleting directories introduced in 5.49.5
    fixed an issue when creating box copies
    fixed performance bug introduced in 0.8.5

Removed

    removed switch for "BlockPassword=n" as it does not seem to be working #938
    -- it's recommended to use "OpenSamEndpoint=y" to allow for password change in windows 10

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

    Added:

    Added option to always auto pick the DefautlBox sandbox #959
    When this option is enabled the normal behavioure with a box selection dialog can be achived holding down CTRL
    Added option to hide boxed form the run in box dialog
    Usefull to avoidl listing for example insecure compatybility test boxes
    Added box options to sys tray #439 #272

    Changed:

    Changed default terminate all boxed processes key from Ctrl+Break to Ctrl+Alt+Break #974
    Start.exe does no longer link in all that unused MFC code reduced file size form over 2.5MB to below 250KB
    Updated the main sandman and tray icon #963
    Improved the bov view tree style

    Fixed:

    Added additional delay and retryes to kmdutill.exe to mitigate issues when unloading the driver #968
    Fixed issue with sbiectrl not being properly started after setup #969
    Fixed issue with explore sandboxed shell option #972
    Fixed issue when running sandman elevated #932
    Fixed new box selection dialog showing disabled boxes
    Fixed issue updating box active status

    Removed:

    Removed Online Armor support as this product is deprecated since 2016

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Whats new:>>

fixed issue with boxes that head auto delete activated introduced in the previous build

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Changed

    MSIServer no longer requirers being run as system completing the move to not using system tockens in a sandbox by default
    -- the security enhanced option "MsiInstallerExemptions=n" is now the default behavioure

Fixed

    fixed issue with the "Explore Sandboxed" command #972
    rolled back the switch from using NtQueryKey to NtQueryObject as it seams to bream soem older w10 versions liek 1803 #984
    -- this change was introduced to fix #951
    -- to use NtQueryObject the option "UseObjectNameForKeys=y" can be added to sandboxie.ini

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Changed

    updated a few icons
    updated GitHub build action to use Qt 5.15.2
    improved the "full" tray icon to be more distinguishable from the "empty" one
    changed code integrity verification policies
    -- code signature is no longer required to change config, to protect presets use the existing "EditAdminOnly=y"

Fixed

    fixed issue with systemless MSI mode introduced in the last build
    fixed MSI installer not being able to create the action server mechanism on Windows 11
    fixed MSI installer not working in systemless mode on Windows 11
    fixed Inno Setup script not being able to remove shell integration keys during Sandboxie Plus uninstall (by mpheath) #1037

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added support for Windows Filtering Platform (WFP) to be used instead of the device-based network blocking scheme
    -- to enable this support, add 'NetworkEnableWFP=y' to the global section and reboot or reload the driver
    -- to use WFP for a specified sandbox, add 'AllowNetworkAccess=n' to said box
    -- you can exempt certain processes from blocking by using 'AllowNetworkAccess=program.exe,y'
    -- you can also enable this policy globally by adding 'AllowNetworkAccess=n' to the global section
    -- in this case you can exempt entire boxes by adding 'AllowNetworkAccess=n' to said boxes
    -- specifying 'AllowNetworkAccess=program.exe,n' will block the access only for the named process
    -- Note: WFP is less absolute than the old approach, using WFP will filter only TCP/UDP communication
    -- restricted boxed processes will still be able to resolve domain names using the system service
    -- however, they will not be able to send or receive data packets directly
    -- the advantages of WFP is that filter rules can be implemented by restricting communication only to specified addresses or selected ports using "NetworkAccess=..."
    added fully functional rule-based packet filter in user mode for the case when "NetworkEnableWFP=y" is not set
    -- the mechanism replaces the old "BlockPort=..." functionality
    -- Note: this filter applies only to outgoing connections/traffic, for incoming traffic either the WFP mode or a third-party firewall is needed
    -- like the old user mode based mechanism, malicious applications can bypass it by unhooking certain functions
    -- hence it's recommended to use the kernel mode WFP-based mechanism when reliable isolation is required
    -- Note: the main reason this mechanism was added in user mode is to allow for easier debugging
    added new trace option "NetFwTrace=*" to trace the actions of the firewall components
    -- please note that the driver only trace logs the kernel debug output, use DbgView.exe to log
    API_QUERY_PROCESS_INFO can now be used to get the impersonation token of a sandboxed thread
    -- Note: this capability is used by TaskExplorer to allow inspecting sandbox-internal tokens
    -- Note: a process must have administrative privileges to be able to use this API
    added a UI option to switch "MsiInstallerExemptions=y" on and off
    -- just in case, if a future Windows build breaks something in the systemless mode
    added sample code for ObRegisterCallbacks to the driver
    added new debug options "DisableFileFilter=y" and "DisableKeyFilter=y" that allow to disable file and registry filtering
    -- Note: these options are for testing only and disable core parts of the sandbox isolation
    added a few command line options to SandMan.exe

Changed

    greatly improved the performance of the trace log, but it's no longer possible to log to both SandMan and SbieCtrl at the same time
    changed code integrity verification policies
    -- code signature validation of user mode components is disabled when Windows is booted in test-signing mode
    reworked process creation code to use PsSetCreateProcessNotifyRoutineEx and improved process termination

Fixed

    added missing hook for ConnectEx function


0.8.9 HotFix 2

Fixed

Fixed issue with registering session leader


0.8.9 HotFix 1

Fixed

Fixed issue with windows 7

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added tray icon indicating no connection to the driver if it happens
    added option to customize the tray icon
    added "DllSkipHook=some.dll" option to disable installation of hooks into selected DLLs
    added localization support for Plus installer (by yfdyh000 and mpheath) #923

Changed

    reworked NtClose handling for better performance and extendibility
    improved tray box menu and list

Fixed

    fixed issue with fake admin and some NSIS installers #1052
    fixed more issued with FileDispositionInformation behaviour, which resulted in bogus file deletion handling
    fixed issue with checking WFP status
    fixed issue WFP failing to initialize at boot
    fixed issue with tray sandbox options not being available just after boot
    fixed issue access changed flag not being proeprly set in box options #1065

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Whats new:>>

Added

    added ability to reconfigure teh driver, allowing to enable/disable WFP and otehr features without a reload/reboot

Fixed

    fixed issue with process start handling introduced in 5.51.0 #1063
    fixed issue with quick recovery introduced in 5.51.0
    fixed incompatybility with CET Hardware-enforced Stack Protection on intel 11th gen and AMD 5xxxX cpu's #1067 #1012

removed

    commented out all windows xp specific support code

https://github.com/sandboxie-plus/Sandboxie/releases