Sandboxie Support

[.07] EMET 4 compatibility

2013-05-07T15:59:10-04:00

Thanks

Statistics: Posted by tzuk — Tue May 07, 2013 3:59 pm

[.07] EMET 4 compatibility

2013-05-07T06:30:53-04:00

tzuk, I forgot to mention awhile back that the URL in the EMET template was no longer valid, but I had no suggestion for a more general updated one... But this page I came across the other day seems like a good, latest version link that seems likely to stay relevant: http://technet.microsoft.com/en-us/security/jj653751

Statistics: Posted by DR_LaRRY_PEpPeR — Tue May 07, 2013 6:30 am

[.07] EMET 4 compatibility

2013-04-30T09:39:40-04:00

@ exploited

Another article:

http://www.saferbytes.it/2012/10/08/com ... t-attacks/

The new version of ES is better
Read Marco Giuliani's comments.

For me Tzuk should be develop compatibility SBIE + ES.
Sorry my bad English

Statistics: Posted by Guest — Tue Apr 30, 2013 9:39 am

ExploitShield.dll

2013-04-30T08:37:25-04:00

@Sampei Nihira As the security value presently of ExploitShield is likely doubtful, it may not be productive for tzuk to allocate lots of time accommodating it.
http://trailofbits.wordpress.com/2012/1 ... oitshield/
http://securitywatch.pcmag.com/security ... or-so-2004

Statistics: Posted by Guest — Tue Apr 30, 2013 8:37 am

[.07] EMET 4 compatibility

2013-04-29T15:41:08-04:00

http://s16.postimg.org/n34erlvrp/Immagine1.jpg

Ver SBIE 07 (OK) Start.exe default_browser

EMET.dll (works)

ExploitShield.dll not (works)

Statistics: Posted by Guest — Mon Apr 29, 2013 3:41 pm

[.07] EMET 4 compatibility

2013-04-29T14:57:44-04:00

Version 4.01.07 adds the compatibility settings suggested by DR_LaRRY_PEpPeR. Thanks!

I took another look at this problem since my last post about it. Forcing the load of AppHelp.dll into the Start.exe process seems to fix the issue with EMET.DLL not always loading.

Please check version 4.01.07.

Statistics: Posted by tzuk — Mon Apr 29, 2013 2:57 pm

[.07] EMET 4 compatibility

2013-04-29T07:18:17-04:00

Right. Again, this seems to go back again to what I was saying about Start.exe in 3.76 not allowing SRP to work (I never updated that thread, I found no evidence at all of problems you talked about 32<->64 bit loading)...

Simply, if Start.exe was started as a NORMAL program inside the sandbox (e.g. like cmd.exe example), OR another copy, with the program to start as an argument, it should all work absolutely fine. I cannot figure out why Start.exe does this weird-acting stuff when it seems to already start running in the sandbox...

Sampei Nihira, sorry, what about Wilders...? Yeah, I saw your posts there, and I check there when I check here usually.

Statistics: Posted by DR_LaRRY_PEpPeR — Mon Apr 29, 2013 7:18 am

[.07] EMET 4 compatibility

2013-04-29T07:10:38-04:00

I looked into this today. EMET.DLL injects into forced programs, or programs that are not started directly through Start.exe.
For example run cmd.exe then use that to run iexplore.exe, and iexplore.exe will have EMET.DLL injected.
Or run Internet Explorer as a forced program, iexplore.exe will have EMET.DLL injected.

EMET is injected by the shim engine component, instructed by data below this registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags

From what I can tell the problem has to do with Start.exe itself not loading the shim engine component,
which might affect the program it starts. I have not researched this at depth.

Statistics: Posted by tzuk — Mon Apr 29, 2013 7:10 am

[.07] EMET 4 compatibility

2013-04-29T06:51:25-04:00

Great news !!!
Alerts you of Wilders ?
My English is very bad.

Statistics: Posted by Guest — Mon Apr 29, 2013 6:51 am

[.07] EMET 4 compatibility

2013-04-29T06:26:57-04:00

Guest10, that shortcut is fine, IF Opera.exe is in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths or its folder is in the PATH env var, of course (I guess!).

Sampei Nihira, I tried that with iexplore.exe (it's in App Paths), modifying the Sandboxed Browser shortcut, as well as one created from Shell Integration > Add Shortcut Icons. While neither unmodified allows EMET to load, your modification DOES WORK! Nice find , and yet more weirdness...

BTW, I thought maybe it was an issue, running shortcuts through Start.exe, but no, as it still fails if I go to the Program Files folder and Run Sandboxed directly on iexplore.exe.

Statistics: Posted by DR_LaRRY_PEpPeR — Mon Apr 29, 2013 6:26 am

[.07] EMET 4 compatibility

2013-04-24T15:25:54-04:00

Sampei Nihira wrote:http://s24.postimg.org/hektqlnk5/Immagine.jpg

The .jpg file shows:
C:\Programmi\Sandboxie\Start.exe Opera.exe
but this cannot be correct.

Assuming that the "C:\Programmi" part is correct, then it should probably be something like:
C:\Programmi\Sandboxie\Start.exe C:\Programmi\Opera\Opera.exe
although I don't know the exact path to the opera.exe file.

You should allow Sandboxie to make a shortcut for you:
Sandboxie Control tray icon window > Configure > Windows Shell Integration
"Add shortcut icons" button.

Statistics: Posted by Guest10 — Wed Apr 24, 2013 3:25 pm

[.07] EMET 4 compatibility

2013-04-24T09:46:24-04:00

@ DR_LaRRY_PEpPeR

Ok, the same results for me.
Just changing the "start default....." with the name browser.
See at the image:

http://s24.postimg.org/hektqlnk5/Immagine.jpg

P.s.

DR_LaRRY_PEpPeR there's a solution for it:

http://www.sandboxie.com/phpbb/viewtopi ... c7539c82ab

Statistics: Posted by Guest — Wed Apr 24, 2013 9:46 am

[.07] EMET 4 compatibility

2013-04-24T05:40:15-04:00

Sampei Nihira, yes, still need to add the setting in 4.01.06, since tzuk has not updated the EMET Template yet. Again, this is only for notifications, which people probably do want to see, but should rarely, if ever, happen.

And the EMET DLL is loading correctly in that screenshot because it's with Sandboxie 3.76. The problem is only (generally) with Run Sandboxed/Start.exe shortcuts since 4.01.04, and is in no way related to EMET 4. It's a Sandboxie/AppCompat bug that probably affects any "Shim DLL" that should be loaded! My complete findings are in the second half of my original post...

Statistics: Posted by DR_LaRRY_PEpPeR — Wed Apr 24, 2013 5:40 am

[.07] EMET 4 compatibility

2013-04-24T04:47:56-04:00

Emet_lover wrote:No. Emet will not work properly. Emet.dll is not loaded if the browser is run through shortcuts or right click run sandboxed.

What doyou mean, it looks like it load the .dll correctly

http://www.wilderssecurity.com/attachme ... 1366610409

Statistics: Posted by Guest — Wed Apr 24, 2013 4:47 am

[.07] EMET 4 compatibility

2013-04-23T20:12:12-04:00

No. Emet will not work properly. Emet.dll is not loaded if the browser is run through shortcuts or right click run sandboxed.

Statistics: Posted by Guest — Tue Apr 23, 2013 8:12 pm