Thema: Sandboxie / Shade Sandbox

[SiLæncer]

Sandboxie-Plus is a fork of Sandboxie designed to address various problems as well as adding improved functionality.

Sandboxie allows you to run programs in an isolated and protected space. This protected space will prevent any permanent changes being made to other programs and data to your computer allowing to test, play and utilize them without fear of harming your machine.

Sandboxie-Plus fixes many known issues and security holes of the last official Sandboxie release, adds new functionality, most notably a new Qt-based UI SandMan.exe that is far more advanced than the old MFC based SbieCtrl.exe UI. The security fixes are essential as they effectively close privilege escalation and sandbox escape issues present in the last 5.33.6 official build.

License: Open Source

Changelog

Added

    added core version compatybility check to sandman UI
    added shell integration options to SbiePlus

Changed

    SbieCtrl does not longer auto show the tutorian on first start
    when hooking, the to the trampoline migrated section of the original function is not longer noped out
    -- it caused issues with unity games, will be investigated and re enabled later

Fixed

    fixed color issue with vertical tabs in dark mode
    fixed wrong path separators when adding new forced folders
    fixed directroy listing bug intriduced in 5.43
    fixed issues with settings window when not being connected to driver
    fixed issue when starting sandman ui as admin
    fixed auto content delete not working with sandman ui

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added explore box content menu option

Fixed

    fixed thread handle leak in SbieSvc and other components
    msedge.exe is now categorized as a chromium derivate
    fixed chrome 86+ compatybility bug with chroms own sandbox

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added SbieLdr (experimental)

Changed

    moved code injection mechanism from SbieSvc to SbieDll
    moved function hooking mechanism from SbieDrv to SbieDll
    introduced a new driverless method to resolve wow64 ntdll base address

removed

    removed support for windows vista x64

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added new notification window
    added user interactive control mechanism when using the new SandMan UI
    -- when a file exeeds the copy limit instead of failing, the user is prompted if the file should be copied or not
    -- when internet access is blocked it now can be exempted in real time by the user
    added missing file recovery and auto/quick recovery functionality
    added silent MSG_1399 boxed process start notification to keep track of short lived boxed processes
    added ability to prvent system wide process starts, sandboxie can now instead of just alerting also block processed on the alert list
    -- set "StartRunAlertDenied=y" to enable prcess blocking
    the process start alert/block mechanism can now also handle folders use "AlertFolder=..."
    added ability to merge snapshots
    added icons to the sandbox context menu in the new UI
    added more advanced options to the sandbox options window
    added file migration progress indicator
    added more run commands and custom run commands per sandbox
    -- the the box settings users can now speficy programs to be available from the box run menu
    -- also processes can be pinned to that list from the presets menu
    added more windows 10 specific template presets
    added ability to create desktop shortcuts to sandboxed items
    added icons to box option tabs
    added box grouping
    added new debug option "DebugTrace=y" to log debug output to the trace log
    added check for updates to the new SandMan UI
    added check for updates to the legacy SbieCtrl UI

Changed

    File migration limit can now be disabled by specifying "CopyLimitKb=-1"
    improved and refactored mesage logging mechanism, reducing memory usage by factor of 2
    terminated boxed processes are now kept listed for a coupel of seconds
    reworked sandbox dletion mechaism ofthe new UI
    restructured sandbox options window
    SbieDLL.dll can now be compiled with an up to date nitll.lib
    improved automated driver self repair

Fixed

    fixed issues migrating files > 4GB
    fixed a issue that would allow a maliciosue application to bypass the internet blockade
    fixed issue when logging messages from a non sandboxed process, added process_id parameter to API_LOG_MESSAGE_ARGS
    fixed issues with localization
    fixed issue using file recovery in legacy ui SbieCtrl.exe when "SeparateUserFolders=n" is set
    when a program is blocked from starting due to restrictions no redundant messages are issues anymore
    fixed UI not properly displaying async errors
    fixed issues when a snapshot operation failed
    fixed some special cases of IpcPath and WinClass in the new UI
    fixed driver issues with WHQL passing compatybility testing
    fixed issues with classical installer

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    Added simple view mode

Changed

    Updated SandMan UI to use Qt5.15.1

Fixed

    fixed crash issue with progress dialog
    fixed progress dialog cancel button not wokong for update checker
    fixed issue around NtQueryDirectoryFile when deleting sandbox content
    fixed dark theme in the notification window
    fixed issue with disable force pograms tray menu

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added advanced new box creation dialog to sandman ui
    added show/hide tray context menu entry
    added refresh button to file recovery dialog
    added mechanism to load icons from {install-dir}/Icons/{icon}.png for UI customization
    added tray indicator to show disabled forced program status in the sandman ui
    added program name suggestions to box options in sandman ui
    added saving of column sizes in the options window

Changed

    reorganized the advanced box options a bit
    changed icons (thanks Valinwolf for picking the new once)
    updated Template.ini (thanks isaak654)
    increates max value for disable forced process time in sandman ui

Fixed

    fixed BSOD introduced in 5.45.0 when using windows 10 "Core isolation"
    fixed minor issue with lingering/leader processes
    fixed menu issue in sandman ui
    fixed issue with stop behavioure page in sandman ui
    fixed issue with Plus installer not displaying kmdutil window
    fixed sandman UI saving ui settings on windows shutdown
    fixed issue with Plus installer autorun
    fixed issue with legacy installer not removing all files
    fixed a driver compatybility issue with windows 20H1 and later
    -- this solves "stop pending", line messager hanging and other issues...
    fixed quick recovery issue in SbieCtrl.exe introduced in 5.45.0
    fixed issue advanced hide process settings, not saving
    fixed some typos in the UI (thanks isaak654)
    fixed issue with GetRawInputDeviceInfo failing when boxed processes are put in a job object
    -- this fix resolves isses with CP2077 andother PC Games not getting keyboard input (thanks Rostok)
    fixed failing ClipCursor wont longer span the message log
    fixed issue with adding recovery folders in sandman ui
    fixed issue with office 2019 template when using a non default sbie install location
    fixed issue settign last access atribute on sandboxed folders
    fixed issue with process start signal

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added prompt to choose if links in the sandman ui should be open in a sandboxed or unsandboxed browser
    added more recovery options, "recovery & ..." and more recver to options
    added "ClosedClsid=" to block com objects from being used when thay cause compatybility issues
    added "ClsidTrace=*" option to trace COM usage
    added "ClosedRT=" option to block access to problematic Windows RT interfaces
    added option to make a link for any selected process to sandman ui
    added option to reset all hidden messages
    added more process presets "Force program" and "allow internet access"
    added "SpecialImage=chrome,some_electron_app.exe" option to sandboxie.ini, valid image types "chrome", "firefox"
    -- with this option you can enable special hardcoded workarounds to new obscure forks of those browsers
    added german translation (thanks bastik-1001) to the sandman UI
    added russian translation (thanks lufog) to the sandman UI
    added portuguese translation (thanks JNylson ) to the sandman UI

Changed

    changed docs and update urls to the new sandboxie-plus.com domain
    greately improved the innos etup script (thanks mpheath)
    "OpenClsid=" and "ClosedClsid=" now support specifyed a program or group name
    by default when started in portable mode the sandbox folder will be located to the parent directory of the sandboxie instance

Fixed

    grouping menu not fully working in the new sandman ui
    fixed can't set quick recovery in sandman ui
    fixed resource leak when loading process icons in sandman ui
    fixed issue with OpenToken debug options
    fixed chrome crashing on websites that cause the invocation of "FindAppUriHandlersAsync"
    fixed issue connecting to the driver when starting in portable mode
    fixed missing template setup when creating new boxes

removed

    removed obsolete "OpenDefaultClsid=n" use "ClosedClsid=" with the aproproate values instead
    removed suspend/resume menu entry, pooling that state wasts substantial cpu cycles, use task explorer for that functionality

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    Sandboxie now strips particularly problematic privileges from sandboxed system tokens
    -- with those a process could atempt to bypass the sandbox isolation (thanks Diversenok)
    -- old legacy behavior can be enabled with "StripSystemPrivileges=n" (absolutely NOT Recommended)
    added new isolation options "ClosePrintSpooler=y" and "OpenSmartCard=n"
    -- those resources are open by default but for a hardened box its desired to close them
    added print spooler filter to prevent printers from being set up outside the sandbox
    -- the filter can be disabled with "OpenPrintSpooler=y"
    added overwrite prompt when recovering an already existing file
    added "StartProgram=", "StartService=" and "AutoExec=" options to the SandMan UI
    added more compatybility templates (thanks isaak654)

Changed

    Changed Emulated SCM behavior, boxed services are no longer by default started as boxed system
    -- use "RunServicesAsSystem=y" to enable the old legacy behavior
    -- Note: sandboxed services with a system token are still sandboxed and restricted
    -- However not granting them a system token in the first place removes possible exploit vectors
    -- Note: this option is not compatible with "ProtectRpcSs=y" and takes precedence!
    Reworked dynamic IPC port handling
    Improved Resource Monitor status strings

Fixed

    fixed a critical issue that allowed to create processes outside the sandbox (thanks Diversenok)
    fixed issues with dynamic IPC port handling that allowed to bypass IPC isolation
    fixed issue with ipc tracing
    fixed CVE-2019-13502 "\RPC Control\LSARPC_ENDPOINT" is now filtered by the driver (thanks Diversenok)
    -- this allowed some system options to be changed, to disable filtering use "OpenLsaEndpoint=y"
    fixed hooking issues SBIE2303 with chrome, edge and possibly others
    fixed failed check for running processes when performing snapshot operations
    fixed some box option checkboxes were not properly initialized
    fixed unavailable options are not properly disabled when sandman is not connected to the driver
    fixed MSI instalelr issue, not being able to create "C:\Config.Msi" folder on windows 20H2
    added missing localization to generic list commands
    fixed issue with "iconcache_*" when runngin sandboxed explorer
    fixed more issues with groups

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added "RunServiceAsSystem=..." allows specific named services to be ran as system

Changed

    refactored some code around SCM access

Fixed

    fixed a crash issue in SbieSvc.exe introduced with the last build
    fixed issue with sandman ui update check

Removed

    removed "ProtectRpcSs=y" due to incompatybility with new isolation defaults

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Changed

    improved access tracing, removed redundant entries
    OpenIpcPath=\BaseNamedObjects[CoreUI]-* is now hardcoded in the driver no need for the template entry
    WindowsFontCache is now open by default
    refactored some IPC code in the driver

Fixed

    fixed creation time not always being properly updated in the SandMan UI


0.5.4c

Hotfix2 (5.46.2) Changelog

Added

    added "CallTrace=*" to log all system calls to the access log

Changed

    improved ipc logging code
    improved MSG_2101 logging

Fixed

    fixed more issues with ipc tracing
    fixed SBIE2101 issue with crome and derivatives

Hotfix (5.46.1) Changelog

Added

    added "RunServiceAsSystem=..." allows specific named services to be ran as system

Changed

    refactored some code around SCM access

Fixed

    fixed a crash issue in SbieSvc.exe introduced with the last build
    fixed issue with sandman ui update check

Removed

    removed "ProtectRpcSs=y" due to incompatybility with new isolation defaults

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added "SandboxService=..." to force selected services to be started in the sandbox
    added template cleanup functionality to plus UI
    allow internet prompt now also allow internet access pemanently
    added browse button for box root folder in the SandMan UI
    added explorer info message
    added option to keep the sandman UI always on top
    added drag and drop file on to sandman exe to open/run it sandboxed
    added start SandMan UI when a sandboxed application starts
    recovery window can now list all files
    added file cunter to recovery window
    when "NoAddProcessToJob=y" is specified chrome and alike now can fully use the job system
    -- Note: "NoAddProcessToJob=y" reduces the box isolation, but the affected functions are mostly covered by UIPI anyways
    added obtimized default column widths to the sbie view

Changed

    improved access tracing, removed redundant entries
    OpenIpcPath=\BaseNamedObjects[CoreUI]-* is now hardcoded in the driver no need for the template entry
    WindowsFontCache is now open by default
    refactored some IPC code in the driver
    updated templates (thanks isaak654)
    when trying to take a snapshot of an empty sandbox a proper error message is displayed
    new layout for the recovery window
    sbie view sorting is now case insensitive

Fixed

    fixed issue allowing to bypass the registry isolation, present since Windows 10 Creators Update
    fixed creation time not always being properly updated in the SandMan UI
    fixed issue child window closing terminating application when main was hidden
    fixed issues with non modal windows
    fixed issues connecting in portable mode to driver
    fixed minor issues with snapshot window
    fixed missing error message when atempting to create an aleady existing sandbox
    fixed issue allowing to save setting when a sandbox was alrady deleted
    fixed issues with disabled items in dark mode
    fixed some dialogs not closing on esc
    fixed tab stops on many windows

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added comfirmation prompts to terminate all commands
    added window title to boxed process info
    added winspy based sandboxed window finder
    added option to view disabled boxes and double click on box to enable it

Changed

    reset columns now resized them to fit the content, also "Reset Columns" can now be localized
    modal windows are now centered to the parent
    improved new box window

Fixed

    fixed issues with window modality
    fixed issues when main window was set to be always on top
    fixed an driver issue with windows 10 insider build 21286
    fixed issues with snapshot dialog
    fixed an issue when writing to a path that aready exist in the napshot but not outside

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    added detection for waterfox.exe, Palemoon.exe, basilisk.exe and brave.exe firefox forks
    added bluetooth API support, IPC port can be opened with "OpenBluetooth=y"
    -- this should resolve issues with many unity games hanging on startup for a long time
    added enhanced RPC/IPC interface tracing
    when DefaultBox is not found by the SandMan UI, it will be recreated
    "Disable Forced Programs" time is now saved and reloaded

Changed

    reduced sandman cpu usage
    sandboxie.ini and templates.ini can now be UTF8 encoded
    -- this feature is experimental, files without a UTF-8 Signature should be recognized also
    -- "ByteOrderMark=yes" is obsolete, sandboxie.ini is now always saved with a BOM/Signature
    legacy language files can now be UTF8 encoded
    reworked file migration behaviour, removed hardcoded lists in favour of templates
    -- you can now use "CopyAlways=", "DontCopy=" and "CopyEmpty=" that support the same syntax as "OpenFilePath="
    -- "CopyBlockDenyWrite=program.exe,y" makes a write open call to a file that won't be copied fail instead of turning it read only
    removed hardcoded SkipHook list in favour of templates

Fixed

    fixed old memory pool leak in the sbie driver
    fixed issue with item selection in the access restrictions ui
    fixed updater crash in sbiectrl.exe
    fixed issues wih RPC calls introduced in sbie 5.33.1
    fixed recently broken terminate all command
    fixed a couple minor UI issues with Sandman UI
    fixed IPC issue with windows 7 and 8 resulting in process termination
    fixed "recover to" functionality

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    sandboxed indicator for tray icons, the tooltip now contains

• if enabled

    the trace log buffer can now be adjusted with "TraceBufferPages=2560"
    -- the value denotes the count of 4k large pages to be used, here for a total of 10 MB
    new functionality to the list finder

Changed

    improved RPC debugging
    improved IPC handling around RpcMgmtSetComTimeout, "RpcMgmtSetComTimeout=n" is now the default behavioure
    -- required exceptions have been hard coded for specific calling dll's
    the LogApi dll is now using Sbies tracing facility to logg events instead of an own pipe server

Fixed

    FIXED SECURITY ISSUE: elevated sandboxed processes could access volumes/disks for reading (thanks hg421)
    fixed crash issue around SetCurrentProcessExplicitAppUserModelID observed with GoogleUpdate.exe
    fixed issue with resource monitor sort by timestamp
    FIXED SECURITY ISSUE: a race condition in the driver allowed to obtain a elevated rights handle to a process (thanks typpos)
    FIXED SECURITY ISSUE: "\RPC Control\samss lpc" is now filtered by the driver (thanks hg421)
    -- this allowed elevated processes to change passwords, delete users and alike, to disable filtering use "OpenSamEndpoint=y"
    FIXED SECURITY ISSUE: "\Device\DeviceApi\CMApi" is now filtered by the driver (thanks hg421)
    -- this allowed elevated processes to change hardware configuration, to disable filtering use "OpenDevCMApi=y"

[close]

https://github.com/sandboxie-plus/Sandboxie/releases

[SiLæncer]

Changelog

Added

    sandboxed indicator for tray icons, the tooltip now contains

• if enabled

    the trace log buffer can now be adjusted with "TraceBufferPages=2560"
    -- the value denotes the count of 4k large pages to be used, here for a total of 10 MB
    new functionality to the list finder
    Enchanced RpcMgmtSetComTimeout handing with "UseRpcMgmtSetComTimeout=some.dll,n"
    -- this option allows to specify for each individual dll if RpcMgmtSetComTimeout should be used or not
    -- this setting takes precedence over hard coded and per process presets
    -- "UseRpcMgmtSetComTimeout=some.dll" and "UseRpcMgmtSetComTimeout=some.dll,y" are equivalent
    Added "FakeAdminRights=y" option that makes processes in a given box think thay have admin permissions
    -- this option is recomended to be used in combination with "DropAdminRights=y" to improve securits
    -- With "FakeAdminRights=y" and "DropAdminRights=y" installers should still work
    added RPC support for SSDP API (the Simple Service Discovery Protocol), Enable with "OpenUPnP=y"

Changed

    improved RPC debugging
    improved IPC handling around RpcMgmtSetComTimeout
    -- required exceptions have been hard coded for specific calling dll's
    the LogApi dll is now using Sbies tracing facility to logg events instead of an own pipe server
    SbieCrypto no longer triggers message 1313
    changed enum process API now more (no limit) than 511 proceses per box can be enumerated
    Reorganized box settings a bit
    Made COM tracing more verbose

Fixed

    FIXED SECURITY ISSUE: elevated sandboxed processes could access volumes/disks for reading (thanks hg421)
    fixed crash issue around SetCurrentProcessExplicitAppUserModelID observed with GoogleUpdate.exe
    fixed issue with resource monitor sort by timestamp
    FIXED SECURITY ISSUE: a race condition in the driver allowed to obtain a elevated rights handle to a process (thanks typpos)
    FIXED SECURITY ISSUE: "\RPC Control\samss lpc" is now filtered by the driver (thanks hg421)
    -- this allowed elevated processes to change passwords, delete users and alike, to disable filtering use "OpenSamEndpoint=y"
    FIXED SECURITY ISSUE: "\Device\DeviceApi\CMApi" is now filtered by the driver (thanks hg421)
    -- this allowed elevated processes to change hardware configuration, to disable filtering use "OpenDevCMApi=y"
    fixed issues with webcam access when the DevCMApi filtering is in place
    fixed issue with free download manager for 'AppXDeploymentClient.dll' RpcMgmtSetComTimeout=y is used
    fixed not all WinRM files were blocked by the driver, with "BlockWinRM=n" this file block can be disabled

[close]

https://github.com/sandboxie-plus/Sandboxie/releases