Sandboxie-Plus 1.13.0 (Experimental)

This is an experimental build it reworks and streamlines the hooking mechanism around SCM related functions which should improve compatibility with newer windows versions. The improved hooking mechanism allows for API call tracing without the need for LogAPI.dll.
This build adds compatibility with windows 11 insider build 26040, 26052 and later, and changes the way the driver handles offset dependent kernel object modifications, the new mechanism allows an offset configuration to be loaded from the registry such that it is possible to update the offsets without rebuilding the driver.
To improve system stability Sandboxie will no longer try to use old known offsets on newer yet not known kernel builds, except when the pc participates in the windows insider program, instead it will disable the token based security isolation and issue SBIE1207 indicating the insecure fallback mode of operation.

Download: https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.13.0


Added

• added advanced API trace functionality

Changed

• reworked scm hooking to improve windows 10 compatybility
• reworked offset dependant handling of undocumented windows kernel objects
  • the required offsets can be now updated independantly from the driver
  • the DynData blob is digitally signed, when in testsigning mode the signature is howeever ignored
  • when sandboxie encounters a yet unsupported kernel build, token based isoaltion is disabled to prevent system instability
  • this safety mechanism is disabled on systems participating in the windows insider program
  • for systems in the insider program the latest known ofsets are tried
• reworked part of the low level code injection mechanism to add compatybility with windows insider build 26040 and later
• enabled CET Shadow Stack Compatible Flag for core sandboxie binaries

Removed

• cleaned up code and removed obsolete VC 6.0 workarounds

Fixed

• fixed incompatybility with windows insider build 26040 and later

 

No hickups observed at first glance. All browsers will start up normally.

 

My Win7x64 is running v1.13.0 with no issues so far.
I'll make way for comments from Win10/11 users (for whom this version is more relevant)

 

Will wait for the official release.

 

I went ahead and installed it over the top b/c the issue I was having with posting on Yahoo using the Plus/Firefox combo came back. The post fails to publish and the "retry" feature doesn't work.

I posted some nonsense in a couple of random topics and they went thru. But something must be changing periodically on the Yahoo site that doesn't agree with Firefox too much since the posting problem tends to return after a time. Anyway, we'll see.

Edit: went back to 1.12.9 as Firefox was taking longer to open and multiple websites taking too long to load in 1.13.0 compared to the prev. I'll deal with Yahoo, it's a very occasional thing to post on there anyway. No big deal.

 

Works perfectly for me. No issues.

Windows 10 22H2 (64-bit)
Firefox 122.0.1 (64-bit)
Thunderbird 115.7.0 (64-bit)
Microsoft Edge 121.0.2277.112 (Official build) (64-bit)

 

Wow, almost one full week after the latest release, almost only encouraging preliminary comments - and this "pseudo"-auto-updater is still on v.1.12.9 on the "pre-release"-channel. Just saying.

 

Right its time to push the auto update, now it should detect 1.13.0

 

Working fine for me - Firexfox x64 latest

 

Stable Builds [here] remains at 1.12.9...at this time
Release v1.13.0 / 5.68.0 remains at Pre-release

 

I spoke to soon, and have had to revert to 1.12.9!

With the same sandboxie.ini & sandboxie-plus.ini files, with 1.13.0 I can no longer force run Firefox by eg loading a saved html file unless it is in a location to which I have granted SB access, whereas with 1.12.9 it will happily force open Firefox sandboxed from any folder/location.

Also, I found that I could not install extensions while Firefox was sandboxed, which I always do to test them before installing permanently.

So it looks like isolation/permissions are working differently.

 

> I can no longer force run Firefox by eg loading a saved html file unless it is in a location to which I have granted SB access

could you please write up a step by step guide to test this issue

 

I no longer have 1.30 installed but, from memory, try

1. opening Firefox in an security hardened sandbox, then try to install an extension from the official add-on site. Nothing would install for me.
2. place a saved html link to a website in a location that is a closedfilepath, and doubleclick to launch into Firefox which is forced to load sandboxed. For me, Firefox started, probably without being able to find my profile, and wouldn't load the website.My recollection is a bit hazy on precisely what happened.​

All is working with 1.12.9

 

BTW, can you guys install the Thorium browsers sandboxed? It's supposedly some speedy Chromium based browser.

https://www.softpedia.com/get/Internet/Browsers/Thorium-Browser.shtml

 

OK thanks, then it must be my older Sandboxie Plus version that can't do it, the installer just exits after a while on my Win 10 machine. I didn't have any trouble installing portable versions of Opera and LibreWolf though.

https://portableapps.com/apps/internet

 

Completely new install of SB+ (1.13.1) with new/default ini files - same problems.

 

I cant reproduce the addon issue, does anyone else has problems with installing addons to the sandbox?

 

Thanks for looking into this.

When I've time, I'll try Firefox with no extensions; and if that does not help me sort it out then a clean install/refresh of Firefox when I have the time.

 

It occurred to me that I could do a refresh in a sandbox!

So with a clean, refreshed Firefox, in a sandbox I could still not install an extension. Further "playing" and it looks like something is suppressing the Firefox pop up box that appears after clicking to install an extension; so it looks like nothing is happening.

And there I'm stuck.

 

ok whats your exact setup?
firefox installed in or out side the sandbox?
where is the user profile inside or outside?

and did you try the newer 1.13.1 version?

 

Both installed outside SB+

Yes[/QUOTE]