Thema: Sandboxie / Shade Sandbox

[SiLæncer]

Sandboxie-Plus is a fork of Sandboxie designed to address various problems as well as adding improved functionality.

Sandboxie allows you to run programs in an isolated and protected space. This protected space will prevent any permanent changes being made to other programs and data to your computer allowing to test, play and utilize them without fear of harming your machine.

Sandboxie-Plus fixes many known issues and security holes of the last official Sandboxie release, adds new functionality, most notably a new Qt-based UI SandMan.exe that is far more advanced than the old MFC based SbieCtrl.exe UI. The security fixes are essential as they effectively close privilege escalation and sandbox escape issues present in the last 5.33.6 official build.

License: Open Source

Changelog

    Added:

    sandbox top level exception handler to create crash dumps -- it can be enabled per process or globally using "EnableMiniDump=process.exe,y" or "EnableMiniDump=y" respectively -- the dump flags can be set as hex with "MiniDumpFlags=0xAABBCCDD" -- a preselected flag set for a verbose dump can be set with "MiniDumpFlags=Extended" -- Note: created dump files are located at: C:Sandbox%SANDBOX%
    added template support for Osiris and Slimjet browsers (by Dyras) #1454

    Changed:

    improved SbieDll initialization a bit
    doubled size of Name_Buffer_Depth #1342
    improved text filter in the templates view #1456

    Fixed:

    fixed issue with forced process display #1447
    fixed crash issue with GetClassName #1448
    fixed minor UI issue #1382
    fixed UI language preset issue #1348
    fixed grouping issues in SandMan UI #1358
    fixed issue with EnableWin32kHooks #1458

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Installers re-released with the following regression fix: #1468

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    replaced "Open with" with a Sandboxie dialog to work on Windows 10 #1138
    added ability to run Store apps in App Compartment mode (on Windows 11 requires COM to be open)
    added new debug options "UnstrippedToken=y" and "KeepUserGroup=y"
    added double click to recover files and folders in recovery window #1466
    added Ukrainian language on Plus UI (by SuperMaxusa) #1488

Changed

    "UseSbieWndStation=y" is now the default behaviour #1442
    disabled Win32k hooking when HVCI is enabled due to an incompatibility (BSOD) #1483

Fixed

    fixed box initialization issue in Privacy mode #1469
    fixed issue with shortcuts creation introduced in a recent build #1471
    fixed various issues in Privacy Enhanced boxes and rule specificity
    fixed issue with SeAccessCheckByType and alike
    fixed issues with Win32k hooking on 32 bit Windows #1479

Removed

    removed obsolete SkyNet rootkit detection from 32 bit build

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added experimental option "CreateToken=y" to create a new token instead of repurposing an existing one
    added option "DisableRTBlacklist=y" allowing to disable the hardcoded runtime class blacklist
    added new template "DeviceSecurity" to lock down access to device drivers on the system
    -- Note: This template requires RuleSpecificity being available to work properly
    added option to set a custom ini editor in the Plus UI #1475
    added option "LingerLeniency=n" to solve issue #997

Changed

    reworked syscall invocation code in the driver
    -- Win32k hooking is now compatible with HVCI #1483

Fixed

    fixed memory leak in driver (conf_user.c)
    fixed issue with file renaming in open paths introduced in 1.0.6
    fixed issue causing Chromium browsers not closing properly #1496
    fixed issue with start.exe #1517 #1516
    fixed SandMan issue with reused process IDs
    fixed KmdUtil sometimes not properly terminating the driver #1493

Removed

    removed OpenToken as it is only a shorthand for UnrestrictedToken=y and UnfilteredToken=y set together

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added Portuguese of Portugal on Plus UI (by JNylson, isaak654, mpheath) #1497
    added "BreakoutProcess=program.exe", with this option selected applications can be started unboxed from within a box #1500
    -- the program image must be located outside the sandbox for this to work
    -- if another sandbox has "ForceProcess=program.exe" configured, it will capture the process
    -- use case: set up a box with a Web browser forced, when another box opens a website, this will happen in the dedicated browser box
    -- Note: "BreakoutFolder=some\path" is also available
    added silent uninstall switch /remove /S for Classic installer (by sredna) #1532

Changed

    The filename "sandman_pt" was changed to "sandman_pt_BR" (Brazilian Portuguese) #1497
    The filename "sandman_ua" was changed to "sandman_uk" (Ukrainian) #1527
    -- Note: Translators are encouraged to follow the Localization notes and tips before creating a new pull request
    updated Firefox update blocker (discovered by isaak654) #1545

Fixed

    fixed issue with opening all file access OpenFilePath=* #971
    fixed issue with opening network shares #1529
    fixed possible upgrade issue with Classic installer (by isaak654) 130c43a
    fixed minor issues with Classic installer (by sredna) #1533
    fixed issue with Ldr_FixImagePath_2 #1507
    when using "Run Sandboxed" with SandMan UI and the UI is off, it wil stay off.
    fixed issue with Util_GetProcessPidByName that should resolve the driver sometimes failing to start at boot #1451
    SandMan will now run in background like SbieCtrl when starting a boxed process post506
    fixed taskbar not showing with persistent box border in full screen post474
    fixed box border not spanning across multiple monitors #1512
    fixed issues with border when using DPI scaling #1506
    fixed DPI issues with Qt #1368
    fixed issue with bright flashing on window creation when in dark mode #1231
    fixed issues with the PortableRootDir setting #1509
    fixed issue with the settings window crashing when the driver was not connected
    fixed DPI issues with Finder Tool #912
    fixed another issue with reused process IDs #1547
    fixed issue introduced in 1.0.6 related to SeAccessCheckByType #1548

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    SandMan now causes all boxed processes to update their path settings in real time when access options were modified
    added new maintenance menu option "Uninstall All" to quickly remove all components when running in portable mode
    added version number to the title bar of Sandboxie Classic
    added option to return not to a snapshot but to an empty box state while keeping all snapshots
    Sandboxie-Plus.ini can now be placed in C:\ProgramData\Sandboxie-Plus\ folder and takes precedence (for business use)
    added support for AF_UNIX on Windows to resolve issues with OpenJDK17 and later #1009 #1520 #1521

Changed

    reworked breakout mechanism to be service based and not allowing the parent process to access the broken out child process
    enabled creation of directory junctions for sandboxed processes #1375
    restored back AutoRecover=y on box creation #1554
    improved snapshot support #1220
    renamed "Disable Forced Programs" command to "Pause Forced Programs Rules" (Plus only)

Fixed

    fixed BreakoutProcess not working with EnableObjectFiltering=y
    FIXED SECURITY ISSUE: when starting COMSRV unboxed, the returned process handle had full access
    fixed issue with progress dialog #1562
    fixed issue with handling directory junctions in Sandboxie #1396
    fixed a handle leak in File_NtCloseImpl
    fixed border issues on maximized windows introduced in the last build #1561
    fixed a couple of index overruns (thanks 7eRoM) #1571
    fixed issues with sysnative directory #1403
    fixed issue with starting SandMan when running sandboxed from context menu #1579
    fixed dark mode flash issue with main window creation #1231
    fixed issues with snapshot error handling #350
    fixed issues with the always on top option (Plus only)

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added option to show only boxes in tray with runnign processes #1186
    -- additional option show only pinned bixes, in box options a bix can be set to be always shown in theay list (Pinned)
    added options menu command to reset the GUI #1589
    added 'Run Un-Sandboxed' context menu option
    added new trigger "OnBoxDelete" that allows to specify a command that is run UNBOXED just before the box content gets deleted
    -- note: this can be used as a replacemetn to the DeleteCommand #591
    sellected box operations (deletion) no longer show the progress dialog 1061
    -- instead a box with a running operation show a blinking hour glass icon, the context menu can be used to cancel the operation

Changed

    HideHostProcess=program.exe can now be used to hide sandboxie services #1336
    updater blocking is now done using a template called BlockSoftwareUpdaters
    enchanced "StartProgram=..." making "StartCommand=..." obsolete
    -- for same functionality as "StartCommand=..." use "StartProgram=%SbieHome%\Start.exe ..."
    merged "Auto Start" General tab with the "Auto Exec" Advanced tab into a universal"Triggers" Advanced tab

Fixed

    fixed a couple issues with the new breakout process feature and improved security (thanks Diversenok)
    fixed issues with re opening already open windows #1584
    fixed issue with desktop access #1588
    fixed issue handling commandline invokation #1133
    fixed ui issue with main window state when switching always on top attribute #1169
    fixed issue with box context menu in tray list 1106
    fixed issue with "AutoExec=..."
    fixed issues canceling box deletion operations didn't working 1061
    fixed issue with DPI scalling and color picker dialog #803

Removed

    removed UseRpcMgmtSetComTimeout=AppXDeploymentClient.dll,y used for free download manager as it broke other things
    -- when using free download manager ad the line manually to your sandboxie.ini

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

   

Added

    added optional tray notification when a box content gets auto deleted
    added FreeDownloadManager template
    added warnign when opening unsandboxed regedit #1606
    added languages files that were missing in official Qt 5.15.2 (by DevSplash) #1605

Changed

    the asynchroniouse box operations introduced in the last build are due to a pupular request now disabled by default
    moved sys tray options from general to shell integration tab
    removed "AlwaysUseWin32kHooks", now these win32 hooks are always enabled
    -- note: you can use "UseWin32kHooks=program.exe,n" to disable them for sellected programs
    updated Listary template to v6 (by isaak654) #1610

Fixed

    fixed compatybility issue with SECUROM #1597
    fixed modality issue #1615

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

   

Added

    added mini dump creation to sandman.exe in case it crashes

Changed

    disabled Chrome and Firefox phishing entries in new sandboxes (by isaak654) #1616
    updated Mozilla paths for the BlockSoftwareUpdaters template (by isaak654) #1623
    renamed "Pause Forced Programs Rules" command to "Pause Forcing Programs" (Plus only)
    reworked tray icon generation now using overlays, added busy overlay

Fixed

    fixed issue with accessing network drives in privacy mode #1617
    fixed issue with ping in compartment mode #1608
    fixed SandMan UI freezing when a lot of processes are created and closed in a box
    fixed Editing existing 'Run Menu' Command Line entry not being recognized #1648
    fixed bsod issue in driver (thanks Diversenok)
    fixed incompatybility with windows 11 insider build 22563.1 #1654

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

   

Fixed

    FIXED SECURITY ISSUE: Hard link creation was not properly filtered (thanks Diversenok)
    fixed issue with checking the certificate entry.

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

   

Added

    added notification window to warn that the default update checker is often behind the newest release on GitHub, to ensure that only bug-free builds are offered as updates #1682
    added main browsers to BlockSoftwareUpdaters template (by Dyras) #1630
    added a warning when sandboxie-plus.ini is not writable #1681
    added cleanup for critical sections (by chunyou128) #1686

Changed

    improved command line handling for breakout processes #1655
    disabled SBIE2193 notification (by isaak654) #1690
    improved error message 6004 #1719

Fixed

    fixed dark mode issue with the new tray list
    fixed now showing a warning when sandboxie-plus.ini is not writable #1681
    fixed issue with software compatibility checkbox (thanks MitchCapper) #1678
    fixed issue with events on box close not always being executed #1658
    fixed memory leaks in key_merge.c
    fixed issue enumerating registry keys in privacy mode
    fixed setting issue introduced in 1.0.13 #1684
    fixed crash issue when parsing firewall port options
    FIXED SECURITY ISSUE: in certain usage cases a sandboxed process could obtain a handle on a unsandboxed thread with write privileges #1714

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Whats new:>>

Fixed

    fixed memory corruption introduced in the last build causing chrome to sometimes crash.
    FIXED SECURITY ISSUE: NtCreateSymbolicLinkObject was not filtered (thanks Diversenok)

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    FIXED SECURITY ISSUE: memory of unsandboxed processes can no longer be read, except for exceptions
    -- you can use ReadIpcPath=$:program.exe to allow read access to unsandboxed processes or processes in other boxes
    Added "Monitor Mode" to the resource access trace, similar to the old monitor view of sbiectrl.exe

Changed

    EnableObjectFiltering is now set enabled by default, and replaces sbies old process/thread handle filter
    the $: syntax now accepts a wildcard $:* no more specialized wildcards though

fixed

    fixed NtGetNextProcess being fully disabled instead of properly filtered
    fixed reworked image name resolution when creating new processes in a sandbox

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added checkbox to easeli allow read access to memory of unsandboxed processes (old sbie behavioure, not recommended)

Changed

    improved OpenProcess/OpenThread logging

Fixed

    Fixed crash issue with the new monitor mode
    Fixed issue with resource access entry parsing

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added minor browsers to BlockSoftwareUpdaters template (by APMichael) #1784

Changed

    Failed memory read attempts to unboxed processes will no longer cause message 2111 by default
    -- Note: the message can be enabled in the settings if desired with "NotifyProcessAccessDenied=y"
    reordered BlockSoftwareUpdaters template (by APMichael) #1785

Fixed

    fixed pipe impersonation in compartment mode
    fixed issue with box clean-up introduced in a recent build
    fixed missing trace log cleanup command #1773
    fixed unpin did not work #1694

[close]

https://github.com/sandboxie-plus/Sandboxie/releases