Returnil

Discussion in 'sandboxing & virtualization' started by biatche, May 14, 2007.

Thread Status:
Not open for further replies.
  1. EASTER.2010

    EASTER.2010 Guest

    No such restrictions with Power Shadow (2.6) for a lifetime. The sorry state of business these days is to sell a limited license with no guarantee the program will continue to perform as expected. Example: ALL AV's.

    One has to remember, vendors are not only in this to fund salaried personnel and/or research but to reap as much profits as they can attract. Lavasoft is a prime example. They cornered the market of AS for a time and lavished themselves in their bloated profits to a point that their customers/corporate and free users were considered nothing more than an easy revenue source and so they backed away from productive research or innovation to where they now are considered a relic of the past.

    That right there is exactly what fuels discontent and destroys reputation without remedy. Only a relic from the past now but valid moral of the consequences of greed and arrogance.
     
  2. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Coldmoon

    Let us know when the beta with MBR protection is ready for us to beat on it. I actually found a way to trash the disk even far more effectively then Killdisk. I will be glad to torture test for you.

    Pete
     
  3. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hi Peter,
    The Beta version with MBR protection is already available from the usual link at MG (1.62.4025). If you don't have the link handy, just follow the links from our website which will take you directly to the same page.

    Mike
     
  4. Rmus

    Rmus Exploit Analyst

    Joined:
    Mar 16, 2005
    Posts:
    4,020
    Location:
    California
    OK, thanks, I see I've got to do some reading...

    -rich
     
  5. EASTER.2010

    EASTER.2010 Guest

    @Coldmoon

    Try to offer some convincing evidence that might sway a dedicated Power Shadow user to switch instead to Returnil.

    Memory features aside, it would be beneficial i think to everyone to know how different they can surf unhindered from potetial risks as opposed to their current solution.

    I'm not neither here nor there in favorability, just interested in something more iron clad that would justify a license or outright purchase of a virtual solution that would in someway surpass the protections already offered.

    I know PS is yet to surface that same idea of exiting shadow-mode without reboot in much the same way Returnil is examining turning OFF protections w/o reboot.

    Thanks
     
  6. innerpeace

    innerpeace Registered Member

    Joined:
    Jan 15, 2007
    Posts:
    2,121
    Location:
    Mountaineer Country
    Just curious, does PS protect the MBR? I'm only able to use the 2.8.2 version. I really like the idea of programs like Returnil, PS and even Sandboxie for that matter. For now, they seem fairly bulletproof (with other layers of course) for those of us lucky enough to know about them.
     
  7. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Mike

    I am downloading the new beta and will test later, and post results.


    Pete
     
  8. flinchlock

    flinchlock Registered Member

    Joined:
    Jan 30, 2005
    Posts:
    554
    Location:
    Michigan
    Data Hiding Tactics for Windows and Unix File Systems by Hal Berghel, David Hoelzer, Michael Sthultz
    Thus, the information in bold above (by me) explains why the first partition always starts at sector 63.

    Since some programs might store data in sectors 1-62 (for example: PowerShadow 2.8.2, BootMagic, GHOST, others)...

    Does Returnil actually protect all of the first 63 sectors (sectors 0-62)?

    Mike

    UPDATE: Oops, sectors are numbered 0-62 = 63 total
     
    Last edited: Jun 4, 2007
  9. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    OKay. Test complete. Downloaded and fired up the new beta in my virtual machine.

    Near as I can see the program works as advertised. It brushed off Killdisk like nothing had happened, and of course the reboot wiped out anything related to it.

    In terms of performance, the machine performed as usual. No loss, no gain. But hey the no loss is important.

    I noticed that reboot resets everything, but leaves the protection on. You have to specifically turn it off again.

    As it stands I am not sure I see a fit for me, since I use FDISR, am tinkering with Rollback again, Sandboxie, and a VM workstation machine.

    What I'd much prefer to see,(good luck on this Mike) is where the system stayed as it is thru a reboot. THis would allow installation of software. Then when you are ready to turn off, the option, to have the system either returned to it's prior state, or save it to the current state. I suspect that is a tall order.

    Mike if there is any other torture I can run, let me know.

    Pete
     
  10. AJohn

    AJohn Registered Member

    Joined:
    Sep 29, 2004
    Posts:
    935
    Correct me if I'm wrong, but I think I can remember ShadowUser being able to save installations through a reboot?
     
  11. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    I believe your right.
     
  12. EASTER.2010

    EASTER.2010 Guest

    Thanks for the link Mike. Very good read and i'm going to read it over again (several times if needed) and as many times as it takes for all that to sink in.

    Also PM received FYI.
     
  13. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hello,
    Sorry for the late reply – long post ahead

    Easter.2010 said:
    There is no reason to suggest that our development efforts are motivated by greed Easter. Again, there is no connection to LS other than the fact I once worked there. Therefore, I have to question the motivation for such a posting in this thread. I thought we were past business model comparisons, but it seems I was mistaken.

    One thing to remember, experienced technicians who also must make a living MUST support all customers. While the lifetime license idea seems a good one at first blush, it is unsustainable over time. If your company survives and grows, eventually you will reach a point where the revenues from new customers will not cover your costs for supporting existing and long standing customers…

    As noted by me earlier, I am not here to convert the faithful. I will let the software itself do the “talking” and then leave the decision of whether RVS is the right solution to the user…

    flinchlock asked:
    The answer is no in build 4025 (selective testing sectors) but is yes in our intermediate testing builds. We are currently on build 4029 which protects all 62 sectors. There were some shut down glitches discovered in our full implementation in intermediate builds 4026 and 4027 that we needed to resolve prior to expanding to all 62 sectors.

    As soon as we are satisfied with performance, we will release it for general public testing. If you want to take a look at 4029 please shoot me a PM and I will give you the link to download from our internal testing server. This link will always have the most recent intermediate build and can change frequently so please check the installation setup file properties to know which build you are testing.

    Peter2150 said:
    We have been doing quite a bit of brainstorming on this idea over the last month and believe we might begin exploring them soon in a future beta series. We are not quite ready yet to say what the solution will be, so keep an eye out when the next beta series starts following the final release of 1.62 as I too find this an extremely compelling future feature for RVS.
     
  14. flinchlock

    flinchlock Registered Member

    Joined:
    Jan 30, 2005
    Posts:
    554
    Location:
    Michigan
    COOL. I would love to test it, BUT, I am too busy with other projects. But, thanks for the offer.

    Mike

    UPDATE: Oops, sectors are numbered 0-62 = 63 total
     
    Last edited: Jun 4, 2007
  15. ErikAlbert

    ErikAlbert Registered Member

    Joined:
    Jun 16, 2005
    Posts:
    9,455
    Coldmoon,
    Regarding screen "System folder relocation tool" containing :
    1. Desktop
    2. IE Cookies
    3. IE Favorites
    4. Event and Logs
    This screen is displayed at the bottom of post #36 of this thread.

    Why don't you replace this screen with a function that allows the user to exclude ANY folder and file in the Virtual Partition.
    What is bothering me the most are "IE Cookies" and "IE Favorites", which indicates that this screen is limited to "MS Internet Explorer" only and not for other browsers, like Firefox, Opera, ... and many others.

    Just allow users to exclude any folder or file in the VP and you won't have that limit anymore.
    Other softwares like FirstDefense-ISR and Anti-Executable allow you to exclude any folder or file without limitations.

    The rule is simple : any excluded folder or file is NOT included in the VP and not protected by the VP.
    There are always folders and/or files of any application that have to be excluded to make them work properly in the VP.
     
    Last edited: Jun 4, 2007
  16. EASTER.2010

    EASTER.2010 Guest

    I in know way intended to steer those statements as a suggestion against Returnil's business model, i was just generalizing over the age old comparisons of "free" vs. "commercial". I often bring attention to that possibility when comparing ALL software programs. Unfortunately, some vendors fall directly in line with that practice, but please don't take those lines in any way referring to Retunil, that's not the intent here, plus it was completely OT on my part, so i stand corrected if it was interpreted in that manner. :)

    No model comparisons here, just program comparisons only. LoL
     
  17. flinchlock

    flinchlock Registered Member

    Joined:
    Jan 30, 2005
    Posts:
    554
    Location:
    Michigan
    flinchlock asked:
    Oops, sectors are numbered 0-62 = 63 total

    Mike
     
  18. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hello - Long post warning

    ErikAlbert asked:
    Subject = “System folder relocation tool"

    I think we still have a bit of confusion here regarding what RVS actually does and why exclusion lists would have little or no real meaning in this context. Either you save data within your Virtual Partition or you do not (no exclusion or inclusion list required). Unless you are an UBER system tweaker, developer, program tester, or researcher there is no overriding need to exclude anything from protection on the System Partition. This is the message that all of use in this space should be emphasizing: “Break your default save directory addiction!

    There are two distinct, core solutions at work in RVS. The first is the System Protection feature and the second is the Virtual Partition. Neither solution requires the other to perform its designed function.

    1) The System Protection feature clones your %s in memory with the clone updated continuously while protection is ON.
    2) The Virtual Partition feature uses a file to mimic an alternative partition on your HDD. Regardless of the fact that it is a file, Windows sees and interacts with this volume as it would any other traditional alternate partition or drive on your computer. The main differences here are that limited users have no access to the root of this virtual drive, and you require a copy of RVS to mount/access the “partition”

    “So how does this relate to the System folder relocation tool?”

    The first feature designed was System Protection. From the beginning, the lead developer recognized that the very nature of the protection feature would result in the user not being able to save data in default directories such as the Desktop, My Documents, Favorites, etc (especially considering the fact that a large percentage of new computers ship with only one partition on the HDD). This is what drove development of the Virtual Partition - allow the user to save data when they do not have access to an alternate data partition.

    This was sufficient during the prior 1.5x series, but user feedback told us we needed to look at alternatives for those who would not or could not be weaned off Windows default save directories. This led to the development of the System folder relocation tool.

    It was created for testing whether this would be a viable and efficient alternative for our users, and regardless of your current choice for an alternative browser, it was logical to start with IE (Favorites, cookies) and the most used System folders such as the Desktop and My Documents (Browser choice independent).

    There are consequences when moving System folders and it was quickly apparent to us that this was not going to be a universally useful solution except for those who are experienced computer users. This is why we have not integrated the relocation tool functions into the RVS core: Too much complexity with little real gain for the new/average user.

    Therefore, we have decided to put the relocation tool on the back burner for the current series and focus on things like the toolbar that would give the user the option to use RVS selectively rather than always ON. We have also decided that it will be more useful to discuss and as a result push user education regarding more appropriate configurations where data is saved in alternate partitions rather than taking the extreme step of moving their System Folders…

    flinchlock said:
    You are correct, and like you, I forgot to count “0” in the total. Common mistake and I apologize for adding some confusion here. Yes, the protection covers all 63 sectors in build 4029: 0-62.

    Easter.2010 said:
    No problem and thank you for the clarification. Though we need to make revenues as a viable company, our primary focus is on the technology itself rather than on revenues as our operational priority. IOW, we see ourselves as a focused R&D provider with sales and service to support our customers and users. There is allot of work ahead for all of us in the security industry and even more to overcome the FUD out there regarding virtualization not being a mature technology …
     
  19. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    I was fooling around a bit tonight testing, and realized that although I'd tested Returnil against Killdisk, I'd never thrown the DEL /F /S /Q c:\*.* test at it, so I gave it a try.

    Unlike all the other programs, the delete operation was a bit ragged with Returnil, and I finally had to power reset as the system hung. ON reboot however it was fine. So I would rate this a mixed bag. Survival was great, but why was it having so much trouble on the delete.

    Pete
     
  20. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Hello Pete,
    Thanks for the report, but it is a bit vague making it difficult for the development team to be sure they are testing the right thing. Can you provide some clarification for what is happening exactly when you say:

    1) "...the delete operation was a bit ragged with Returnil"

    2) "...and I finally had to power reset as the system hung"

    We need to know as much detail as possible about what was running at the same time and the exact steps you used that resulted in the issues. The lead developer is aware of your report and will look into this ASAP.

    Mike
     
  21. EASTER.2010

    EASTER.2010 Guest

    Very good feature indeed.

    Contrary to what some users might prefer & according to those same particular interests, i have to say i also lean more toward keeping virtualization as flexible as possible.

    In case i missed something or simply overlooked it, with RVS Protection turned OFF, it then permits the same effect as switching over to the "actual physical" drive/partition?
     
  22. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Mike

    I will duplicate later so I can document exactly what I was seeing, and report back.

    Pete
     
  23. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Mike

    Well I lied. I reran test, but did not duplicate results. This time the del just went smoothly as it had with other test. Returnil recoverd exactly as advertised. Ah the joy of computers. Sorry.

    Pete
     
  24. Coldmoon

    Coldmoon Returnil Moderator

    Joined:
    Sep 18, 2006
    Posts:
    2,981
    Location:
    USA
    Pete,
    Thanks for the report. Could you run the test a few times in succession to make sure? This should help to eliminate any possibility that there is an intermitent issue here - thanks again

    Mike
     
  25. EASTER.2010

    EASTER.2010 Guest

    @Coldmoon

    Could you please offer a small brief also to my question while you're available to answer posts. I want to absorb some encouragement from your own descriptions and hopefully pass the word around on this new proggy.

    Thanks.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.