DavidXanatos
patreon
Sandboxie-Plus v0.3
🕑 Added 2020-07-04 11:02:19 +0000 UTCThis is a huge update fixing many bugs and security issues, it also expands on the functionality of the new SandMan.exe UI component, Check out the full ChangeLog for more details.
Changelog:
Added
- API_QUERY_PROCESS_INFO can be now used to get the original process token of sandboxed processes
-- Note: this capability is used by TaskExplorer to allow inspecting sandbox internal tokens - Added option "KeepTokenIntegrity=y" to make the sbie token keep its initial integrity level (debug option)
-- Note: Do NOT USE Debug Options if you dont know their security implications (!) - Added process id to log messages very usefull for debugging
- Added finder to resource log
- Added option to hide host processes "HideHostProcess=[name]"
-- Note: Sbie hides by default processes from other boxes, this behavioure can now be controlled with "HideOtherBoxes=n" - Sandboxed RpcSs and DcomLaunch can now be run as system with the option "ProtectRpcSs=y" howeever that breaks sandboxed explorer and other
- BuiltIn Clsid whitelist can now be disabled with "OpenDefaultClsid=n"
- Processes can be now terminated with the del key, and require a confirmation
- Added sandboxed window border display to SandMan.exe
- Added notification for sbie log messages
- Added Sandbox Presets sub menu allowing to quickly change some settings
-- Enable/Disable API logging, logapi_dll's are now distributed with SbiePlus
-- And other: Drop admin rights; Block/Allow internet access; Block/Allow access to files on te network - Added more info to the sandbox status column
- Added path column to SbieModel
- Added info tooltips in SbieView
Changed
- Reworked ApiLog, added pid and pid filter
- Auto config reload on in change is now delayed by 500ms to not reload multiple times on incremental changes
- Sandbox names now replace "_" witn " " for display allowing to use names that are build of separated words
Fixed
- added mising PreferExternalManifest itialization to portable mode
- fixed permission issues with sandboxed system processes
-- Note: you can use "ExposeBoxedSystem=y" for the old behaviour (debug option) - fixed missing SCM access check for sandboxed services
-- Note: to disable the access check use "UnrestrictedSCM=y" (debug option) - fixed missing initialization in serviceserver that caused sandboxed programs to crash when querying service status
- fixed many bugs that caused the SbieDrv.sys to BSOD when run with MSFT Driver Verifier active
-- 0xF6 in GetThreadTokenOwnerPid and File_Api_Rename
-- missing non optional parameter for FltGetFileNameInformation in File_PreOperation
-- 0xE3 in Key_StoreValue and Key_PreDataInject
Comments
William Barrett
Recover downloads is now a very large issue, I'm starting to get complaints, client ca't find downloads
David Xanatos
With the new built 0.4.2 the chrome issue is fixed
David Xanatos
will check that out on the weekend, must be fixable somehow
This app is part of WPS Office and manages settings.
David Xanatos
what is ksomisc.exe needed for? does it work without it?
Yes, it works, only ksomisc.exe falls anyway
David Xanatos
I have played around with the issue a it more and found a better workaround: OpenWinClass=# this option does not weaken the isolation.
David Xanatos
also you can use my thread on widlers: https://www.wilderssecurity.com/threads/sandboxie-plus-sbie-fork.427755/
David Xanatos
i actually already have a forum just havnt advertized it yet: https://forum.xanasoft.com/
Can you create a forum to discuss problems, suggestions for improvement, translation into other languages, etc.?
My opinion is that nothing from the sandbox should be released, because it is created for this purpose.
Thank you to David for supporting this "Sandboxie" project.
David Xanatos
depanding on your usecase that may be acceptable, i tryed opening the sued winclasses directly but that did not work OpenWinClass=Shell_TrayWnd OpenWinClass=ApplicationManager_DesktopShellWindow OpenWinClass=Progman probably it does not like running in a job, i will debug that hypothesis furtehr, and sorry for the multiple messages in a row, just realized now that i cant wrinte a multi line message normally.
David Xanatos
add OpenWinClass=* to the sandbox you are using, keep in mind that this will substantially weaken some protection aspects related to communication between windows
David Xanatos
Ok so a quick fix for you that probably wont break anything,
David Xanatos
the crash is in ole.cpp when calling __sys_SetPropW(hwnd, (LPCWSTR)Gui_DropTargetProp_Atom, pDropTarget); not sure why though debug in that will take some time probably, adding a dump workaround would be faster but than drag and drop would be broken.
David Xanatos
I have tried it in a VM in the mean time and it seams that even if I install it outside the sandbox, when ran inside the sandbox it crashes at the same situation. i.e. when I try to start a new text document.
David, the installation of WPS Office 11.2.*** completely in the sandbox completes successfully, but with errors in the application ksomisc.exe. What then causes the main program to crash.
David Xanatos
WPS Office seams free... have downloaded the installer and put it on my todo, if you don't hear any updates remind me in a week please
David, make support for WPS Office
