BSA+Sandboxie Portable

[gjf]

The constantly updated portable Buster Sandbox Analyzer + Sandboxie system is located at http://tools.safezone.cc/gjf/Sandboxie-portable.zip
All manuals are within the archive.
If you have some problems and/or suggestions - please PM me.

[Buster]

I noticed bsa.conf contains next lines:

Code: Select all

[BSA]

InjectDll=C:\Program Files\Sandboxie\Buster Sandbox Analyzer\sbiextra.dll
InjectDll=C:\Program Files\Sandboxie\Buster Sandbox Analyzer\antidel.dll
InjectDll=C:\Program Files\Sandboxie\Buster Sandbox Analyzer\LAPI.dll
OpenWinClass=TFormBSA
ConfigLevel=6
Enabled=y
NotifyInternetAccessDenied=y
BoxNameTitle=n
BorderColor=#0000FF

OpenFilePath=C:\Sandbox\TEST!!!\

"NotifyDirectDiskAccess=y" is missing. Without that parameter, BSA will be unable to notice direct disk writing behaviour.

Other two important parameters are:

ProcessLimit1=20
ProcessLimit2=30

That is used to avoid certain type of malware that floods the system making it unstable. Normally none (malicious or not) application will be running over 30 processes at the same time.

More things...

You include "DLLLDR.EXE". That file is obsolete and can be removed because it is not used anymore.

The same happens with "HideDriver.sys" and "HideDriverGUI.exe". They were replaced by BSA.SYS. Anyway someone could use HideDriver instead BSA´s own driver, so I could understand why it is kept in the package.

"regdump.exe" is dropped everytime BSA needs it, so it is unnecesary to have it in the package.

The same for "sigcheck.exe" and "ssdeep.exe".

[gjf]

Thanks, Buster, but I believe you mean Sandboxie.ini file, not BSA.conf.

All your suggestions will be used.

[otreus]

don't work for me (win8 64bit) and in the archive I haven't find the Faq for using it. Thanks

[Buster]

don't work for me (win8 64bit) and in the archive I haven't find the Faq for using it. Thanks

Download Buster Sandbox Analyzer and learn to configure it by yourself.

[gjf]

otreus, x64 is not supported yet by this portable system. You should install Sandboxie and BSA and configure them by yourself.

[brdlstone007]

Don't work for me (win8 64bit) and in the document I haven't find the Faq for utilizing it. Much appreciated

[Gioanvm]

The constantly updated portable Buster Sandbox Analyzer + Sandboxie system is located at http://tools.safezone.cc/gjf/Sandboxie-portable.zip
All manuals are within the archive.
If you have some problems and/or suggestions - please PM me.

Could you please provide the password for the zip file? Or upload an unprotected zip file?

[Barb@Invincea]

Hello Gioanvm,

Hopefully the user will see the message and give you the password, however I tried unzipping the file using a blank password (just hit enter) and it seemed to work.

Regards,
Barb.-

[Gioanvm]

Hi Barb.

Will give that a try. Thanks

[Gioanvm]

Hi Barb,

I tried extracting it with WinRAR and IZArc but no luck.

[Barb@Invincea]

Hello Gioanvm,

You'll have to wait for the user to provide the password.
I can decompress it with 7zip without entering the password, but the files are empty. I was hoping to find the password somewhere in there, but no luck.

You should also be able to find the tools (separate files) here:
https://www.sandboxie.com/index.php?Con ... dUtilities

Regards,
Barb.-

[gjf]

The link without password: hxxp://www5.zippyshare.com/v/6wcBDcHb/file.html
However the development is stopped. I am not interested any more in this project as long as BSA is not supported in Sandboxie.

[Gioanvm]

Thanks gjf