Sandboxie Documentation

Technical Documentation: sandboxie-plus/Sandboxie

ℹ️ Provenance: Multi-Tier Ingestion · CodeWiki Reference

Overview (`README.md`) Copy Section

Sandboxie Plus / Classic

Sandboxie is a sandbox-based isolation software for Windows NT-based operating systems that creates a secure operating environment in which applications can be run or installed without permanently modifying local & mapped drives or the Windows registry. An isolated virtual environment allows controlled testing of untrusted programs and web surfing.

Sandboxie allows you to create virtually unlimited sandboxes and run them alone or simultaneously to isolate programs from the host and each other, while also allowing you to run as many programs simultaneously in a single box as you wish.

Note: This is a community fork that took place after the release of the Sandboxie source code and not the official continuation of the previous development (see the project history and #2926).

⏬ Download Copy Chapter

Latest Release

✨ Changelog Copy Chapter

EN

🚀 Features Copy Chapter

Sandboxie is available in two editions, Plus and Classic. They both share the same core components, this means they have the same level of security and compatibility.
What's different is the availability of features in the user interface.

Sandboxie Plus has a modern Qt-based UI, which supports all new features that have been added since the project went open source:

• Snapshot Manager - takes a copy of any box in order to be restored when needed
• Maintenance menu - allows to uninstall/install/start/stop Sandboxie driver and service when needed
• Portable mode - you can run the installer and choose to extract all files to a directory
• Additional UI options to block access to Windows components like printer spooler and clipboard
• More customization options for Start/Run and Internet access restrictions
• Privacy mode sandboxes that protect user data from illegitimate access
• Security enhanced sandboxes that restrict the availability of syscalls and endpoints
• Global hotkeys to suspend or terminate all boxed processes
• A network firewall per sandbox which supports Windows Filtering Platform (WFP)
• The list of sandboxes can be searched with the shortcut key Ctrl+F
• A search function for Global Settings and Sandbox Options
• Ability to import/export sandboxes to and from 7z files
• Integration of sandboxes into the Windows Start menu
• A browser compatibility wizard to create templates for unsupported browsers
• Vintage View mode to reproduce the graphical appearance of Sandboxie Control
• A troubleshooting wizard to assist users with their problems
• An Add-on manager to extend or add functionality via additional components
• Protections of sandboxes against the host, including the prevention of taking screenshots
• A trigger system to perform actions, when a sandbox goes through different stages, like initialization, box start, termination or file recovery
• Make a process not sandboxed, but its child processes sandboxed
• Force programs to automatically use a user-provided SOCKS5 proxy
• DNS control by blocking or redirecting
• Limit the amount of memory space a single process in the sandbox can occupy and the total amount of memory space all processes can occupy, and You can limit the total number of sandboxed processes per box
• A completely different token creation mechanism from Sandboxie's pre-open-source version makes sandboxes more independent in the system
• Encrypted Sandbox - an AES-based reliable data storage solution
• Prevent sandboxed programs from generating unnecessary unique identifier in the normal way
• An internal INI editor that aids the user with visual hints and tooltips on the settings they have configured or want to add
• The ability to configure an external text editor, beside the system default
• Control over the alpha transparency of the border
• A custom UAC-dialog, allowing to fake permission, grant them or cancel the elevation attempt
• Modern icons, while you can use the old-school ones in certain places
• You can change the font of the user interface
• Custom colors or icons can be used for sandboxes or groups

More features can be spotted by finding the sign = through the shortcut key Ctrl+F in the CHANGELOG.md file.

Sandboxie Classic has the old no longer developed MFC-based UI, hence it lacks native interface support for Plus features. Although some of the missing features can be configured manually in the Sandboxie.ini configuration file or even replaced with custom scripts, the Classic edition is not recommended for users who want to explore the latest security options.

📚 Documentation Copy Chapter

A GitHub copy of the Sandboxie documentation is currently maintained, although more volunteers are needed to keep it updated with the new changes. It is recommended to also check the following labels to track current issues: Labels · sandboxie-plus/Sandboxie.

A partial archive of the old Sandboxie forum that was previously maintained by Invincea is still available. If you need to find something specific, it is possible to use the following search query: site:https://sandboxie-website-archive.github.io/www.sandboxie.com/old-forums/.

🚀 Useful tools for Sandboxie Copy Chapter

Sandboxie's functionality can be enhanced with specialized tools like the following:

• LogApiDll - adds a verbose output to Sandboxie's trace log, listing invocations of relevant Windows API functions
• SbieHide - attempts to hide the presence of SbieDll.dll from the application being sandboxed
• SandboxToys2 - allows to monitor files and registry changes in a sandbox
• Sbiextra - adds additional user mode restrictions to sandboxed processes
• WrapLocale - provide more flexible locale pretending options than native LangId feature

📌 Project history Copy Chapter

Looking for older Sandboxie versions? Check the version history.

See the current roadmap.

📌 Project support / sponsorship Copy Chapter

Thank you Vector 35 for providing a Binary Ninja license to help with reverse engineering.

Binary Ninja is a multi-platform interactive disassembler, decompiler, and binary analysis tool for reverse engineers, malware analysts, vulnerability researchers, and software developers.

Thank you Icons8 for providing icons for the project.

🤝 Support the project Copy Chapter

If you find Sandboxie useful, then feel free to contribute through our Contribution guidelines.

📑 Helpful Contributors Copy Chapter

• DavidBerdik - Maintainer of Sandboxie Website Archive
• Jackenmen - Maintainer of Chocolatey packages for Sandboxie (support)
• vedantmgoyal9 - Maintainer of Winget Releaser for Sandboxie (support)
• blap - Maintainer of SandboxToys2 addon
• diversenok - Security analysis & PoCs / Security fixes
• TechLord - Team-IRA / Reversing
• hg421 - Security analysis & PoCs / Code reviews
• hx1997 - Security analysis & PoC
• mpheath - Author of Plus installer / Code fixes / Collaborator
• offhub - Documentation additions / Code fixes / Qt5 patch and build script / Collaborator
• LumitoLuma - Qt5 patch and build script
• QZLin - Author of sandboxie-docs theme
• isaak654 - Templates / Documentation / Code fixes / Collaborator
• typpos - UI additions / Documentation / Code fixes
• Yeyixiao - Feature additions
• Deezzir - Feature additions
• wzxjohn - Code fixes, Documentation additions
• okrc - Code fixes
• Sapour - Code fixes
• lmou523 - Code fixes
• sredna - Code fixes for Classic installer
• weihongx9315 - Code fix
• marti4d - Code fix
• jorgectf - CodeQL workflow
• stephtr - CI / Certification
• yfdyh000 - Localization support for Plus installer
• Dyras - Templates additions
• cricri-pingouin - UI fixes
• Valinwolf - UI / Icons
• daveout - UI / Icons
• kokofixcomputers - Support member of the Discord channel
• NewKidOnTheBlock - Changelog fixes
• Naeemh1 - Documentation additions
• APMichael - Templates additions
• 1mm0rt41PC - Documentation additions
• Luro223 - Documentation additions
• lwcorp - Documentation additions
• wilders-soccerfan - Documentation additions
• LepordCat - Documentation additions
• stdedos - Documentation additions
• habatake - UI additions, Code fixes
• Polyester6719 - Documentation additions
• oddwatcher - Documentation additions & improvements
• mihomoQ - Code fixes & documentation improvements
• marcelodotnet - Documentation additions & improvements

🌏 Translators Copy Chapter

• czoins - Arabic
• yuhao2348732, 0x391F, nkh0472, yfdyh000, gexgd0419, Zerorigin, UnnamedOrange, DevSplash, Becods, okrc, 4rt3mi5, sepcnt, fzxx, Vstory, GT-Stardust, habatake, mihomoQ - Simplified Chinese
• TragicLifeHu, Hulen, xiongsp, habatake, mihomoQ - Traditional Chinese
• RockyTDR - Dutch
• imalyzer - Farsi
• clexanis, Mmoi-Fr, hippalectryon-0, Monsieur Pissou - French (provided by email)
• bastik-1001, APMichael - German
• timinoun - Hungarian (provided by email)
• isaak654, DerivativeOfLog7 - Italian
• takahiro-itou, lllIIIlll - Japanese
• VenusGirl, 꿈을꾸는 파랑새(Sakai) - Korean
• divinity76 - Norwegian Bokmål
• 7zip, AndrzejRafalowski - Polish (provided separately)
• JNylson - Portuguese and Brazilian Portuguese
• lufog, marat2509 - Russian
• LumitoLuma, sebadamus - Spanish
• 1FF, Thatagata - Swedish (provided by email or pull request)
• xorcan, fmbxnary, offhub - Turkish
• SuperMaxusa, lufog, Nazar1ky - Ukrainian
• GunGunGun - Vietnamese

Before submitting a translation, read the translation collaboration and attribution guidelines and the Localization notes and tips.

📚 Documentation Translators Copy Chapter

• Vstory, GT-Stardust, wzxjohn, SOLEADO20, habatake, YuHuanTin, darkskygit, oddwatcher - Simplified Chinese

All documentation translators are encouraged to look at the Multilingual Translation Contribution Guide before sending a translation.

Overview (`Installer/ReadMe.md`) Copy Section

Sandboxie Plus installer instructions Copy Chapter

To create Sbie Plus installer environment Copy Section

1. Install Inno Setup 6.3.3 (installer is located at https://jrsoftware.org/isdl.php)

Note: this section requires additional steps to be completed, please open a new pull request.

To create the Sbie Plus installers Copy Section

The Sbie Plus installer ISS file is Sandboxie-Plus.iss.

Note: this section requires steps to be completed, please open a new pull request.

Overview (`Sandboxie/ReadMe.md`) Copy Section

Sandboxie Classic build instructions Copy Chapter

• Please note: there is another ReadMe.md file in the install folder that explains how to create the Sandboxie Classic installers.
• Please note: the following instructions may lag behind the CI workflow, so be aware of any version change.

Sandboxie Classic builds under Visual Studio 2022.

1. Download Visual Studio 2022
2. In the Visual Studio Installer, select Desktop development with C++ and a current Windows SDK
3. Install the MSVC v143 and MFC components for each platform you want to build
4. Install a matching Windows Driver Kit (WDK)
5. The WDK installer should also install its Visual Studio extension; rerun the WDK installer if the driver project is unavailable in Visual Studio
6. The Sandbox.sln solution is in the Sandboxie directory
7. Keep the toolsets selected by the project files; do not retarget every project or add WDK include paths manually
8. To compile an x64 release, first build the required Win32 service and DLL components, then the x64 solution and driver:

msbuild /t:build Sandboxie\SandboxDll.sln /p:Configuration="SbieRelease" /p:Platform=Win32 -maxcpucount:8
msbuild /t:build Sandboxie\Sandbox.sln /p:Configuration="SbieRelease" /p:Platform=x64 -maxcpucount:8
msbuild /t:build Sandboxie\SandboxDrv.sln /p:Configuration="SbieRelease" /p:Platform=x64 -maxcpucount:8

These commands can be run from a Visual Studio 2022 Developer Command Prompt in the repository root. For ARM64 and ARM64EC, see the current commands in the CI workflow.

Source projects (in alphabetical order) Copy Section

Note: the core of Sandboxie are the driver, SbieDrv, the service, SbieSvc, and the injection DLL, SbieDll. Study these projects first.

Common (\apps\common). It builds common.lib, which contains some common GUI objects, and it is used by the Control and Start projects.

KmdUtil (\install\kmdutil). It builds KmdUtil.exe, which is used during the installation process, e.g. to start/stop the Sbie driver (SbieDrv.sys).

LowLevel (\core\low). It creates LowLevel.dll, which is used in code injection. LowLevel.dll is embedded into SbieSvc.exe as a resource (see core\svc\lowlevel.rc for more information).

Parse (\msgs). It creates the Sbie messages files.

SandboxBITS (apps\com\BITS). It creates SandboxieBITS.exe (Background Intelligent Transfer Service).

SandboxCrypto (apps\com\Crypto). It creates SandboxieCrypto.exe.

SandboxieInstall (\install\release). It creates the combined x64/x86 installer SandboxieInstall.exe by combining the x64 & x86 installer binaries into a RC file.

Note: SandboxieInstall is not built during the normal SLN build. It must be built manually after the x64 & x86 installers are completed.

SandboxRpcSs (\apps\com\RpcSs). It creates SandboxieRpcSs.exe, the Sbie's wrapper for the Remote Procedure Call Sub-System.

SandboxWUAU (\apps\com\WUAU). It creates SandboxieWUAU.exe, the Sbie's wrapper for the Windows Automatic Update Service (WUAUSERV).

SbieControl (\apps\control). It builds SbieCtrl.exe, the Sandboxie Control app that displays real-time sandboxed application activity.

SbieIni (\apps\ini). It creates SbieIni.exe, a utility for querying and updating the sandboxie.ini configuration file.

SboxDcomLaunch (\apps\com\DcomLaunch). It creates SandboxieDcomLaunch.exe.

SboxDll (\core\dll). It creates the Sbie injection DLL, which injects into every process running in the sandbox.

SboxDrv (\core\drv). It creates the Sbie kernel-mode driver.

SboxHostDll (\SboxHostDll). It builds the Sbie host injection DLL, which is injected into host processes that must be redirected into the sandbox.
Currently, the only app this is used for is MS Office. SboxHostDll.dll is injected into OfficeClickToRun.exe.

SboxMsg (\msgs). It creates SboxMsg.dll, which contains the Sbie user messages in various languages.

SboxSvc (\core\svc). It creates the Sbie service.

Start (\apps\start). It creates start.exe, which is used to start processes in the sandbox.

Overview (`SandboxiePlus/ReadMe.md`) Copy Section

Sandboxie Plus build instructions Copy Chapter

• Please note: there is another ReadMe.md file that explains how to create the Sandboxie Plus installers.
• Please note: the following instructions may lag behind the CI workflow, so be aware of any version change.

Sandboxie Plus builds under Visual Studio 2022 and uses the Sandboxie Classic components.

1. Install Visual Studio 2022 with the Windows SDK and WDK required by the Classic build instructions
2. Install the MSVC v142 build tools and Windows 10 SDK 10.0.19041.0 required by SbieShell
3. Install 7-Zip in C:\Program Files\7-Zip
4. Build Sandboxie Classic using the commands in the Classic build instructions
5. The Qt version is defined in Installer\buildVariables.cmd; install_qt.cmd downloads the matching Qt 6 build
   • The scripts use the Visual Studio 2022 Enterprise vcvars*.bat path used by CI; if you use Community or Professional, update that path in qmake_plus.cmd and copy_build.cmd
6. From a Visual Studio 2022 Developer Command Prompt in the repository root, run:

SandboxiePlus\install_qt.cmd x64
SandboxiePlus\install_jom.cmd
SandboxiePlus\qmake_plus.cmd x64 build_qt6
msbuild /t:restore,build -p:RestorePackagesConfig=true SandboxiePlus\SbieShell\SbieShell.sln /p:Configuration="Release" /p:Platform=x64
msbuild /t:build SandboxieTools\SandboxieTools.sln /p:Configuration="Release" /p:Platform=x64 -maxcpucount:8
Installer\fix_qt5_languages.cmd x64 build_qt6
Installer\get_openssl.cmd
Installer\get_7zip.cmd
Installer\copy_build.cmd x64 build_qt6

7. The assembled x64 build is placed in Installer\SbiePlus_x64
8. For ARM64, see the current commands in the CI workflow

At this point, you may wonder how to run this build. In the end, the driver is not signed and we did not touch the process of signing the user mode components either.

As signing the driver is probably not feasible for most developers due to the lack of an EV code signing certificate, we will set up our Windows to run in test mode by entering "bcdedit /set testsigning on" in an elevated command prompt and rebooting. Once rebooted, we can start the SandMan UI and use the Maintenance menu to install all components, start and connect them with only one click.

You may notice that we did not get the obligatory "access denied" error we would expect by connecting an unsigned user mode component to the driver. This is because when the driver sees Windows being run in test mode, it also disables the custom signature verification mechanism, meaning you don't need to create any *.sig files for your own Sandboxie Plus test build.

With everything running, you can now go to the Global Settings and enter your supporter certificate to unlock all the exclusive Plus features.

Source projects Copy Section

Note: the core of Sandboxie are the driver, SbieDrv, the service, SbieSvc, and the injection DLL, SbieDll:
Sandboxie\ReadMe.md#source-projects-in-alphabetical-order

Sandboxie Plus is made up of the following components:

MiscHelpers (\MiscHelpers)

QSbieAPI (\QSbieAPI)

QtSingleApp (\QtSingleApp)

SandMan (\SandMan)

SbieShell (\SbieShell)

UGlobalHotkey (\UGlobalHotkey)

Overview (`Sandboxie/install/ReadMe.md`) Copy Section

Sandboxie Classic installer instructions Copy Chapter

To create Sbie NSIS installer environment Copy Section

1. Install NSIS 2.5 (installer is located at https://sourceforge.net/projects/nsis/files/NSIS%202/2.50/)
   Later versions will not work with the Sbie NSI file.

2. You will also need NSIS InetC plugin https://nsis.sourceforge.io/Inetc_plug-in

3. From Inetc.zip, copy \Plugins\x86-ansi\InetC.dll to your NSIS plugins folder (e.g. C:\Program Files (x86)\NSIS\Plugins)

4. Overwrite C:\Program Files (x86)\NSIS\Contrib\Modern UI\System.nsh with install\nsis_updates.zip\nsis\Contrib\Modern UI\System.nsh

5. Copy language files from install\nsis_updates.zip\nsis\Contrib\Modern UI\Language files to C:\Program Files (x86)\NSIS\Contrib\Modern UI\Language files

6. The install also requires Iconv 1.9.2.1747 (for international language conversion) which can be downloaded from https://gnuwin32.sourceforge.net/packages/libiconv.htm

   You need 2 zip files, the Binaries and the Dependencies. These contain the 3 binaries that are required:
   Iconv.exe
Libiconv2.dll
Libintl3.dll

   Copy these 3 binaries into a folder under the Sandboxie source tree named tools\iconv at the same level as Sandbox.sln (e.g. C:\src\Sbie\tools\iconv)

Everything above only needs to be done once. Then your machine should be good to go.

To create the Sbie Classic installers Copy Section

The Sbie installer NSI file is \install\SandboxieVS.nsi.

Note: this section contains obsolete information, as it is only valid for the old code signing not mediated by Microsoft.
Please refer to issue #1248 and open a new pull request to update the following steps:

1. Sign the binaries (if applicable).
2. Set the #defines in \common\my_version.h (SBIE_INSTALLER_PATH, etc.) to the location of your binaries. (These #defines are read by SandboxieVS.nsi).
3. Edit \install\SandboxieVS.nsi and uncomment the !define _BUILDARCH for the version you want to create an installer for.
4. In Explorer, right-click on \install\SandboxieVS.nsi, and select Compile NSIS Script.
   The resulting installer binary (SandboxieInstall64.exe or SandboxieInstall32.exe) will be saved to SBIE_INSTALLER_PATH (from my_version.h).
5. Sign the installers.
6. To create the combined 32/64 bit installer in Visual Studio, right-click on the SandboxieInstall project, click Project Only -> Build Only SandboxieInstall.
   This will create a SandboxieInstall.exe in the install folder.
7. Sign the combined installer.

Overview (`SandboxiePlus/UGlobalHotkey/README.md`) Copy Section

UGlobalHotkey Copy Chapter

Description Copy Section

UGlobalHotkey is an extension for Qt framework, which implements global hotkeys functionality for Windows Linux and MacOSX platforms.
It is written by bakwc, extracted from Pastexen and turned into a shared library by me.

Building from source Copy Section

• You can either open project with QtCreator and press Build button
• Or build it using terminal:

qmake  
make

Usage example Copy Section

UGlobalHotkeys *hotkeyManager = new UGlobalHotkeys(); 
hotkeyManager->RegisterHotkey("Ctrl+Shift+F12");
connect(hotkeyManager, &UGlobalHotkeys::Activated, [=](size_t id)
{
    qDebug() << "Activated: " << QString::number(id);
});

License Copy Section

UGlobalHotkey library is licensed as Public Domain, so you are free to do anything with it.

--- METRICS ---

• Files Extracted: 6
• Estimated Token Budget: ~6298 tokens
• Canonical Reference: https://codewiki.google/github.com/sandboxie-plus/Sandboxie