SandboxDiff - Registry/Files changes

[George]

I did exactly as you said, yet it still runs in sandbox mode. Try using this with the latest version of sandboxie.

I have the exact same error as casey too.

Thanks

[George]

Version 3.30

Released on 2 September 2008.

These are the changes to Sandboxie since version 3.28.

* New features:

* Forced Folders protection extended to apply to documents as well as programs.

...

That probably explains it.

[wraithdu]

Easy solution.

Copy the files to their locations as instructed.
Now start a cmd prompt via Start -> Run... -> cmd.exe
'cd' to your sandbox directory, ie 'cd C:\Sandbox\DefaultBox'
Now type SandboxDiff.bat

You can thank me later

[majoMo]

George, thanks a lot for the info.

It will be update as soon as possible.

The wraithdu'solution is interesting.

[majoMo]

SandboxDiff updated.

Download and additional info in first post.

P.S.: Thanks again Casey44 and George for your useful information and feedback.

[wraithdu]

I'm curious if you tested this. On my system, Vista SP1 32-bit, I cannot run anything from C:\Sandbox. I cannot even open a text file. SB has this folder under some sort of protection.

[tzuk]

wraithdu, do you mean just C:\Sandbox,
or do you mean C:\Sandbox and anything below it?

[majoMo]

wraithdu, tested under Win XP.

I can't run anything from "C:\Sandbox\<UserName>\DefaultBox\".

I can run normally from "C:\Sandbox\" and "C:\Sandbox\<UserName>\" .

'SandboxDiff.exe' (with the customized 'UserPath.bat') is capable of being executed normally inside "C:\Sandbox\".

[wraithdu]

Huh, nevermind I guess. Works fine today. But yes, I meant only in C:\Sandbox. Launching from subfolders was fine. But yeah, today it all works ok. Not sure what changed, oh well.

[Casey44]

SandboxDiff updated.

Download and additional info in first post.

P.S.: Thanks again Casey44 and George for your useful information and feedback.

majoMo you beat me to it
I played around with your former .BAT file.
Found following important(?):
1. Comp-Reg.html must be placed outside/higher than Defaultbox area. Otherwise I can't open it.
2. If no sandboxed activity has taken place beforehand, there is no file RegHive file! So copying to hive_1.bak fails!

Following I did:
Placed your files in separate folder C:\SandboxDif
I adapted the BAT with a
SET BoxPath=C:\Sandbox\<user>\Defaultbox
SET DiffPath=C:\SandboxDif
and used %BoxPath% and %DiffPath% everywhere in the BAT
Seemd to work ok. Guess that is about what you did now. Have to check the new EXE out further.

Problem 2. still stands.
With your new SandboxDiff.exe I get "hive path err" as content of the file Reg_Before.txt
Your helpfile could suggest a sort of dummy action in the sandbox to create the first Reghive file...
Or better maybe your pgm could test for the situation, and execute that dummy action?

I made a "Dummy.bat" (echo Hello World; exit)
Doing R-mouse | Run sandboxed runs it UN-Sandboxed (No # in title. Help! Tzuk?) but DOES create a first RegHive file.

So far my observations.
I must say I do have some problems interpreting the "Comp-" files.
I see (first glance only) some strange results.
Must be the DIFF and DIFF1 progs.

Is your SandboxDiff.exe a (sort of) compiled BAT file? With the same DIFF progs as before?
Maybe they need some looking in to.

Thanks so far, great work
I'd LOVE to have a good reg-compare for installs!
BTW: Are ALL regchanges recorded?

Casey

[Casey44]

majoMo
In Step 3 of RegDiff.exe I get error notice
"Can not find ..\hive_1.bak"

Looking in the map (Explorer, F5-ing) I see hive_1.bak present, but disappearing when Step 3 starts.
Being deleted an instruction step too soon??

Casey

Edit: No now it's OK again.
Seems to happen 1 in ... times.
Maybe a delay before the delete. Is possible (exec queues) the step before delete is not finished when delete is done?

[majoMo]

@ Casey,

Like you noticed it's needed that preexist a reghive file before SandboxDiff start their analyze. Your suggestion is adviced: to do "a sort of dummy action" when sandbox folder is empty: e.g. to open/close any .txt file sandboxed is enough. It will be included in helpfile. I'll see if to test the dummy action is easy to do... I don't know yet.

Until now I didn't see any "strange results" in "Comp-" files. It had been accurate in my tests; if for some reason you did a sandboxed analyze action, something like 'virtual' files are recorded... I don't know if it was this kind of annoyance... And yes: "SandboxDiff.exe" is a compiled .bat file: run it sandboxed in "C:\Sandbox" is enough (with "UserPath.bat" customized).

In next update SandboxDiff will support reg-compare; yes, all reg-changes are recorded from Sandboxie'process.

BTW: Your "Dummy.bat" was executed sandboxed in fact: when reghive is created the file was opened sandboxed (even without "# title"). You can test their windows'status in Sandboxie Control Panel: File > Is Windows Sandeboxed? (put a "pause" command in your .bat can help).

In Step 3 of RegDiff.exe I get error notice
"Can not find ..\hive_1.bak"Edit: No now it's OK again.
Seems to happen 1 in ... times.

I think you got this error because you didn't terminate all programs sandboxed (after install) - inadvertent. It's when I get that error.
o
Thanks.

[Grumpus]

I apologise if I'm doing something very obviously wrong here, but I simply do not seem able to run *anything* from C:\sandbox. Cannot open a txt file from there with a double click, can't run an exe without getting the message 'Windows cannot access the specified path, device or file. You may not have the appropriate permissions to access the item'.

I'm logged in as administrator, and can obviously run programs and files from any other location on my computer. This problem happens when I have Sandboxie both running and not running.

Is there some kind of protection option that I need to turn off? Thanks in advance to whoever is able to point out just where in this process I am being a dolt

[MFS]

Thanks for your utility that is a great help

Do you keep working on it in order to improve it ?

Best regards

[majoMo]

Glad to know it's useful to you.

I'm testing registry changes in .reg format to add in next update.

Merry Christmas.