Programs fails to start from command prompt

[Cedd]

Thank you for the investigation and reply, again.

I run 'accesschk.exe' and I got "SBIE2337 Failed to start program: [44 / 2]"... However that happens only with TCC/LE (a free version of Take Command -- https://jpsoft.com/). When I tested the same with Window's Command Prompt, 'accesschk.exe' printed its output to the same (un-sandboxed) command prompt OK (and the program was run under the supervision, as expected).

So, something odd is happening with TCC/LE.

You mentioned earlier that SBIE2337 means "file not found", so maybe a new prompt is created behind the scenes (and not yet visible), but/and the file path or the current directory gets somehow distorted and the file cannot be launched as it cannot be found...or something. And then there was, also, the issue that you cannot run TCC/LE as sandboxed... (As I mentioned earlier) it will throw the following error:

Code: Select all

SBIE2303 Could not hook NtQueryObject (888)
SBIE2304 Initialization failed for process tcc.exe

I'm using TCC LE 13.06.77 x64.

[Craig@Invincea]

What happens when you drag tcmd.exe into SBIE Control > Programs Files?

It should prompt you for a sandbox to install it to.

The installer will then run. Depending on what you choose, Windows UAC may be triggered, and if you agree to that, some components will be installed on your host machine.

You can then run the program in a SB.

[Cedd]

I downloaded all the installer packages of Take Command Console: the commercial/trial and free versions (tcmd.exe, tcmdx64.exe, tccle.exe, tcclex64.exe).

I'm able to run all the installers inside a sandbox. However, when I try to run 64-bit TCC command prompt from that sandbox, I'm getting SBIE2303 and SBIE2304, as earlier. 32-bit command prompts will run as sandboxed, though.

When running a command-line program from a sandboxed 32-bit TCC command prompt, the program's output will go to cmd window (as it should). However, if I run a non-sandboxed command prompt and launch a command-line program from a Forced Folder, then a new cmd window opens (the program runs as sandboxed, its output goes to the new cmd window, and then the window closes).

Window's Command Prompt works OK when you have a non-sandboxed prompt and you run a program from Forced Folder. Well, I noticed a small issue/bug in it: if you use piping, then the cmd window's title is not restored back to the non-sandboxed state. For example, you have a non-sandboxed Command Prompt and you run a program as sandboxed:

Code: Select all

someprog.exe | more

(E.g. 'someprog.exe' is a Forced Program so that it will be run sandboxed.) 'someprog.exe' redirects its output to 'more' and exits. When 'more' is executing, the title is still "[#] Command Prompt [#]", and it does not change after 'more' exits. So, the cmd window's title will incorrectly indicate that it's sandboxed while it's not.

[Craig@Invincea]

(E.g. 'someprog.exe' is a Forced Program so that it will be run sandboxed.) 'someprog.exe' redirects its output to 'more' and exits. When 'more' is executing, the title is still "[#] Command Prompt [#]", and it does not change after 'more' exits. So, the cmd window's title will incorrectly indicate that it's sandboxed while it's not.

Incorrectly? Are you sure about that? You can verify that in Programs view in SBIE ( Or try below, link http://www.sandboxie.com/index.php?FileMenu

The Is the Window Sandboxed? command is used to select a window displayed on the screen, and if the window is owned by a sandboxed program, the command displays the name of the program and the sandbox it is running in.

To use the command, click and hold the left mouse button on the Finder Tool, that is, the icon of a target within a window. Without releasing the left mouse button, drag the target over the desired window, and when the target is within the boundaries of the desired window, release the left mouse button.

If the window is owned by a sandboxed program, Sandboxie will display the program name and sandbox name, will switch the view to Programs View, and highlight that program.

Some programs display their windows using customized graphics, and this prevents Sandboxie from showing the [#] indicators in the title bar. In these cases, you can use the Is Window Sandboxed? command to make sure that the window and its related program are running sandboxed.

[Cedd]

Sorry for the late reply. (I have been travelling.)

Incorrectly? Are you sure about that? You can verify that in Programs view in SBIE ( Or try below, link http://www.sandboxie.com/index.php?FileMenu

Yes, I can confirm it. The title of the command prompt window incorrectly indicates that it's being run sandboxed (while it's not, actually).

The 'Programs' view in SBIE shows that the sandbox is empty. Also, the 'Is Window Sandboxed?' command states that the command prompt is not sandboxed.

Some programs display their windows using customized graphics, and this prevents Sandboxie from showing the [#] indicators in the title bar. In these cases, you can use the Is Window Sandboxed? command to make sure that the window and its related program are running sandboxed.

Of course, in this case, the '[#]' indicators are shown correctly, but they are not removed afterwards (when the sandboxed program run in the command prompt window exists). And without the piping, the '[#]' indicator are removed correctly. So, "custom graphics" are not causing issues here. The chaining of the commands (through the pipe(s)) probably cause some "timing issues".

[Craig@Invincea]

I'll leave this for Curt to address in more specific detail if it's something that should be looked at more closely.

[Craig@Invincea]

When installing the x64 directly into a SB, I'm getting what you had seen earlier SBIE2303 Could not hook NtQueryObject (888)
SBIE2304 Initialization failed for process tcc.exe (I'm on 10x64 and SBIE 5.07.2)

I'll install it directly on my host to see if anything additional I can find out.

[Ransom]

When installing the x64 directly into a SB, I'm getting what you had seen earlier SBIE2303 Could not hook NtQueryObject (888)
SBIE2304 Initialization failed for process tcc.exe (I'm on 10x64 and SBIE 5.07.2)

Same here when trying to simply run an installed x64 tcc in the sandbox

You also may need to configure SBIE to allow the program to access the registry. By default, in a sandbox..that's not permitted.

I already allowed reg access to their keys - but the data in the registry keys are minimal, I doubt that's the problem

It also injects .dll into Windows. I can see that being an issue. This is one of the main reasons Kaspersky doesn't work. It injects and hooks into areas that SBIE needs to be. There is not work around for that. https://jpsoft.com/support/faq.html

That sounds about right, esp. since the x86 (32 bit) version runs just fine - so that's somewhat of a workaround. I suggest you add this possible workaround on the page of the cryptic SBIE2303 error.

Is there some way to trace what dll exactly it is tcc tries to load? If so and it's not essential, I could cross-post the problem to the jpsoft forum and ask them if there's a way make the x64 version compatible with Sandboxie.

[Craig@Invincea]

You can try SBIE resource access monitor http://www.sandboxie.com/index.php?Reso ... essMonitor and / or running Procmon.

Procmon:
Get procmon here (free) https://technet.microsoft.com/en-us/sys ... 96645.aspx


Close any programs that are not needed.
Run Procom (not sandboxed)
and then try and fire up the program (sandboxed of course).
Let the error happen/not load/etc
stop capturing events in Procmon (under file)
then Save the results (under file, make sure "save all events it ticked") and
save in PML format.
These files can be large, so post somewhere we can download and look (link)
OR (Please zip them!) and send to Support@sandboxie.com