www.sandboxie.com :: View topic

Posted: Tue Feb 01, 2011 4:40 pm

I use sandboxie to view system and registry changes. and I have found two utilties here sandobxiediff and sandiff...
My question is: if I run, say total uninstall or revo uninstaller to see the complete changes on my sandbox why should I use sandobxiedif or sandiff? I tested it and the output is definitely fine. I see the changes in the sandboxie because I ran the scanning program as sandboxed ..

so what do you say? have any of you already thought about this?

one more question that I'd like you to say what you think:
Quite off-topic question: I'm not going to deny it...I'm new to computers. Actually I have spent a lot of time using them but now I really want to understand them. How can I start?

Posted: Tue Feb 01, 2011 5:46 pm

Hello wrote:

I use sandboxie to view system and registry changes. and I have found two utilties here sandobxiediff and sandiff...
My question is: if I run, say total uninstall or revo uninstaller to see the complete changes on my sandbox why should I use sandobxiedif or sandiff? I tested it and the output is definitely fine. I see the changes in the sandboxie because I ran the scanning program as sandboxed ..

so what do you say? have any of you already thought about this?

Sandiff has been discontinued. You may be interested in Buster Sandbox Analyzer which is an improved version of Sandiff.

If you feel fine with total uninstall or revo uninstaller then go with them.

Just one question: How fast are total uninstall and revo uninstaller compared to SandboxieDiff?

Posted: Tue Feb 01, 2011 6:33 pm

I tested all the scanning programs(revo, total uninstall, regshot,system explorer) in sandboxie and there the problems start to appear...
So I don't know why at the first time it worked, but now it doesnt work anymore. ahhhh so I guess there is a problem with this and this is the reason utils like yours were designed...
can you tel me why those wont work in sandboxed?

Posted: Tue Feb 01, 2011 6:46 pm

Hello wrote:

( ... ) ahhhh so I guess there is a problem with this and this is the reason utils like yours were designed... ( ... )

Yes that is the reason... Razz

Please see here about: http://www.sandboxie.com/phpbb/viewtopic.php?t=5407&highlight=looping

Posted: Tue Feb 01, 2011 7:07 pm

Hello wrote:

I tested all the scanning programs(revo, total uninstall, regshot,system explorer) in sandboxie and there the problems start to appear...
So I don't know why at the first time it worked, but now it doesnt work anymore. ahhhh so I guess there is a problem with this and this is the reason utils like yours were designed...
can you tel me why those wont work in sandboxed?

As Kind told you, there are problems with registry part.

I suggest you use tools specifically designed to work under Sandboxie.

Posted: Tue Feb 01, 2011 7:26 pm

Quote:

When is done a reg backup sandboxed comes out the known issue: looping (with the sandboxie key).

Thus you can't use app. (sandboxed) that needs to do .reg snapshots, like RegShot, ZSoft Uninstaller, etc..

This was the reason why is useful to use SandboxDiff to read the before/after changes in Sandboxie'hives.

Okay, but why...? Smile

Quote:

If your app has the ability to exclude registry keys, you can try to exclude all HKEY_USERS\Sandbox* branches. Doing this, I've been successful getting

RegShot to run sandboxed.

TRUE?

Posted: Wed Feb 02, 2011 8:07 pm

Hello wrote:

Okay, but why...? Smile

It seems to be a similar issue with "Wow6432Node" (32 versus 64 bits Registry versions):

Quote:

When using the registry API in a 32-bit application, Wow6432Node acts like a symbolic link that loops back to the same 32-bit hive. It does not map into the 64-bit hive as you might think.

For example, walking the registry tree down to HKLM\Software\Wow6432Node in a 32-bit application loops back to HKLM\Software. The result is infinite recursion: HKLM\Software\Wow6432Node\Wow6432Node\Wow6432Node\..., etc.

If you want to view the 64-bit registry hive in 32-bit code you must open HKLM\Software using KEY_WOW64_64KEY. Do not try to open Wow6432Node; it will not work.

Source

Since SandboxIE does a virtualization with registry hives also, a "symbolic link" comes out: to exclude "HKEY_USERS\sandbox_{user-name}_defaultbox" branches don't help.
Even if looping issue doesn't comes out, there aren't an accurate registry tracking definitively.