3 ms·

It virtualizes file IO and registry API calls from running apps and redirects them to a predefined location, a "sandbox".

saagarjha 7y ago
How? Is it running in the kernel, or is it some sort of debugger trick where any sort of system call gets trapped and handled by a sandboxing coprocess? Or is it an in-process library? (!!)
- lstamour 7y ago
  https://community.sophos.com/products/sandboxie/f/forum/115348/anyone-seeing-occasional-ole-init-hook-failed-errors-from-sandboxie https://community.sophos.com/products/sandboxie/f/forum/1153... suggests a method... https://vallejocc.files.wordpress.com/2014/12/sandboxie-process-isolation-with-kernel-hooks.pdf https://vallejocc.files.wordpress.com/2014/12/sandboxie-proc... has more details. Also https://malwaretips.com/threads/sandboxie-should-be-avoided-in-2019-and-above.93426/ https://malwaretips.com/threads/sandboxie-should-be-avoided-... and https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849 https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...
  - saagarjha 7y ago
    Thanks. Does Sandboxie use code patching to hook functions in statically-linked binaries?
    - lstamour 7y ago
      Statically linked binaries aren’t exactly a “thing” on Windows... https://reverseengineering.stackexchange.com/questions/2070/can-i-statically-link-not-import-the-windows-system-dlls https://reverseengineering.stackexchange.com/questions/2070/... It appears to patch the SSDT table to intercept system calls to the kernel, and based on forum thread titles, has been caught by PatchGuard in Windows before, but I haven’t investigated myself. From what I can tell, once a privileged process like a kernel driver, starts messing with memory it doesn’t own, like SSDT tables and loaded user-land DLLs, well, game’s over as far as system integrity’s concerned. PatchGuard does integrity checking, but I presume given how common it is, there are known ways to fool it or disable it, perhaps by poisoning whatever it uses to check the SSDT memory. Interesting variations on this technique might be https://github.com/tandasat/DdiMon https://github.com/tandasat/DdiMon and https://github.com/tandasat/SimpleSvmHook https://github.com/tandasat/SimpleSvmHook In terms of defense, there’s https://github.com/IgorKorkin/MemoryRanger https://github.com/IgorKorkin/MemoryRanger And for an organized list of far too many examples for me to feel safe, there’s https://github.com/ExpLife0011/awesome-windows-kernel-security-development https://github.com/ExpLife0011/awesome-windows-kernel-securi... (Note: over half of the links I clicked at random had Chinese github commit text or readmes, presumably the list author is either searching Github by function calls or understands Chinese...) Less organized for obvious reasons, but this list of 199 starred projects might also be worth a look https://github.com/dmaynor?tab=stars https://github.com/dmaynor?tab=stars which in turn pointed me to https://github.com/Hack-with-Github/Awesome-Hacking https://github.com/Hack-with-Github/Awesome-Hacking And if you like this, you’ll probably also like: https://news.ycombinator.com/item?id=21481598 https://news.ycombinator.com/item?id=21481598

saagarjha 7y ago

How? Is it running in the kernel, or is it some sort of debugger trick where any sort of system call gets trapped and handled by a sandboxing coprocess? Or is it an in-process library? (!!)

lstamour 7y ago
https://community.sophos.com/products/sandboxie/f/forum/115348/anyone-seeing-occasional-ole-init-hook-failed-errors-from-sandboxie https://community.sophos.com/products/sandboxie/f/forum/1153... suggests a method... https://vallejocc.files.wordpress.com/2014/12/sandboxie-process-isolation-with-kernel-hooks.pdf https://vallejocc.files.wordpress.com/2014/12/sandboxie-proc... has more details. Also https://malwaretips.com/threads/sandboxie-should-be-avoided-in-2019-and-above.93426/ https://malwaretips.com/threads/sandboxie-should-be-avoided-... and https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849 https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...
- saagarjha 7y ago
  Thanks. Does Sandboxie use code patching to hook functions in statically-linked binaries?
  - lstamour 7y ago
    Statically linked binaries aren’t exactly a “thing” on Windows... https://reverseengineering.stackexchange.com/questions/2070/can-i-statically-link-not-import-the-windows-system-dlls https://reverseengineering.stackexchange.com/questions/2070/... It appears to patch the SSDT table to intercept system calls to the kernel, and based on forum thread titles, has been caught by PatchGuard in Windows before, but I haven’t investigated myself. From what I can tell, once a privileged process like a kernel driver, starts messing with memory it doesn’t own, like SSDT tables and loaded user-land DLLs, well, game’s over as far as system integrity’s concerned. PatchGuard does integrity checking, but I presume given how common it is, there are known ways to fool it or disable it, perhaps by poisoning whatever it uses to check the SSDT memory. Interesting variations on this technique might be https://github.com/tandasat/DdiMon https://github.com/tandasat/DdiMon and https://github.com/tandasat/SimpleSvmHook https://github.com/tandasat/SimpleSvmHook In terms of defense, there’s https://github.com/IgorKorkin/MemoryRanger https://github.com/IgorKorkin/MemoryRanger And for an organized list of far too many examples for me to feel safe, there’s https://github.com/ExpLife0011/awesome-windows-kernel-security-development https://github.com/ExpLife0011/awesome-windows-kernel-securi... (Note: over half of the links I clicked at random had Chinese github commit text or readmes, presumably the list author is either searching Github by function calls or understands Chinese...) Less organized for obvious reasons, but this list of 199 starred projects might also be worth a look https://github.com/dmaynor?tab=stars https://github.com/dmaynor?tab=stars which in turn pointed me to https://github.com/Hack-with-Github/Awesome-Hacking https://github.com/Hack-with-Github/Awesome-Hacking And if you like this, you’ll probably also like: https://news.ycombinator.com/item?id=21481598 https://news.ycombinator.com/item?id=21481598