Medical Imaging Disc Error

Please post your problem description here

Moderator: Barb@Invincea

Post Reply
sgrechtman
Posts: 4
Joined: Wed Feb 17, 2016 10:42 am

Medical Imaging Disc Error

Post by sgrechtman » Wed Feb 17, 2016 11:00 am

We bought 40 corporate copies of Sandboxie to allow medical staff to view medical imaging discs (cd's/dvd's) while being sandboxed. On one of these types of discs, while launching the viewer, an error is received. It seems like it's a .NET error or another library, but I'm not entirely sure. It seems like the application (Reviewer.exe) is unable to access something that it needs outside of the sandbox. The disc does work while being launched normally (not sandboxed). I have gone through email support for this issue as well, but it hasn't been resolved yet. I have tried some suggestions adding the entire dvd drive and/or folders as direct access exceptions (have tried many combinations), but it still throws an error (although I have seen it throw a different error message). Any assistance with this will be greatly appreciated.

OS: Win7 Enterprise SP1 x64
.NET: 4.5.2
Sandboxie: 5.08

Thanks!



Error screenshots are attached. 001 is the normal error. 002 is received after adding exceptions.




UPDATE:

Here are the actual error messages copied/pasted:

---------------------------

---------------------------
Access denied - at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus errorCode)
at System.Management.ManagementEventWatcher.Start()
at Reviewer.Common.IO.WMIVolumeWatcher.CreateWatcher(String eventClassName, String eventQueryString, EventArrivedEventHandler handler)
at Reviewer.Common.IO.WMIVolumeWatcher.LoadOpticalDriveEvents()
at Reviewer.Common.IO.WMIVolumeWatcher..ctor()
at Reviewer.Common.ReviewerGlobal.Start()
at Reviewer.Program.ApplicationInstance.OnStartup(StartupEventArgs eventArgs)
at Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.DoApplicationModel()
at Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.Run(String[] commandLine)
at Reviewer.Program.Main(String[] args)
---------------------------
OK
---------------------------




---------------------------

---------------------------
Cannot create a file when that file already exists.
- at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.__Error.WinIOError()
at System.IO.File.Move(String sourceFileName, String destFileName)
at Reviewer.Program.InitializeTracing()
at Reviewer.Program.ApplicationInstance.OnInitialize(ReadOnlyCollection`1 commandLineArgs)
at Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.DoApplicationModel()
at Microsoft.VisualBasic.ApplicationServices.WindowsFormsApplicationBase.Run(String[] commandLine)
at Reviewer.Program.Main(String[] args)
---------------------------
OK
---------------------------
Attachments
Sandboxie_Error_001.jpg
Sandboxie_Error_001.jpg (190.1 KiB) Viewed 907 times
Sandboxie_Error_002.jpg
Sandboxie_Error_002.jpg (181.07 KiB) Viewed 907 times

sgrechtman
Posts: 4
Joined: Wed Feb 17, 2016 10:42 am

Re: Medical Imaging Disc Error

Post by sgrechtman » Tue Mar 08, 2016 10:06 am

Bump. Still trying to get a solution/workaround for this if possible.

Craig@Invincea
Sandboxie Support
Sandboxie Support
Posts: 3523
Joined: Thu Jun 18, 2015 3:00 pm
Location: DC Metro Area
Contact:

Re: Medical Imaging Disc Error

Post by Craig@Invincea » Thu Mar 10, 2016 3:06 pm

I spoke with Curt this afternoon, and from the Procmon, there isn't anything there we can see. Something is being blocked, but what we don't know.

Is there a way (a trial) of this software we can look at to test internally?

BUCKAROO
Posts: 206
Joined: Sun Oct 24, 2010 3:13 am

Re: Medical Imaging Disc Error

Post by BUCKAROO » Fri Mar 11, 2016 6:22 am

Sandboxie Control . Configure . Forget Hidden Messages

System.Management.ManagementEventWatcher.Start()
"Subscribes to events with the given query and delivers them, asynchronously, through the EventArrived event."

Code: Select all

SBIE2205 Service not implemented:  WMI IWbemServices 23
ExecNotificationQueryAsync
Asynchronous version of the IWbemServices::ExecNotificationQuery method.
Opnum: 23
If you use a prescribed workaround -- search the error message, the method isn't supported by Sandboxie -- to talk to the real Windows Management Instrumentation (WMI), uh it probably won't workaround it but quit at new ManagementEventWatcher(); if not sooner.

So I don't know what you're gonna do save for an examination of the assembly and a hacking an ear off of the binary.

Craig@Invincea
Sandboxie Support
Sandboxie Support
Posts: 3523
Joined: Thu Jun 18, 2015 3:00 pm
Location: DC Metro Area
Contact:

Re: Medical Imaging Disc Error

Post by Craig@Invincea » Fri Mar 11, 2016 11:29 am

I'm wondering if there is a "need" to SB this drive?

If it's reading imaging software, which I'm going to assume is in house created? I would think not SB'ingthis instance would be best? I can understand if the drive is to be on a machine that could be shared, and unknown programs that could be run from a CD/DVD...but this seems like known data from a known source?

This has been a topic of conversation.

BUCKAROO
Posts: 206
Joined: Sun Oct 24, 2010 3:13 am

Re: Medical Imaging Disc Error

Post by BUCKAROO » Fri Mar 11, 2016 9:42 pm

Med discs / archived images and respective re-viewer programs could arrive from referred specialists / doctors / patients themselves / social engineers with the perfect bait to unleash a Trojan, for the software has internal network access...

Best search out alternative DICOM software and/or script-your-own launcher entwined with a borrowed / working and up-to-date DICOM program from one of the successful img discs or reputable software vendor, one-suits-all app that will Sandbox.

TriStarGod
Posts: 26
Joined: Thu Oct 09, 2014 11:43 am

Re: Medical Imaging Disc Error

Post by TriStarGod » Fri Mar 11, 2016 10:32 pm

From the .NET error, it looks like an permission issue. I don't have a CD/DVD drive but check if you can give Sandboxie readonly access to the entire CD/DVD drive (including an empty one) and then running the Disc.

BUCKAROO
Posts: 206
Joined: Sun Oct 24, 2010 3:13 am

Re: Medical Imaging Disc Error

Post by BUCKAROO » Sat Mar 12, 2016 3:28 am

A feature of the language was explicitly denied by Sandboxie because a service for it has not been implemented. But he tried that drive "exception", leads to a second error ahead of the first error (still to follow this one) which isn't a file access issue but we brought about this one (additional) such problem.

Here's an example [Sandbox] configured in such a way that it will substitute any AutoRun program with any alternative task you give it to perform.
[DICOM]

Enabled=y
ConfigLevel=7
Template=BlockPorts
Template=LingerPrograms
Template=AutoRecoverIgnore
BorderColor=#00FFFF,ttl
BoxNameTitle=y

NotifyInternetAccessDenied=y
ClosedFilePath=InternetAccessDevices

Comment=Force sandbox autorun programs and files from removable media drives:
#ForceFolder=B:\
ForceFolder=D:\
ForceFolder=E:\

Comment=Suppose we have chosen XnView as our preferred viewer
LeaderProcess=xnview.exe
LeaderProcess=XnView-win-full.exe
LeaderProcess=XnView-win.exe
LeaderProcess=XnView-win-small.exe

Comment=Always AutoExec LeaderProcess if it is not running & Cancel autorun/force/initiating process unless manually sandboxed & Auto launch our own leader process instead of autorun. [Note: Unfortunately our ini variables aren't expanded by AutoExec]

AutoExec="%ComSpec%" /C"REG DELETE "HKCU\SOFTWARE\SandboxAutoExec" /va /f&TASKKILL /FI "IMAGENAME ne Sbie*" /FI "IMAGENAME ne Start.exe" /FI "IMAGENAME ne Sandboxie*" /FI "STATUS eq UNKNOWN" /F&START "" "%ProgramFiles(x86)%\XnView\xnview.exe" -full "E:\DICOM\*""

Comment=XnView defaults are Space for Next file, Backspace for Previous file, F11 to return to XnView Browser providing that images in the path, specified on its command line, exist. Mess with XnView's options and add/remove its arguments above until satisfied.

TriStarGod
Posts: 26
Joined: Thu Oct 09, 2014 11:43 am

Re: Medical Imaging Disc Error

Post by TriStarGod » Sat Mar 12, 2016 8:41 am

Aah, sorry. I overlooked that sentence. From my experience, med disks are usually self contained discs with a viewer and the DICOM images. In our office, I have a separate non-networked computer floating around specifically for viewing these images. Due to the variations among med disks, it may be difficult to get Providers to reliably access the images without the technical know-how. Was the issue resolved?

Craig@Invincea
Sandboxie Support
Sandboxie Support
Posts: 3523
Joined: Thu Jun 18, 2015 3:00 pm
Location: DC Metro Area
Contact:

Re: Medical Imaging Disc Error

Post by Craig@Invincea » Sat Mar 12, 2016 8:22 pm

TriStarGod wrote:Aah, sorry. I overlooked that sentence. From my experience, med disks are usually self contained discs with a viewer and the DICOM images. In our office, I have a separate non-networked computer floating around specifically for viewing these images. Due to the variations among med disks, it may be difficult to get Providers to reliably access the images without the technical know-how. Was the issue resolved?
It hasn't been resolved. We've looked at PML's, etc now for a few months. The Devs are suggesting just to unsanbox the drive, let it do what it needs to do..and the sandbox the drive again. It's not a use case anyone here has seen before unfortunately .

sgrechtman
Posts: 4
Joined: Wed Feb 17, 2016 10:42 am

Re: Medical Imaging Disc Error

Post by sgrechtman » Tue Mar 15, 2016 11:42 am

Thanks for the info you guys!

Some backstory for you......
These are shared devices that have access to our internal network and some external internet access as well. This is how the clients wanted these devices setup (they wanted them to be used for other things besides a dedicated viewing station), and they wanted to be able to view these image discs with as much security as possible. We suggested that they have separate offline viewing devices, but they didn't want this.....We will probably end up telling them to open the discs normally if they have issues being sandboxed. They use many different DICOM vendor discs.

Curt@invincea
Sandboxie Lead Developer
Sandboxie Lead Developer
Posts: 1638
Joined: Fri Jan 17, 2014 5:21 pm
Contact:

Re: Medical Imaging Disc Error

Post by Curt@invincea » Tue Mar 15, 2016 8:41 pm

Have you tried running the resource access monitor?

sgrechtman
Posts: 4
Joined: Wed Feb 17, 2016 10:42 am

Re: Medical Imaging Disc Error

Post by sgrechtman » Wed Mar 23, 2016 12:03 pm

Curt@invincea wrote:Have you tried running the resource access monitor?
Yes I did run this, and received a log file, but I was unable to determine anything from it.

Here is the link for the log file: https://app.box.com/s/sa79mraynp5287xhxfkqtzggkrqz92c1

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest