I'm trying out your release of Sandboxie, and keep running into the following error:

SBIE2101 Object name not found: , error OpenProcess (C0000022) access=001FFFFF initialized=1

This seems to happen when I invoke the sandboxed application's embedded Python interpreter.

I tried searching the old Sandboxie forums, but the only solution I saw talked about whitelisting IPC access. I'm not sure how safe that would be for an untrusted application.

Can you explain what is going on? Can this problem be fixed for the next release? Is the provided error message enough or do you need something more specific from me?

I generally use sandboxie as a container for specific apps that I want to make portable. It works like a charm but some feedback may help you make everything better. Since it became open source I'm very happy that wonderful people are trying to improve this program.

For better tracking of these, you can close this issue and make seperate for each of them.

1. Spoof computer info (like username and basic stuff)
2. Option to Act like stock windows: Apps launched in sandbox think it is a fresh install, hence they won't see any other thing on the computer.
3. Support (unify) for customized user files location: When a stock user folder (my pictures/documents etc) moved outside of sandbox, gather writes onto that folder into "SANDBOX/user" instead of "SANDBOX/drive/d/customuserfolder/custom"
4. Show active COM and IPC while adding COM/IPC access to Sandbox.
5. Ability to check writes to registry made inside sandbox
6. Rework file mitigation, this causes a lot of issues when using game setups etc.
7. Make context menu better: Maybe make a tree under run sandboxed. Also run unsandboxed tweak must be added to the app ( there's a registry about it).
8. Sandbox only user files' access: granting full access to everything but user files.
9. Interface rework: this one is probably in the works.
10. Steam Sandbox: for running two instances or another special use cases.
11. Temp Sandbox: Every change is deleted when the app is closed.

I also would like to thank everyone who is contributing to this program.

I would like to point out that identifiers like “_MY_GUISERVER_H” and “_SBIELOW_J_TABLE” do eventually not fit to the expected naming convention of the C++ language standard.
Would you like to adjust your selection for unique names?

This is an old bug and hopefully very simple to fix

menu is broken(grayed out text) after right click on >666 sandboxes

I often rely on him for reverse software
For example, what registry will a software change
What files will be written
I run it with sandboxie
Used to reverse software
Do differential registry
Even containers are created on windows, similar to flatpak, there will be no residue when deleting
If it can be combined with virtualization to achieve driver virtualization, then the real container.

Please clarify the situation of the different repos.

At first news like
https://www.heise.de/security/meldung/Windows-Sandboxing-Tool-Sandboxie-jetzt-Open-Source-4703926.html
mentioned the repo on https://github.com/sandboxie-dev, which was uploaded April, 9th, 2020. Which have also two binary releases published. The author is https://github.com/DavidXanatos
The repo was also linked on the sandboxie-website https://www.sandboxie.com/ .
Then the repo moved to
https://github.com/sandboxie-plus

Later the sandboxie-website liked to the repo at https://github.com/sandboxie , which was uploaded on April, 14th, 2020.
The author is https://github.com/SandboxieDev

What is now the main project repo? And why existing the other one?

A shot in the dark here, but others may be interested in developing/using something like this.

I think many people would find it useful for an outlook plugin which if possible would force any attachments to open in a sandbox. That way damage from any malicious attachments could be limited to a sandbox instead of the actual machine.

If such a feature exists elsewhere, I would be grateful for a pointer.

Hi,

I really liked the new sandboxie plus UI so far, just somehow I can't drag exe file to the main Sandboxie Plus UI to run the exe file like the old Sandboxie UI:

https://i.imgur.com/hIJ1GZd.png

I think drag and drop exe file is very good to have, so I hope you will consider adding this feature.

The logging feature seems to not working too, I couldn't find any log file in the root folder of Sandboxie:

https://i.imgur.com/vW7AWXH.png

And I would love to see a way to create Sandbox folder in the root folder to make the Portable Mode even "more portable". Currently Sandbox folder is created in C:\ (OS drive).

Thank you very much for all the improvements.

Anybody have any examples where the fix #1
works?

I'm seeing the same error. 1809 with Acrobat DC setup.

I never thought to make a list of installers where I got this error, going back a while, so I don't have anything more to test with.

OS: Windows 8.1 x64 Home edition
happens when i try to open an image after a long usage session of sandboxie,
the sandboxie service crashed, and i need to restart the service to continue.
this is my 3rd or 4th time with this bug, 1º time with this version of sandboxie.
Event viewer error:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Application Error" /> 
  <EventID Qualifiers="0">1000</EventID> 
  <Level>2</Level> 
  <Task>100</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2020-04-29T18:08:33.000000000Z" /> 
  <EventRecordID>19639</EventRecordID> 
  <Channel>Application</Channel> 
  <Computer>jotapc</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>SbieSvc.exe</Data> 
  <Data>5.40.0.0</Data> 
  <Data>5e907966</Data> 
  <Data>ntdll.dll</Data> 
  <Data>6.3.9600.19629</Data> 
  <Data>5e2fdc0d</Data> 
  <Data>c0000374</Data> 
  <Data>00000000000f1cd0</Data> 
  <Data>438</Data> 
  <Data>01d61cb9f53fc898</Data> 
  <Data>C:\Program Files\Sandboxie\SbieSvc.exe</Data> 
  <Data>C:\Windows\SYSTEM32\ntdll.dll</Data> 
  <Data>6f90c1b5-8a44-11ea-827f-2c600c907251</Data> 
  <Data /> 
  <Data /> 
  </EventData>
  </Event>

Any comments?

Sandboxie 5.40.1.

No such message with Sandboxie 5.33.3.

The font on the middle tab bar is too small
IIRC, Qt has a function call to auto adjust on HiDPI screen.
Qt::AA_EnableHighDpiScaling from this link may be helpful.

is there or will there be a way to increase the memory limit of the programs that sandboxie can run? I need to run a bitcoin miner but it crashes due to sandboxie's limited memory.

Now Sandboxie has became open source, can you consider adding portable launcher ? Thank you.

Portable Launcher - Contributed by wraithdu https://www.sandboxie.com/old-forums/viewtopic48d6.html?f=22&t=2299

An extra null pointer check is not needed in functions like the following.

• CAnimatedBitmap::SetImage
• CBoxProc
• CMessageDialog

just found out about the sandboxieplus project, and updated (it did technically override) from the freeware 5.33.3. it worked well until i restarted the laptop. reinstalling with and without restarting also faces crashes. ive also tried reinstalling the old version, which still works. all at their default settings, except changing the default drive to my ramdisk using imdisktoolkit.

now im getting 2 types of spam errors.
SBIE9234 Service startup error level 9153 status=C0000034 error=-1073741772
SBIE9234 Service startup error level 9153 status=C0000906 error=-1073739514

i have used various debloating win10 scripts found from github, but with version 5.33 it still works. what are some things i should send for debugging?

Hello,

Since the sbie driver needs to be digitally signed, how about you add a "call to fund raising" to buy a code signing certificate ?
A sectigo 3 years valid certificate costs about 220$.

I pledge to fund a part of that price.
Are others willing to ?

@DavidXanatos Would that help ?

Dear Sir,

I hope everything is going great with your project.
I'm sorry to say that but when I downloaded your latest release and tried to build it on windows 10 it fails.

So is there a step by step build process or is it a must to build it on windows 7 with the given driver kit.

Thanks.

The recovery windows does not respect the system's "main display" setting. Instead it always opens on the leftmost screen.

Version 5.31.4 (64-bit) on Windows 10 Build 17763

I am a user of Sandboxie for a long time. The version 5.33.2 works normally on my computer. Today I compiled the 5.40 from source code. The building process is fine without any issue and I make the driver (SbieDrv.sys) signed.

The new version runs well and the SbieCtrl loads Sandboxie.ini in a normal way. But I cannot start any program in the sandbox! It seems that Start.exe will crash before it loads anything. I can see some WERFAULT.exe processes emerged when I try to start some program.

I am quite sure it is the problem in the code. Because when I substituted the compiled binary to the binary of version 5.33.2 without uninstalling/rebooting, everything is good again.

The problem exists in both the initial release of Sophos code and the version v5.40.1 in the github. I tried it on two different laptops with Windows 10 x64. The problem is the same. Is there anyone else have this strange problem?

Sandboxie is throwing the following error messages when running Google Chrome:

SBIE2303 Could not hook CoGetObject (33, 1655)
SBIE2303 Could not hook RegisterDragDrop (33, 1655)
SBIE2318 DLL initialization failed for 'ole32.dll'

I haven't noticed any problems, and apparently this issue has been around for a while:
https://community.sophos.com/products/sandboxie/f/forum/115348/anyone-seeing-occasional-ole-init-hook-failed-errors-from-sandboxie#pi2151=1

Greetings, @DavidXanatos

I think we can create a new GitHub organization for keeping Sandboxie's code and accumulating its further development. I see this repository starts gaining attention, so I was wondering if you want to do so. It will help to bring the community in one place and continue improving this product collaboratively on GitHub.

I would love to participate, and I hope we can find more people with sufficient skills and motivation to improve this program together. And making a GitHub organization seems like a reasonable first step.

What is the reason that Sandboxie isn't working with apps from the Microsoft Store?
Is it possible to improve Sandboxie so that it also works with Store apps?

Hi DavidXanatos,when I try to compile "SboxDrv.sln",it reminds me missssing file "log_buff.h" and “log_buff.c”.I can't find these two files.Where can I get these two files?

Hi all,

I'm new to Sandboxie and trying to use it to sanbdbox an application in a terminal server, sorry if this is a dumb question...

I built the sandbox, configured it, tested and everything was fine until 2 users were logged in at the same time and tried to use the same sandboxed application, the second user gets the "SBIE1241 Cannot mount registry hive" error.

Does this mean that a sandbox can only be used by one user at a time? is there any workaround for this? will I need to duplicate the sandbox for every user to avoid this problem?

Thanks!

I'm running Windows 10 LTSC (which is based on Windows 1809) with all updates installed: Microsoft Windows Version 1809 (OS Build 17763.973). I'm running SandBoxie 5.33.1 - the application says it's the latest available version - no updates found.

I cannot install some applications which use the Nullsoft installer.

Sandboxie is installed by default, nothing has been changed in its config.

Here's a sample application: https://www.hdtune.com/files/hdtune_255.exe

The errors are: The file does not have an app associated with it for performing this action. Please install an app or, if one is already installed, create an association in the Default Apps Settings page. Unable to execute file in the temporary directory. Setup aborted. Error 1223: The operation was canceled by the user.

The application can be installed directly without using SandBoxie. I'm a local administrator. UAC is off. I've verified that the installer unpacks a payload in the temporary location and it's a valid exe file though it doesn't have the usual extension (exe).

Here's the global settings section:

[GlobalSettings]

Template=WindowsRasMan
Template=WindowsLive
Template=OfficeLicensing

(Strangely I don't remember ever installing MS Office or Windows Live).

Edit: the issue affects Windows 10 built-in Administrator account only.

When running Turbo Tax inside of Sandboxie, it thinks the OS is Windows XP.

Because of that, it appears the SSL connection is downgraded, which means taxes cannot be submitted electronically since the receiving server refuses the connection saying it is insecure.

This is probably not Sandboxie's fault, but I wonder what could be triggering it.
Any suggestions what Sandboxie settings I could try to troubleshoot this?

To test this without submitting a tax return:
When saving a tax file while sandboxed, a message appears recommending a password due to XP being insecure. This message does not appear when the program is run outside of sandboxie.

Hope this will go into a Project' Task.

At the 3.x epoch there was a very useful functions used to inject dlls like AntiDel and some runtime monitoring. And BSA addon based on these features. Unfortunately these functions were trashed out and we're definitely need them back.

Was just going through the code and saw this:
https://github.com/sandboxie-dev/Sandboxie/blob/e9d144b696fbf1b93b4222afaccce9d96e38aeb4/Sandboxie/core/drv/syscall_open.c#L225

It seems that in wow64!Wow64HideThreadFromGuestByClientId Windows "attempts to open threads from several processes and request THREAD_GET_CONTEXT | THREAD_SET_CONTEXT access on the NtOpenThread call"

Can anyone shed some light on this

Hi DavidXanatos, after I update to Windows 10 20H1, I can only do English input. Any idea?
Thank you.

The right hand-side is sandboxie, non-sandboxie on the left.

I can't find other log for sandboixe but only Resource Access Monitor. Hope it would help.
RAM.txt

- Sandboixe info
Version 5.40.1 (64 bit)

• OS info
  Edition: Windows 10 Pro
  Version: 2004
  OS build: 19041.264
  Experience: Windows Feature Experience Pack 120.2202.130.0

I know 5.28 is old, but any idea why this happens with Firefox 76?
Is it because Firefox is now doing their own sandboxing?

I did an sfc /scannow and all appears ok, I just get those dberr.txt entries when running Firefox 76 in the default box. Only the dberr.txt within the actual sandbox was affected.

sometimes they makes fullscreen apps crash (like games)

I use sandboxie for sandboxing command line applications in a non-interactive scripting environment, however the issue is that currently sandboxie doesn't produce any stdout or stderr when running command line applications, so this limits what can be achieved, and makes debugging difficult.

Would it be possible to have sandboxie's start command produce stdout and stderr from its child process?

If memory serves Windoes treats gui and cli programs separately, so maybe this would require a start-cli.exe variant for command line applications (I'm primarily a Linux developer and am using sandboxie to provide compatibility to Windows users).

It would also be useful if the sandbox configuration could be passed as command line arguments to start.exe so that Sandboxie could be run in a stateless configuration. Currently I'm creating and deleting a sandbox before and after each command, which is unnecessary and a little slow.

can you add a simple registry viewer or reader for sandbox

When attempting to recover a file to a path which does not exist, the deepest folder of the path will not be created and the file will be renamed to this folder name instead.

Example:
Recover file.png to C:\a\b\

1. If the folder C:\a\b\ exists, the file will be recovered as C:\a\b\file.png
2. If the folder does not exist, the file will be recovered as C:\a\b (where b is a file with the file.png content)

Version 5.31.4 (64-bit) on Windows 10 Build 17763

I would like to request being able to configure a 'lenient' sandbox.

When a sandboxed process attempts to write on disk, the operation fails if the target does not have enough space or is readonly, even if the drive physically containing the sandbox has the necessary space. An alternative 'lenient' mode would allow writes to succeed in the sandbox even if the unsandboxed attempt would fail (the original files will still not be touched, which is the purpose of the sandbox). In this mode automatic file recovery should be disabled.

This would resemble UnionFS behavior and be useful e.g. to mount a compressed image with source code and compile to ramdisk (basically a poor-man's Docker that does not need virtualization support). It would allow to greatly lower the footprint of, say, Android Studio, reduce disk wear and tear and speed up compilation since non-RAID disk I/O is slower than CPU on-the-fly decompression (SSDs excepted).

[DefaultBox]
BlockDrivers=n

it is not work

This feature has been deprecated in SBIE version 4.+ and up. It is not longer supported.

...

It appears that the "Windows Installer Service could not be accessed" error is still present in this release.

The good news is that now, we can fix it ourselves! That is, we can fix it ourselves if we understand the code. I've been reading through the code trying to get a sense of how it works, but have admittedly made little to no progress. Do you have any idea how to fix this? Or at least some pointers as to where I should be looking?

Reproducing the issue is very simple: try to run an MSI installer inside a sandbox, and you will get this error.

It seems the the Sandboxie team moved the download to an official repository: https://github.com/sandboxie/sandboxie

I am not suggesting that this version of the repository be removed, but it might be worth keeping an eye on the official repo for changes.

Since the original Sandboxie website is closing and it contains lots of useful information, I have made a copy of the website and made it available at http://sandboxie-website-archive.github.io/. This archive includes the old Sandboxie forums.

When I try to DL SandboxieInstall64-v5.41.0.exe file, I get alert from Chrome browser and Win10 Defender Shield, that the file is infected with TrojanWin32Vigorf.A. Is this a false alarm or what?

I have visual studio 2019, installed 140 (vs 2015), windows 8.1 sdk
sbiedll.dll not complied after compilation. Others files are complied
How to fix this issue?

Windows Security detects :
SandboxieInstall64-v5.41.0.exe (with) Trojan:Win32/Ymacco.AA07
SandboxieInstall32-v5.41.0.exe (with) Trojan:Win32/WacatacC!ml

I'm new to Windows, so I don't know if this is because Sandboxie is seen as suspicious because all of its admin capabilities, or there's something bad going on here.

I’ve been reading your roadmap of ideas and it’s really impressive, great ideas all over the place.

From reading them, I also have a couple of questions just to know if they are feasible:

• about the portable sandboxes, would it be possible to compact (zip?) the sandboxes for easier migration? For example, like Thinstall/ThinApp does that generates a single executable (and afaik, deflates on scratch space when executed). This could also morivate a behavior similar to the distribution of Docker images in some sort of hub (like portableapps.com). I currently use sandboxie in combination with Python virtualenv to manage different environments and app versions and this sounds interesting
• something, similar would be sandbox snapshotting, to easily revert to a prior version. A simple way could be by compacting the sandbox. The problem would be the data duplication, but I don’t know if an alternative is too complicated
• lastly, about the networking, if not including the firewall functionality directly, did I understand correctly that your idea is to attach a virtual networking device to each sandbox? That would be very interesting

This has been an ongoing buck for the last year or so, since 1809, still happens in windows x64 1909 and on different cpu/ram/mobo; to speed up the trigger, just open up 20-30 different unique tabs on RT.com rapidly, the bug should trigger and not go away. However, the program generally works fine for a while and will trigger no matter what page, no matter how little resources are loaded. This basically makes sandboxie mostly useless for me ATM.

Since Sandboxie appears to have code to detect when a sandbox has been created and how long it hasn't been 'cleaned' since Sandboxie issues this message:

Sandbox '%2' was created %3 days ago.

Please consider deleting the contents of your sandbox from time to time.

To configure automatic deletion, use the Sandbox Settings command from
the Sandbox menu in Sandboxie Control.

I thought that it would be a good enhancement to add a setting, which would allow one to set x days before the auto deletion function could clean up the contents of a sandbox. Right now it is only possible to set auto deletion to clean up the contents of a sandbox once it becomes unused.

I am not sure if that is feasible or even worse a bad idea.