That matches my copy.

Thanks for the confirmation. I'll check it soon.

I looked into it. What normally happens with HIPS-type drivers is that they inject into the kernel somewhat similar to this:

Application --> Open Process API --> ...
... --> HIPS Driver --> Operating System --> Nt Open Process --> ...
... --> Sandboxie

But XueTr injects like this:

Application --> Open Process API --> ...
... --> Operating System --> Nt Open Process --> XeuTr --> ...
... --> Sandboxie

This difference is confusing to Sandboxie, because it looks like some driver (XueTr in this case) is issuing the Open Process request. Sandboxie always permits a request that it thinks came from a driver.

I'm not sure that I can resolve this conflict without explicitly identifying the XueTr driver by name, which is an option, but not the best one.

Update. I redesigned the way Sandboxie figures out if the call came from the application or a driver that happens to be operating in the context of that application. It resolves this particular conflict with XueTr. The new way should actually be more robust than the old way. I will release beta version 3.41.02 in a day or two, and you guys would be able to confirm it at that time.

Excellent. Thanks for the update.

Sweet.

Also, is it possible for sandboxie to support "simulated" injection of one of it's files? I have a few malware samples that like to take over processes and then drop the files, and sandboxie isn't okay with this because it wants to hijack a kernel sandboxie driver; Only, I don't want it to be able to do it for real.

Are you saying that these samples are able to bypass SBIE?

Not at all. He's simply saying that if he tries to run those malware files sandboxed, nothing will happen, because Sandboxie will block it. However, I think he wants Sandboxie to be able to let the malware run sandboxed to observe its behaviour, but to keep it contained of course.

Is this only releated to this POC used in the prescence of XueTr ? or could it be exploited by some rare types of malware w/o the aforementioned program being on the system?

This problem can only occur when XueTr is running outside the sandbox.



That depends on the injection I suppose. For example, if the malware tries to inject Explorer.exe you might simulate it by running Explorer.exe in the sandbox.

Should be fixed in version 3.41.02.

Confirmed. Thanks for the fix.

...and thanks as well to a256886572008 for reporting the issue.

By no means. They die on the spot, actually.

Thats entirely correct. Sorry I didn't clarify myself better.