+- AiOwares (https://www.aiowares.com)
+-- Forum: Software & Applications (https://www.aiowares.com/forumdisplay.php?fid=6)
+--- Forum: Multi-Platform Software (https://www.aiowares.com/forumdisplay.php?fid=14)
+---- Forum: Windows (https://www.aiowares.com/forumdisplay.php?fid=42)
+---- Thread: Sandboxie-Plus (/showthread.php?tid=2968)
Pages:
1
2
Sandboxie-Plus - DavidXanatos - 09-10-2021
Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. It creates a sandbox-like isolated operating environment in which applications can be run or installed without permanently modifying local & mapped drives or the windows registry. An isolated virtual environment allows controlled testing of untrusted programs and web surfing.
Features
Sandboxie is available in two flavors, Plus and Classic. They both share the same core components, this means they have the same level of security and compatibility. What's different is the availability of features in the user interface.
Plus build has a modern Qt based UI, which supports all new features that have been added since the project went open source:
- Snapshot Manager - this feature takes a copy of any box in order to be restored when needed
- Maintenance mode - it allows to uninstall/install/start/stop Sandboxie driver and service when needed
- Portable mode - you can run the installer and choose to extract all files to a directory
- Additional UI options to block access for Windows components like printer spooler and clipboard
- More customization options for Start/Run and Internet access restrictions
- Global hotkey to terminate all boxed processes
- A new firewall per sandbox which supports Windows Filtering Platform (WFP)
If you need to check all new features at once, a good way to highlight them quickly is to search the equal sign in the detailed changelog.
Code:
The contents of this section are hiddenDownload:
Code:
The contents of this section are hiddenRE: Sandboxie-Plus - Skunk1966 - 09-10-2021
Coded your link (all links need to be coded)
Use the highlighted button (see image) to code links
![[Image: XEaWZkbO_o.jpg]](https://images2.imgbox.com/24/71/XEaWZkbO_o.jpg)
RE: Sandboxie-Plus - DavidXanatos - 09-10-2021
Okay, thanks
RE: Sandboxie-Plus - DavidXanatos - 09-12-2021
This release fixes an incompatibility with windows 11 build 22449 as well as fixes many bugs, it also improves a lot on the recovery feature and adds some minor otehr UI features.
If you have issues with an update installation, just uninstall the previous version keeping the sandboxie.ini and reinstall the new build.
Download:
Code:
The contents of this section are hiddenChangelog
Added
added ability to rename groups #1152
added ability to define a custom order for the sandboxes, you can move using the move context menu, or holding alt + arrow key
added recovery to list to the recovery window: #988
added finder to the recovery window
Changed
updated the BlockPort rule inside Template_BlockPorts to the new NetworkAccess format (by isaak654) #1162
default for immediate recovery behavioure is now th show the recovery window instzead of using the notifications window #988
the new run dialog now takes double click #1171
reworked the recovery window
Fixed
fixed issue with create group menu #1151
fixed issue when renaming a box it lost its group association
fixed issue with Thunderbird build 91+ #1156
fixed an issue with file disposition handling #1161
fixed issue with windows 11 22449.1000 #1164
fixed SRWare Iron template (by Dyras) #1146
fixed labels position in Classic UI (by isaak654) #1088
RE: Sandboxie-Plus - DavidXanatos - 10-02-2021
This is a test build which includes a lot of internal changes, required for future features and improvements.
This build changes how the sandboxie.ini is handled, hence it is recommended to create a backup just in case.
Download:
Code:
The contents of this section are hiddenChangelog
Added
added forced process indicator to process status column #1174
added "SbieTrace=y" option to trace the interaction between Sandboxie processes and the Sandboxie core components
when initializing an empty sandbox, MSI debug keys are set to generate the debug output of MSI installer service
added "DisableComProxy=y" allowing to disable COM proxying through the service
added "ProcessLimit=..." that allows to limit the max count of processes in a sandbox #1230
added missing IPC logging
Changed
reworked SbieSvc ini server to allow settings caching and greatly improve performance
-- Now comments in the Sandboxie.ini are being preserved as well as the order of all entries
enabled configuration section list replacement with a hash map to improve configuration performance
improved progress and status messages for the Plus installer (by mpheath) #1168
reworked RpcSs start mechanics, sandboxed RpcSs and DcomLaunch can now be run as system, use "RunRpcssAsSystem=y"
-- note: this is generally not recommended for security reasons but may be needed for compatibility in some scenarios
reworked WTSQueryUserToken handling to work properly in all scenarios
reworked configuration value list to use a hash table for better performance
Fixed
fixed Plus upgrade install in Windows 7 (by mpheath) #1194
fixed custom autoexec commands being executed on each box start instead of only on the initialization
fixed a design issue limiting the maximal amount of processes in one box to 511
fixed handle leaks in the lingering process monitor mechanism
fixed issue with opening device paths like "\??\FltMgr"
fixed build issue with an explicit FileDigestAlgorithm option for driver sign (by isaak654) #1210
fixed issue with resource access log sometimes getting corrupted
fixed issue with Microsoft Office Click-to-Run #428 #882
removed
removed support for Microsoft EMET (Enhanced Mitigation Experience Toolkit), as it was EOL in 2018
removed support for Messenger Plus! Live, as MSN Messenger is EOL since 2013
disabled Turkish language on Plus UI for inactivity (by isaak654) #1215
RE: Sandboxie-Plus - BALTAGY - 10-02-2021
@DavidXanatos Coded the link, please code any external links
btw do you still work on WuMgr ?
Thanks
RE: Sandboxie-Plus - DavidXanatos - 10-05-2021
Hi
ok will do that in future, sorry for forgetting it.
there isn't much to be done at WuMgr its just a tool that leverages the update API MSFT provides, AFAIK they did not updated this in years.
Cheers
David
RE: Sandboxie-Plus - DavidXanatos - 10-15-2021
This build fixes many bugs and add some new features.
Download:
Code:
The contents of this section are hiddenIf you have issues with an update installation, just uninstall the previous version keeping the sandboxie.ini and reinstall the new build.
Changelog
Added
added debug switch to disable Sbie console redirection "NoSandboxieConsole=y"
-- note that this was previously part of "NoSandboxieDesktop=y"
added Sbie+ version to the log #1277
added uninstall cleanup of extra files for the Plus installer (by mpheath) #1235
added set language for Sandman for the Plus installer (by mpheath) #1241
added EventLog messages with SbieMsg.dll for the Plus installer (by mpheath)
group expansion state is now saved
added additional filters to the trace tab
Changed
reworked and extended RPC logging
reintroduced the "UseRpcMgmtSetComTimeout=some.dll,n" setting to be used when no "RpcPortBinding" entry is specified
--- this allows to enable/disable out of box RPC binding independently from the timeout setting
the "BoxNameTitle" value can now be set explicitly on a per image name basis #1190
Fixed
fixed inability to delete read-only files from sandboxed explorer #1237
fixed wrong recovery target in Plus UI #1274
fixed SBIE2101 issue introduced with 0.9.7a #1279
fixed inability to delete read only files from sandboxed explorer #1237
fixed wrong recovery target in plus ui #1274
fixed sorting in the box picker window #1269
fixed tray refresh issue #1250
fixed tray activity display #1221
fixed recovery window not displaying in taskbar #1195
fixed dark theme preset not updating in real time #1270
fixed Microsoft Edge complaining about "FakeAdminRights=y" #1271
fixed issue with using local template in the global section #1212
fixed issue with git.exe from MinGW freezing #1238
fixed issue with search highlighting when using in dark mode
RE: Sandboxie-Plus - DavidXanatos - 10-25-2021
Download:
Code:
The contents of this section are hiddenChangelog 0.9.8c
Added
added explicit lines on Plus installer to delete empty shell registry keys at uninstall time (by mpheath) 3f661a8
Fixed
fixed template sections not showing in editor #1287
fixed autodelete box content broken in the previous build #1296 #1324
fixed crash in "Browse Content" window #1313
fixed issue with icon resolution on Windows 7 #1310
fixed invalid "No Inet" status in the status column #1312
fixed Windows Explorer search box not working (by isaak654) #1002
fixed Waterfox phishing template (by Dyras) #1309
fixed issue with Chinese translation files on Plus installer (by mpheath) #1317
fixed autorun registry key path on Plus installer (by mpheath) abd2d44
fixed memory corruption in SbieSvc.exe
Changelog 0.9.8b
Added
added ability to save trace log to file on Plus UI
added French language on Plus UI (by clexanis) #1155
Changed
network traffic trace is now properly logged to the driver log instead of to the kernel debug log
Plus installer will autostart SandMan.exe after install to fix a taskbar icon issue #3040211
Classic installer will show the license agreement when updating #1187
Fixed
fixed template sections not showing in editor #1287
fixed issue with app ID resulting in some apps showing two button groups in the taskbar #1101
fixed issue with maximum ini value length on Plus UI #1293
fixed issue handling an empty Sandboxie.ini that got introduced recently #1292
fixed issue with "SpecialImages" template (by Coverlin) #1288 #1289
fixed issue with box emptying #1296
fixed issues wich some languages #1304
fixed issue with mounted directories #1302
added missing translation for qt libraries #1305
fixed issue with Windows compatibility assistant #1265
fixed issue with process image specific settigns #1307
RE: Sandboxie-Plus - DavidXanatos - 11-17-2021
Version 1.0.0 is here and brings a lot of new major features, hence its a pre release, test it and expect new bugs as well, at least in the new features. I expect the final being 1.1.0 or so
The first major feature is Privacy Mode, here most of the PC is set to be treated like a Write[File/Key]Path meaning the sandbox locations are writable but the unsandboxed locations are not readable. The Hard disk appears empty except for C:\Windows and C:\Program Files and the registry only allows reading of the machine but not user root keys. This way sandboxed processes can work but can not access private user data.
To make this mode useful an other feature has been implemented called “Rule Specificity” it can be enabled independently but is always enabled in Privacy enhanced boxes. It allows to specify rules to override other rules, this is not based on specifying an order or priority, but instead by measuring how specific a rule is and always attributing the highest priority to the most specific rule.
Here the specificity is measures by the path length that matches the rule, except the last wildcard.
So for example the built in privacy rules plus a custom one
OpenFilePath=%AppData%\Mozilla\Firefox\Profiles*
NormalFilePath=C:\Program Files*
NormalFilePath=C:\Windows*
WriteFilePath=C:*
Here the rules are ordered by their specificity.
Also there is a new type Normal[File/Key/Ipc]Path which defines a default sandbox behavior for a path.
The next major feature is "App Compartment" mode "NoSecurityIsolation=y", this is a new mode of operation which disables the token based security isolation, which brings the security down to the level of other sand boxing solutions, but by doing so greatly improves compatibility. For all use cases where the goal is only compartmentalization, running multiple instances, etc, but not hard core security this mode is preferable as it should avoid many typical sandboxie issues caused by processes running with a heavily restricted token.
In this mode file system and registry accesses are still being filtered to enforce the access rules, this filtering can be disabled with "NoSecurityFiltering=y"
To ensure this “unsecure” mode is at least as secure as the sandboxing offered by other sandboxing products, a new object access filter was added that can be enabled with "EnableObjectFiltering=y" in the global settings.
If you have issues with an update installation, just uninstall the previous version keeping the sandboxie.ini and reinstall the new build.
You can support the project through donations, any help will be greatly appreciated.
Download:
Code:
The contents of this section are hiddenChangelog
Added
added Privacy enhanced mode, sandboxes with "UsePrivacyMode=y" will not allow read access to locations containing user data
-- all locations except generic Windows system paths will need to be opened explicitly for read and/or write access
-- using "NormalFilePath=...", "NormalKeyPath=...", "NormalIpcPath=..." allows to open locations to be readable and sandboxed
added new "App Compartment" mode of operation, it's enabled by adding "NoSecurityIsolation=y" to the box configuration
-- in this mode, security is traded in for compatibility, it should not be used for untrusted applications
-- note: in this mode, file and registry filtering are still in place, hence processes run without administrative privileges
-- it is reasonably safe, all filtering can be disabled with "NoSecurityFiltering=y"
added experimental use of ObRegisterCallbacks to filter object creation and duplication
-- this filtering is independent from the regular SbieDrv's syscall-based filtering, hence it also applies to App Compartments
-- with it enabled, an application running in a compartment will not be able to manipulate processes running outside the sandbox
-- Note: this feature improves the security of unisolated App Compartment boxes
-- to enable this feature, set "EnableObjectFiltering=y" in the global section and reload the driver
-- when globally activated, the filtering can be disabled for individual boxes with "DisableObjectFilter=y"
added "DontOpenForBoxed=n", this option disables the discrimination of boxed processes for open file and open key directives
-- this behaviour does not really improve security anyways, but may be annoying, also app compartments always disable this
added setting to entirely open access to the COM infrastructure
Changed
reworked the resource access path matching mechanism to optionally apply more specific rules over less specific ones
-- for example "OpenFilePath=C:\User\Me\AppData\Firefox takes precedence over "WriteFilePath=C:\User\Me"
-- to enable this new behaviour, add "UseRuleSpecificity=y" to your Sandboxie.ini, this behaviour is always enabled in Privacy enhanced mode
-- added "NormalFilePath=..." to restore default Sandboxie behaviour on a given path
-- added "OpenConfPath=...", which similarly to "OpenPipePath=..." is a "OpenKeyPath=..." variant which applies to executables located in the sandbox
removed option to copy a box during creation, instead the box context menu offers a duplication option
reworked the box creation dialog to offer new box types
Fixed
fixed SBIE1401 notification during Sandboxie Plus uninstall (by mpheath) 68fa37d
fixed memory leak in driver handling FLT_FILE_NAME_INFORMATION (by Therzok) #1371