Sandboxie Support

Why emet at all with Sandboxie?

2013-09-19T16:42:59-04:00

If I'm running programs within Sandboxie as I am, why do I even need EMET. Any damage rogues might do would be contained in the Sandboxie would they not?

Given I have both products what is the recommended way do I run emet itself within Sandboxie?

I must be missing something?

Statistics: Posted by Escalader — Thu Sep 19, 2013 4:42 pm

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-08-13T01:09:14-04:00

Run a browser under Sandboxie directly(without open Windows Explorer), HitmanPro.Alert can inject it's hmpalert.dll to the browser or any other process, that's really a surprise.

Statistics: Posted by dismaze — Tue Aug 13, 2013 1:09 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-23T10:17:58-04:00

Thanks for the workaround. But, I know it is difficult, I still hope one day there is a normal way to use EMET 4 with Sandboxie 4 without using other workaround.

Also can you please take a look of Malwarebytes Anti-Exploit？It has a similar problem, too.

The three products both have ability to protect user from zero day exploit, if user can combine these together, I think it will very effective to defend bad things from web.

Statistics: Posted by dismaze — Tue Jul 23, 2013 10:17 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-23T07:30:26-04:00

No, you're talking about injecting using Win32 hooks, EMET is injecting using the Windows compatibility layer.

Statistics: Posted by tzuk — Tue Jul 23, 2013 7:30 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-23T06:42:48-04:00

tzuk wrote:I looked into this and I can see the problem, but I don't know if I am going to fix it.

The thing is that I want to prevent the "application compatibility layer" DLL (AppHelp.dll) from loading into Sandboxie programs like Start.exe because if one mistakenly sets the option "run this program in compatibility mode for another versions of Windows" then it introduces strange problems in Sandboxie. This has happened in the past.

On the other hand, EMET is relying on that DLL to inject itself into programs, and therein lies the problem, because Start.exe does not load the AppHelp.dll.

Now one kind of fix is to run your browser as a forced program and then Start.exe is not involved and EMET DLLs are injected correctly, but I understand not everyone uses the forced program feature.

So a possible workaround is to create a special shortcut that uses an intermediate program. Right-click New > Shortcut on the desktop, then paste:
CODE:
"C:\Program Files\Sandboxie\Start.exe" explorer "C:\Program Files\Internet Explorer\iexplore.exe"
So you're getting Explorer.exe to launch Internet Explorer (or whatever browser) and Explorer.exe will load AppHelp.dll and will inject EMET into the new process it is starting.

Hope this helps.

Sorry for potentially hijacking this thread, but I was wondering whether this workaround would also fix this issue?:
http://www.sandboxie.com/phpbb/viewtopic.php?t=15797

Statistics: Posted by ssj100 — Tue Jul 23, 2013 6:42 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-23T06:26:49-04:00

txs a lot, Tzuk!

Although applying the workaround it fixes the problem related to the browser, the problem remains in the case of downloading a pdf file.
Even if the player is emetized, Sandboxie prevents the loading of the dll inside the memory space of the reader...

Statistics: Posted by nsb — Tue Jul 23, 2013 6:26 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-23T02:58:42-04:00

Yes, sandboxed Explorer.exe will do that.

Statistics: Posted by tzuk — Tue Jul 23, 2013 2:58 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-22T16:44:14-04:00

Following your hint, everything works as expected.

I was wondering though if it is an expected behaviour that explorer.exe is terminated automatically after a short time frame...

Statistics: Posted by nsb — Mon Jul 22, 2013 4:44 pm

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-21T09:07:10-04:00

thx for the fix, confirmed to be working on chrome + emet 4.0

Statistics: Posted by blasev — Sun Jul 21, 2013 9:07 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-18T07:38:22-04:00

I looked into this and I can see the problem, but I don't know if I am going to fix it.

The thing is that I want to prevent the "application compatibility layer" DLL (AppHelp.dll) from loading into Sandboxie programs like Start.exe because if one mistakenly sets the option "run this program in compatibility mode for another versions of Windows" then it introduces strange problems in Sandboxie. This has happened in the past.

On the other hand, EMET is relying on that DLL to inject itself into programs, and therein lies the problem, because Start.exe does not load the AppHelp.dll.

Now one kind of fix is to run your browser as a forced program and then Start.exe is not involved and EMET DLLs are injected correctly, but I understand not everyone uses the forced program feature.

So a possible workaround is to create a special shortcut that uses an intermediate program. Right-click New > Shortcut on the desktop, then paste:

CODE:

"C:\Program Files\Sandboxie\Start.exe" explorer "C:\Program Files\Internet Explorer\iexplore.exe"

So you're getting Explorer.exe to launch Internet Explorer (or whatever browser) and Explorer.exe will load AppHelp.dll and will inject EMET into the new process it is starting.

Hope this helps.

Statistics: Posted by tzuk — Thu Jul 18, 2013 7:38 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-11T10:14:14-04:00

Of course the child processes get it OK. Start.exe is not involved in starting them, which seems to be the problem!

Hasn't this been the case each time there's an issue...?

Statistics: Posted by DR_LaRRY_PEpPeR — Thu Jul 11, 2013 10:14 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-11T10:03:52-04:00

Hi, tzuk:
i observ the same behaviour even in the case of IE 10 where infact the dll is injected only within the slave (child) process..

Statistics: Posted by nsb — Thu Jul 11, 2013 10:03 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-11T05:29:56-04:00

regarding google chrome, sandboxie prevents the injection of emet.dll within the memory space of the parent process.
The injection of the dll is instead allowed correctly for its child processes.

EMET 4.0.4913.26122
Sbxie 4.04
OS: 8x64

Statistics: Posted by nsb — Thu Jul 11, 2013 5:29 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-08T11:22:09-04:00

OK, EMET version number is 4.0.4913.26122.

Statistics: Posted by dismaze — Mon Jul 08, 2013 11:22 am

Sandboxie 4.02/4.04 not fully compatible with EMET 4.0

2013-07-08T10:49:12-04:00

In that topic that you linked I did fix (at the time) the same problem that you are describing here.
But I can check again specifically on 32-bit Windows 7.
Can you quote a specific version number for EMET ?

Statistics: Posted by tzuk — Mon Jul 08, 2013 10:49 am