NtQueryInformationProcess hook

[Buster]

Sandboxie hooks NtQueryObject in order to return a faked path instead the real one to sandboxed applications.

I would like to request you hook also NtQueryInformationProcess (ProcessImageFileName) in the same terms as NtQueryObject, so faked path is returned too for that function.

http://msdn.microsoft.com/en-us/library ... 85%29.aspx

ProcessImageFileName
27

Retrieves a UNICODE_STRING value containing the name of the image file for the process.

[Curt@invincea]

tzuk has some comments in the code that look like he started working on this. It sounds like a good idea, but there may be some issues that caused him to postpone it. Please give us some time to investigate.

[Buster]

Nice, thanks!

[Buster]

Will be possible to introduce the requested hook?

[Buster]

Sandboxie 4.13.1 will include this feature?

[Curt@invincea]

Sandboxie 4.13.1 will include this feature?

That will probably be in 4.13.2.

[Buster]

Sandboxie 4.13.1 will include this feature?

That will probably be in 4.13.2.

Has been included?

[Curt@invincea]

I am working on this right now. It will be in 4.13.3.

[Buster]

Nice, thanks!