SandDiff

Utilities designed for use with Sandboxie
Buster
Posts: 2576
Joined: Mon Aug 06, 2007 2:38 pm
Contact:

Post by Buster » Wed Oct 14, 2009 2:24 am

That may be the reason. I will do some research when I have time.

kxsq

Post by kxsq » Fri Oct 23, 2009 11:13 am

sanddiff1.04 sounds good
thank u

wraithdu
Posts: 1410
Joined: Fri Jun 29, 2007 2:54 pm

Post by wraithdu » Fri Oct 23, 2009 11:14 am

I took a look through Everything's forums and found the reason NETSTAT.EXE is not found in system32. It is because netstat (and many other system32 files) are actually hardlinks. You can google the term. I don't know how this affects opening or running an app via ShellExecute().

Brummelchen
Posts: 388
Joined: Sun Oct 12, 2008 9:13 pm

Post by Brummelchen » Fri Oct 23, 2009 11:31 am

why is netstat neccessary for this program? explain!

wraithdu
Posts: 1410
Joined: Fri Jun 29, 2007 2:54 pm

Post by wraithdu » Fri Oct 23, 2009 2:24 pm

Part of the program can monitor ports that an application has open/listening.

Brummelchen
Posts: 388
Joined: Sun Oct 12, 2008 9:13 pm

Post by Brummelchen » Fri Oct 23, 2009 3:53 pm

And what is the relationship to the reghive and files in sandbox?

is sanddiff working when the box is active or not active?

its a bit like watching an electron (heisenberg): you cannot determine position and impulse same time ;)

Buster
Posts: 2576
Joined: Mon Aug 06, 2007 2:38 pm
Contact:

Post by Buster » Fri Oct 23, 2009 5:34 pm

Brummelchen wrote:And what is the relationship to the reghive and files in sandbox?

is sanddiff working when the box is active or not active?

its a bit like watching an electron (heisenberg): you cannot determine position and impulse same time ;)
Sanddiff works when Sandboxie is not active.

SandDiff compares 2 moments of a given sandbox. Let´s call them "before and "after".

In the "before" moment the sandbox folder can be empty or contain information.

In the "after" moment the sandbox folder must contain information if not it´s pointless.

Between the "before" and the "after" you must run sandboxed whatever you want.

When you are done you terminate all processes and you are ready for comparision.

Sanddiff compares the file, registry and port differences between the "before" and the "after" states of the sandbox.

Relationship to the reghive and files in sandbox? None. It´s just another source of information to compare.

I think it´s pretty simple to understand. Let me know if something is not clear.

The next version of SandDiff will contain a new feature. It will check for malware activity and present results to the user based in the differences.

Brummelchen
Posts: 388
Joined: Sun Oct 12, 2008 9:13 pm

Post by Brummelchen » Sat Oct 24, 2009 1:22 pm

i understand your explanation - i can reproduce both ways.
what i NOT understand is the use of netstat in that combination.
if there is nothing active what to determine?
(except looking into registry i dont know a way to determine if
a sandbox is still active, never though about it till now)

Buster
Posts: 2576
Joined: Mon Aug 06, 2007 2:38 pm
Contact:

Post by Buster » Sat Oct 24, 2009 2:46 pm

Brummelchen wrote:i understand your explanation - i can reproduce both ways.
what i NOT understand is the use of netstat in that combination.
if there is nothing active what to determine?
(except looking into registry i dont know a way to determine if
a sandbox is still active, never though about it till now)
Netstat is used to obtain the state of the ports.

Netstat automatically retrieves port information when you press "before".

Optionally you can press "Meanwhile" button and obtain port information before you press "after".

You decide when you press "Meanwhile" or even if you want to press it.

The user must press "after" when he has finished sandboxed processes. SandDiff doesn´t determine if a sandbox is still active.

Brummelchen
Posts: 388
Joined: Sun Oct 12, 2008 9:13 pm

Post by Brummelchen » Sat Oct 24, 2009 3:59 pm

Netstat automatically retrieves port information
and that is the point i dont understand.
if sanddiff does not care about activity what to determine at open ports and listening apps?

#hmm - just startet sanddif 1.04 - netstat is needed for the "meanwhile" option and open apps?

Buster
Posts: 2576
Joined: Mon Aug 06, 2007 2:38 pm
Contact:

Post by Buster » Sat Oct 24, 2009 5:28 pm

Brummelchen wrote:and that is the point i dont understand.
if sanddiff does not care about activity what to determine at open ports and listening apps?

#hmm - just startet sanddif 1.04 - netstat is needed for the "meanwhile" option and open apps?
Who did say SandDiff doesn´t care about port activity?

Yes, netstat is needed for the "meanwhile".

Buster
Posts: 2576
Joined: Mon Aug 06, 2007 2:38 pm
Contact:

Post by Buster » Tue Oct 27, 2009 5:02 am

I have fixed the problem with deleted keys/values.

As soon as tzuk adds the feature I requested I will release a new version.

Buster
Posts: 2576
Joined: Mon Aug 06, 2007 2:38 pm
Contact:

Post by Buster » Tue Oct 27, 2009 4:09 pm

wraithdu wrote:I took a look through Everything's forums and found the reason NETSTAT.EXE is not found in system32. It is because netstat (and many other system32 files) are actually hardlinks. You can google the term. I don't know how this affects opening or running an app via ShellExecute().
I have a computer with Windows XP and Windows 7 installed and when I´m running Windows XP I can see NETSTAT.EXE in \Windows\System32 and does not look like a hard link. The file is 32kb long. :?

wraithdu
Posts: 1410
Joined: Fri Jun 29, 2007 2:54 pm

Post by wraithdu » Tue Oct 27, 2009 10:27 pm

The hardlink is only in Win7. Maybe Vista, but I don't have it to test anymore. And the hardlink will seem exactly the same as the real file - properties, size, appearance, etc. - except the Compatibility settings will be greyed out.

brahman
Posts: 3
Joined: Thu Oct 29, 2009 7:09 am

Feature Request: Save Differences in Reg Format

Post by brahman » Thu Oct 29, 2009 7:14 am

Hi,

thanks for this great app.

It would be very nice if it could save registry differences automatically in Windows Registry Editor Version 5 format.

Thanks.

B.

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests