Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 701196">When Sandboxie &quot;sandboxes&quot; a process, the process is still on the Host environment. Sandboxie doesn&#039;t use virtualisation via the hyper-visor which uses processor-embedded technology such as Intel VT-x or AMD SVM. Therefore, the activities made by a program isolated by Sandboxie still passes through the Host environment&#039;s Windows Kernel. Due to this, when a program is isolated by Sandboxie, the Host environment receives the process creation notifications as it still passes through the Windows Kernel of the Host environment. The callbacks are dished out in an order where one callback routine registered by driver X will receive it at a time as far as I am aware, and thus NoVirusThanks OSArmor still becomes aware of when a program is started up regardless of whether it&#039;s going into the Sandboxie container or not.Sandboxie pretty much start up a process under a different user account, inject a DLL into it which hooks a huge amount of APIs (user-mode run-time byte patching to be precise) and relies on kernel-mode callbacks to redirect activities from kernel-mode and not only from user-mode, which makes it a bit more secure than if it relied entirely on user-mode patching for interception and redirection.</blockquote>

[QUOTE="Deleted member 65228, post: 701196"] When Sandboxie "sandboxes" a process, the process is still on the Host environment. Sandboxie doesn't use virtualisation via the hyper-visor which uses processor-embedded technology such as Intel VT-x or AMD SVM. Therefore, the activities made by a program isolated by Sandboxie still passes through the Host environment's Windows Kernel. Due to this, when a program is isolated by Sandboxie, the Host environment receives the process creation notifications as it still passes through the Windows Kernel of the Host environment. The callbacks are dished out in an order where one callback routine registered by driver X will receive it at a time as far as I am aware, and thus NoVirusThanks OSArmor still becomes aware of when a program is started up regardless of whether it's going into the Sandboxie container or not. Sandboxie pretty much start up a process under a different user account, inject a DLL into it which hooks a huge amount of APIs (user-mode run-time byte patching to be precise) and relies on kernel-mode callbacks to redirect activities from kernel-mode and not only from user-mode, which makes it a bit more secure than if it relied entirely on user-mode patching for interception and redirection. [/QUOTE]

Verification