How does sandboxing/isolate software work in 64 bit enviroments?

I know patchguard causes some problems with isolating/sandboxing and makes the programs that can weaker compared to 32 bit OS's. How do they get past the patchguard to make it work since that patch doesn't let any modifying of the kernel. I know after a while 64 bit sandboxie was finally released and it was a lil bit weaker then the 32 bit version but a few updates down it was said to be as strong as its 32 bit counterpart. Geswall 64 bit is going to be in beta testing soon and I am looking forward to trying that out but also hoping that it would be as good as the 32 bit version.

 

Microsoft has provided some APIs, which make it possible to write code to provide functionality similar to x 86 architecture, but still it is much limited. Sandboxie has added dropped right functionality for x64 to fill the gap of complete control over sandboxed contents.

 

Are all security apps in a 64 bit environment weaker in design when compared to in 32 bit counterparts?

 

I know sandboxie is by a bit. Not sure about others.

 

Yes. All security applications are weaker (some more, some less depending on features they are offering) than their 32 bit counterparts.

 

x64 OS is more secure by default over an x86 OS as well.

 

and what about TDL4 x64

 

Sandboxie 64 bit and my testing, never let anything get through. To me, it is just as good as 32 bit version.

 

I always force run sandboxie in 32 bit environment, I have a few apps which do not run at all in 64bit sandboxie

 

To be precise, Tzuk never claimed both versions to be equal in security protection at any point in time. What was meant by that release news point, was that they are both equal in terms of program support.

I know he later enabled the LUA option by default; how that measures up to the x86 deafault protection I dont know. When discussing the same matter on sandboxie forums, Tzuk said that the only Achilles heel of the x64 version was the matter of service isolation which is supposed to be dealt with thru dropmyrights.

Excellent work, Trjam. I wish more testers here could take your lead.
I am interested in the sample size (# of viruses) you used in testing and the variety of viruses used -- i.e. whether it is fake AVs, killdisk variants etc. Also could you test how Java exploits fare in a start/run restricted sandbox? Are they successful in launching services?

 

Whats your point? That vulnerability has been fixed.

 

Start/Run restrictions my friend