Sandboxie-Plus v1.17.4

[DavidXanatos]

Sandboxie-Plus 1.17.4 / 5.72.4 introduces several improvements focused on compatibility, security, and overall stability. This update adds new controls for handling local loopback communication with the introduction of the BlockLocalLoop=y option, allowing users to explicitly block applications running inside a sandbox from connecting to services on the host through the local loopback interface.


To improve compatibility with modern desktop frameworks, Sandboxie-Plus now includes automatic detection of Electron-based applications. The primary heuristic runs early and is enabled by default, automatically applying the appropriate handling for Electron programs; it can be disabled with UseElectronDetection=n if required. In cases where this early heuristic fails or has been disabled, a secondary detection mechanism may later determine that the application is Electron-based after startup. Because this happens too late to apply the automatic workaround, Sandboxie-Plus will display the new SBIE2189 message to inform the user and provide troubleshooting guidance, suggesting the configuration option SpecialImage=chrome,program.exe for the affected application.


Hardware information protection has also been refined and can now be configured on a per-process basis, providing more granular control for users who need to selectively expose or restrict hardware identifiers to specific applications. Additionally, the driver now performs certificate verification using UTC time instead of local system time, preventing issues caused by incorrect local clock settings and ensuring consistent validation behavior.


A number of reliability problems have been resolved in this release. An issue affecting volatile configuration updates has been corrected, and a missing WaitServiceState call has been added to address cases where LINE failed to launch with a NO_SIGNATURE error. Stability improvements include fixing a race condition that could lead to a system crash during driver unload, correcting the verification logic used by Key_MergeSubkeys, and resolving a problem in Application Compartment mode related to File_WaitNamedPipe. Additional fixes address an IPC synchronization issue where Ipc_Handles_CritSec was not properly released when NtQueryDirectoryObject failed, as well as a bug that caused user interfaces of WebView2 applications built with Tauri to become unresponsive inside the sandbox.


As part of ongoing cleanup, the deprecated configuration option UseElectronWorkaround=y has been removed, as the new Electron detection mechanism supersedes the previous workaround. Overall, this release improves compatibility with modern application frameworks, strengthens certificate validation behavior, and resolves several stability issues, making it a recommended update for all Sandboxie-Plus users.


For a full list of changes please review the change log.

Download: https://github.com/sandboxie-plus/Sandboxie/releases/tag/v1.17.4

 

[Mr.X]

This update adds new controls for handling local loopback communication with the introduction of the BlockLocalLoop=y option, allowing users to explicitly block applications running inside a sandbox from connecting to services on the host through the local loopback interface.

Can someone describe an example when to use this feature?

BlockLocalLoop=y

Is this setting made for global settings or per sandbox/process?

Is this correct?

BlockLocalLoop=programA.exe,programB.exe,y
or
BlockLocalLoop=programA.exe,y
BlockLocalLoop=programB.exe,y

 

[Mr.X]

added electron detection and SBIE2189 Message with a trouble shooting option to set 'SpecialImage=chrome,program.exe' for the encountered application

Can someone provide an example or use case?

added automated electron app detection heuristic on by default it can be disabled with 'UseElectronDetection=n'

If it is a good thing to detect electron apps by default, why would I want or need to disable such a feature? An example?

Hardware info protection can now be switched per process

I read issue #5271. Can someone describe a scenario in real life?

 

[offhub]

BlockLocalLoop:
> Is this setting made for global settings or per sandbox/process?
BOTH
> Is this correct?
Nope, it only supports Y or N.

> Can someone provide an example or use case?

SpecialImage=chrome,chrome.exe
SpecialImage=chrome,msedge.exe
SpecialImage=chrome,msedgewebview2.exe
SpecialImage=chrome,iron.exe
SpecialImage=chrome,dragon.exe
SpecialImage=chrome,opera.exe
SpecialImage=chrome,neon.exe
SpecialImage=chrome,maxthon.exe
SpecialImage=chrome,vivaldi.exe
SpecialImage=chrome,brave.exe
SpecialImage=chrome,browser.exe
SpecialImage=chrome,osiris.exe
SpecialImage=chrome,slimjet.exe
SpecialImage=chrome,catsxp.exe
SpecialImage=chrome,BitBrowser Global.exe

SpecialImage=firefox,firefox.exe
SpecialImage=firefox,waterfox.exe
SpecialImage=firefox,palemoon.exe
SpecialImage=firefox,basilisk.exe
SpecialImage=firefox,seamonkey.exe
SpecialImage=firefox,k-meleon.exe
SpecialImage=firefox,librewolf.exe
SpecialImage=firefox,thunderbird.exe

#SpecialImage=thunderbird,thunderbird.exe

SpecialImage=mail,winmail.exe
SpecialImage=mail,IncMail.exe
SpecialImage=mail,eudora.exe
SpecialImage=mail,thebat32.exe
SpecialImage=mail,thebat64.exe
SpecialImage=mail,Foxmail.exe
SpecialImage=mail,Mailbird.exe
SpecialImage=mail,MailClient.exe
SpecialImage=mail,postbox.exe
SpecialImage=mail,Inky.exe

SpecialImage=browser,PuffinSecureBrowser.exe

SpecialImage=chrome,wechat.exe
SpecialImage=chrome,slack.exe
SpecialImage=chrome,spotify.exe
SpecialImage=chrome,Amazon Music.exe
SpecialImage=chrome,steam.exe
SpecialImage=chrome,FreeTube.exe
SpecialImage=chrome,aDrive.exe
SpecialImage=chrome,Signal.exe
SpecialImage=chrome,Actual.exe
SpecialImage=chrome,Beeper.exe

> If it is a good thing to detect electron apps by default, why would I want or need to disable such a feature? An example?
Collateral detection, a different tool in the same directory gets misidentified as Electron.

 

[Mr.X]

This update adds new controls for handling local loopback communication with the introduction of the BlockLocalLoop=y option, allowing users to explicitly block applications running inside a sandbox from connecting to services on the host through the local loopback interface.

Still, I need to understand more. Can someone describe an example, a notorious scenario where this is needed?
Why would I need to block such a connection?
TIA

 

[Mr.X]

Hardware info protection can now be switched per process

I read issue #5271.
Still, I need to understand whether is a good thing to enable HWID hiding globally or not. Is it good for privacy or security?

 

[bastik-1001]

Still, I need to understand more. Can someone describe an example, a notorious scenario where this is needed?
Why would I need to block such a connection?

You could have something running on the machine that provides a local connection at 127.0.0.1 (or IPv6 equivalent) like a proxy at some port like 8080, 8118 or 8123. With this option it should be possible (I have not tested it) to block a sandboxed process from connecting to anything that is providing something like that locally. I may prevent software that provides a local server and client to function (I have not tested it).

whether is a good thing to enable HWID hiding globally or not. Is it good for privacy or security?

This is for privacy. It aims to prevent fingerprinting. I fail to see how it would be relevant for security.

 

[Mr.X]

You could have something running on the machine that provides a local connection at 127.0.0.1 (or IPv6 equivalent) like a proxy at some port like 8080, 8118 or 8123. With this option it should be possible (I have not tested it) to block a sandboxed process from connecting to anything that is providing something like that locally. I may prevent software that provides a local server and client to function (I have not tested it).

If you have time, could you try it and test it and then share your config/scenario to understand a bit more?
TIA

 

[bastik-1001]

If you have time, could you try it and test it

I don't have a proxy installed, nor do I have any software that provides a service on the localhost. Therefore, I don't have something I can test. Me saying I did not test it, only meant that I assume that this feature is supposed to be able to block access to those. The reasons behind this setting are not perfectly clear to me.

 

[Mr.X]

Can these options be used globally set in [GlobalSettings]?

HideFirmwareInfo=y
RandomRegUID=y
HideDiskSerialNumber=y
HideNetworkAdapterMAC=y

 

[bastik-1001]

Can these options be used globally set in [GlobalSettings]?

Yes, I just tested by adding them to the Global Settings, the user interface just does not show it for the sandboxes, similar to the setting I reported it for.

I used TaskExplorer (with Sandboxie support enabled) to check if the settings are listed in the "config" tab.

 

[Mr.X]

I used TaskExplorer (with Sandboxie support enabled) to check if the settings are listed in the "config" tab.

Could you elaborate on this? It seems like a TaskExplorer's feature I didn't know it existed...
TIA

Edit: I found it.