Programs fails to start from command prompt

[Cedd]

Sandboxie v5.06 (64bit) (registered)
Windows 8.1 (64bit)
The Windows installation is "plain": no third party anti-virus or firewall software.

The following two issues exist in all the Sandboxie versions 4.x and 5.x. I remember that when the very first v4.x was published, some windows handling mechanism was changed in Sandboxie, making my XP computer to open program windows very slowly (we are talking several (1-3) seconds here). I actually have to revert back to v3.x version, because it was too slow to use programs that open windows/dialogs during the usage. That issue (on XP) might very well be related or even responsible for the problems I have in Windows 8.1:

1)
Let's say you have a sandbox with 'Forced Folder' pointing to a directory containing a command-line program. (A command-line program does not use window(s), but just prints its output to the command prompt window that was used to execute it.)

Now, if you execute that command-line program from a command prompt window, then a new command prompt window is always opened and the program is run in it. (Instead, the program should naturally run inside the very same command prompt window from which it was executed.)

This makes such the usage of command-line programs impossible. For example, let's say you launch Microsoft File Checksum Integrity Verifier to see checksums of a file. Then a new command prompt window gets opened and closed instantly -- you don't have the time to read what File Checksum Integrity Verifier printed to the screen!


2)
You cannot run (some) programs from a command prompt if you are "inside" a sandbox (see below). This concerns both command-line programs and/or windowed programs, BUT some programs will start OK, while others will fail. You will get the following error (if the start will fail):

Code: Select all

SBIE2337 Failed to start program:  [44 / 2]

By "inside" a sandbox I mean the following. Start a command line prompt and change the current directory inside a sandbox. For example, let's say you have a sandbox named 'mybox' and its location is 'c:\sandbox\mybox'. Now, let's launch 'zip.exe' "inside" the sandbox by entering the following commands:

Code: Select all

cd c:\sandbox\mybox\drive\c

zip.exe

(Assuming 'zip.exe' is found from the path or from the current directory. 'zip.exe' might or might not start, depending how it was build/compiled.)

For instance, the command-line programs of http://gnuwin32.sourceforge.net/ seems to work (at least some of them), but all of my own command-line programs compiled with the old good Visual C++ 6.0 do not work.

Curiously, when I tested command-line programs of http://www.imagemagick.org/script/index.php, 'convert.exe' worked, but pretty much any other program there (e.g. 'compare.exe', 'ffmpeg.exe', etc.) failed to start!

About windowed programs (i.e. non-command-line programs)... The calculator 'calc.exe' of Windows starts OK. But majority(?) seems to fail. For example, 'swriter.exe' of OpenOffice.org v3.x does not work (and probably the latest version of it does not launch either).

[Craig@Invincea]

Are you following the tips listed here for command line launching of programs under the supervision of SBIE?
http://www.sandboxie.com/index.php?Star ... Line#start

[Curt@invincea]

SBIE2337 Failed to start program: [44 / 2] means the file you tried to run was not found.

You don't want to do cd c:\sandbox\mybox\drive\c inside a sandboxed cmd prompt. The sandbox folder is where Sbie redirects files that are modified by sandboxed applications. If a sandboxed app tries to access something inside the sandbox folder directly, it will get very confused.

[Cedd]

Are you following the tips listed here for command line launching of programs under the supervision of SBIE?
http://www.sandboxie.com/index.php?Star ... Line#start

I'm not, because those instructions are not relevant in this case. I mean, I'm using 'Forced Folders' feature of Sandboxie, which will (as you know) automatically launch programs under the supervision of SBIE. The chapter 'Start Programs' (you're likely referring to) is telling how to explicitly launch programs under the supervision.

Note that in my case, programs are indeed launched (implicitly) under the supervision of SBIE. It seems that SBIE does not realize that a program is launched by using a command prompt, and/so it will create a new command prompt window/process. It works like you would have launched the program by other means, for example, by using Windows Explorer.

SBIE2337 Failed to start program: [44 / 2] means the file you tried to run was not found. You don't want to do cd c:\sandbox\mybox\drive\c inside a sandboxed cmd prompt. The sandbox folder is where Sbie redirects files that are modified by sandboxed applications. If a sandboxed app tries to access something inside the sandbox folder directly, it will get very confused.

I'm not using a sandboxed command prompt -- it is not under the supervision of SBIE.

Anyway, I don't see why the current directory would make any difference when a program is launched, and what mechanism was used to launch it. For instance, let's say I have a command prompt and Windows Explorer that both are not running under SBIE's supervision:

Code: Select all

1)
cd c:\
sandbox\mybox\drive\c\zip.exe

2)
cd c:\sandbox\mybox\drive\c
zip.exe

3)
Using Windows Exporer to launch 'c:\sandbox\mybox\drive\c\zip.exe'.

The end result should be the same in all three cases. SBIE catches the program's "startup event", and sees that the program is located under a sandbox directory, meaning it's always launched under the supervision.


I have been using Sandboxie heavily over many years, and I would like to continue using this great product also with the command prompt, scripts, etc. So it would be really nice if the "new command prompt window" issue would be fixed, at least.

[Craig@Invincea]

You don't want to do cd c:\sandbox\mybox\drive\c inside a sandboxed cmd prompt. The sandbox folder is where Sbie redirects files that are modified by sandboxed applications. If a sandboxed app tries to access something inside the sandbox folder directly, it will get very confused.

I would take Curt's advice on it. I don't think a "new cmd prompt window" is something we would look into at this time, but we will discuss it.

[Curt@invincea]

Why do you want to start a host cmd prompt, cd to the sandbox folder, and run an exe from there? What are you trying to accomplish with that?

[Cedd]

Why do you want to start a host cmd prompt, cd to the sandbox folder, and run an exe from there? What are you trying to accomplish with that?

I'm just using my computer. You know, Windows Explorer is not the only way to use it. Ok, I understand that Windows users may not be familiar with it because Windows' standard command prompt is poor. But use TCC/LE or something else (and tweak it to your liking), and often it's faster and more effective way of using computer than Windows Explorer and/or graphical programs. (And I guess many Linux/Unix users out there tend to agree, at least.) For example (and this is a very simple example), let's say I have downloaded a program. I unpack the package into a sandbox and run the program there. That is less laborious for me to do with a command prompt than by using Explorer.

And (not to least) when you do scripting, you may want to run programs that are located in sandboxes. For example, you have a shortcut to a script that first launches AutoHotkey (that remaps the keys) and then runs a game by calling 'Steam.exe'.


It seems that Sandboxie v3.x works like this:
When you run a command-line program via a command prompt, Sandboxie checks if the program should be launched under the supervision. That happens if the program is located in a sandbox or in a 'Forced Folder'. Or the program is a 'Forced Program'. In that case, the command prompt is temporary "transferred" under the supervision of SBIE and the program is run in that command prompt. (In case of a non-command-line program, the program is launched as a separate process that is run under the supervision of SBIE.)

That would be (and was) logical, consistent, and perfect way.


By the way, the error SBIE2337 also happens when you launch a program via a command prompt and your current directory is not inside a sandbox. I did not mention that earlier. For example, when you do:

Code: Select all

cd c:\
sandbox\drive\c\zip.exe

Heh, it's almost like that Sandboxie would try to temporary "transfer" the command prompt under the supervision of SBIE, and then run the program in the command prompt, just like in v3.x. But could not quite do it. Well, I would like to think that the latest Sandboxie has all the "means" to work like v3.x in this matter -- it's just how the things (details) are put together, I hope.

[Curt@invincea]

Open a sandboxed cmd prompt and run the exe from there.

[Cedd]

Open a sandboxed cmd prompt and run the exe from there.

Thanks for the tip -- that might be useful in some case. Of course, that workaround is not viable for normal use (you cannot run programs inside a different sandbox and you cannot run commands and programs outside a sandbox).

Seems that the command prompt I'm using, TCC/LE (a free version of Take Command -- https://jpsoft.com/), cannot be launched as sandboxed:

Code: Select all

SBIE2303 Could not hook NtQueryObject (888)
SBIE2304 Initialization failed for process tcc.exe

TCC LE 13.06.77 x64

[Curt@invincea]

Open a sandboxed cmd prompt and run the exe from there.

Thanks for the tip -- that might be useful in some case. Of course, that workaround is not viable for normal use (you cannot run programs inside a different sandbox and you cannot run commands and programs outside a sandbox).

That's not a workaround, that's the proper way to use Sbie. You can start a cmd prompt in any sandbox you want. Ignore the sandbox folder. Pretend it doesn't exist.

[Cedd]

Open a sandboxed cmd prompt and run the exe from there.

Thanks for the tip -- that might be useful in some case. Of course, that workaround is not viable for normal use (you cannot run programs inside a different sandbox and you cannot run commands and programs outside a sandbox).

That's not a workaround, that's the proper way to use Sbie. You can start a cmd prompt in any sandbox you want. Ignore the sandbox folder. Pretend it doesn't exist.

I think we are talking about a different thing here. Seems that you are concentrating to single use cases, while I'm talking about the general use (of a computer via a command prompt). I mean, one does not normally run Windows Explorer under the Sandboxie's supervision, so one does not normally want to do that for a command prompt either.

As I said earlier, command prompts and Windows Explorer (and other similar programs) are just different user interfaces to use a computer. Ideally both the ways would be analogous to each other in respect of Sandboxie. But now command prompt(s) and command-line line programs are handicapped, unfortunately. (Sandboxie v3.x works perfectly in that respect, though.)

[Curt@invincea]

You seem reluctant to take my suggestions. So, please give me reproducible steps that show how command line programs are "handicapped".

[Cedd]

You seem reluctant to take my suggestions. So, please give me reproducible steps that show how command line programs are "handicapped".

Heheh, I'am (reluctant), because these issues affect/hinder my daily work usually. (The work I could do with Sandboxie v3.x.)

Well, I think I have listed the minimal steps for reproducing the issues in my earlier posts, but here are the formal descriptions and steps...

Code: Select all

Description:

    Let's have a command-line program which is configured to be run under the supervision of SBIE.
    The program is then launched from a command prompt. A new, temporary command prompt (supervised by SBIE)
    is opened and the program is run in it. (The new command prompt is closed after the program finishes.)

    This also breaks piping ('|') and redirection ('>', '<', etc).
    So you cannot, for instance, redirect the output of the command into a file.

    Also, usually the temporary command prompt is closed quicky, so you cannot even see its output.


Expected Result:

    Instead of opening a new command prompt, the old one (used to run the program) is temporary elevated to
    run under the supervision of SBIE and the program is executed in it.


Why?

    So that you could run some of the command-line programs inside a sandbox while working normally
    with your computer. For instance, you don't trust the command-line program to be run non-sandboxed,
    or you just want to keep it "contained/portable" for other reasons (e.g. so that all the config files etc.
    are kept inside a single directory, i.e. sandbox folder).


Steps to reproduce (one way -- there are several ways):

    1)
    Download the command-program 'file' from here: http://gnuwin32.sourceforge.net/packages/file.htm

    That is, the binary package: http://downloads.sourceforge.net/gnuwin32/file-5.03-bin.zip

    2)
    Unzip the package of 'file' somewhere, e.g.: c:\file

    3)
    Create a sandbox (or use existing one), e.g.: c:\sandbox\mybox

    4)
    Configure the directory of 'file' ('c:\file') to be 'Forced Folder' in the sandbox you created.
    
    5)
    Open a command prompt (not as sandboxed) and run 'file' from there, e.g.:

        cd c:\
        c:\file\bin\file.exe

Code: Select all

Description:

    When CD'ing inside a sandbox and executing a program (command-line or windowed) from there,
    the program might fail to start.

    The error message is:
        SBIE2337 Failed to start program:  [44 / 2]


Expected Result:

    All the executed programs run under the supervision of SBIE, as normal.


Why?

    So that you could run scripts that are inside sandboxes, for instance.
    Or you could use a command prompt when working with the sandbox directory (unpacking packages,
    executing programs)...


Steps to Reproduce:

    1)
    Download the command-program 'file' from here: http://gnuwin32.sourceforge.net/packages/file.htm

    That is, the binary package: http://downloads.sourceforge.net/gnuwin32/file-5.03-bin.zip

    2)
    Create a sandbox (or use existing one), e.g.: c:\sandbox\mybox

    3)
    Extract 'file' into the sandbox, e.g.: c:\sandbox\mybox\drive\c\file

    4)
    Open a command prompt (not as sandboxed), CD into the sandbox folder, and run 'file' from there, e.g.:

        cd c:\sandbox\mybox\drive\c\file\bin\
        file.exe

Finally, just a reminder of the issue I noticed earlier:

The command prompt TCC/LE (a free version of Take Command -- https://jpsoft.com/), cannot be launched as sandboxed:

Code: Select all

SBIE2303 Could not hook NtQueryObject (888)
SBIE2304 Initialization failed for process tcc.exe

TCC LE 13.06.77 x64

[Curt@invincea]

I ran your 1st scenario, and I don't get the same behavior you describe. file.exe outputs to the same cmd line window whether the file or folder is forced or not.

1) Get sysinternals suite from sysinternals.com
2) Unzip into c:\SysInternals
3) Add c:\Sysinternals as a forced folder in Sbie.
4) Start un-sandboxed cmd prompt.
5) Run accesschk.exe
6) Accesschk.exe runs in sandbox, output goes to un-sandboxed cmd window. No additional windows are created.
7) Repeat by unforcing c:\sysinternals, and forcing accesschk.exe. Same result.

What you are describing sounds like someone is creating a new cmd prompt window, running the exe, then immediately closing the window. I don't know what is doing that in your situation. I can get that same result by running this: "C:\Program Files\Sandboxie\Start.exe" accesschk

[Curt@invincea]

Scenario 2, again normally you need to ignore the fact that c:\sandbox exists. That is why there is a DONT-USE.TXT file under there. If you want to install something in the sandbox, run the installer under Sbie.