[1.4.2] [W11 22H2] Most programs can't be opened in the hardened sandboxes

[isaak654]

Originally reported in #2287 (reply in thread)

Thanks to the reply above, I was able to reproduce an error with Windows 11 22H2 x64 (22621.674) inside the hardened sandboxes: it seems it is related to a hook named PowerSettingRegisterNotification that can't be run:

Standard sandboxes + W11 22H2 = unaffected
Hardened sandboxes with data protection + W11 22H2 = affected
Security Hardened sandboxes + W11 22H2 = affected

[okrc]

Correction, it seems that most software cannot be opened.

[isaak654]

Workaround:

Also, I see a connection with #2278

PowerSettingRegisterNotification lines in the source code:
https://github.com/sandboxie-plus/Sandboxie/search?q=PowerSettingRegisterNotification

[DavidXanatos]

on my win 11 test VM insider dev channel orange boxes work just fine, strange...
how can i reproduce this issue?

[isaak654]

I'm on the stable branch of Windows 11 22H2 x64 - fresh Windows installation without third-party apps or tweaks involved.
Opening MS Edge or Windows Explorer as sandboxed is enough to reproduce it.

[isaak654]

As far as I know, there is a security feature that can only be used on new Windows 11 installations: Smart App Control

In the system in question, it is currently set to evaluation mode:

[DavidXanatos]

So when you disable this smart app controll sandboxie works fine?

[isaak654]

I'm not encouraged to disable it, because that would be a permanent change that could only be reversed with a new Windows 11 reinstallation... Microsoft is actually discouraging it with such bold claims.

[DavidXanatos]

Fix for the general sandboxie operation:
NormalFilePath=\Device\SrpDevice

[DavidXanatos]

I'm not encouraged to disable it, because that would be a permanent change that could only be reversed with a new Windows 11 reinstallation... Microsoft is actually discouraging it with such bold claims.

For testing I have created a clean fresh Win 11 VM and set this Smart App Control to activated.
The result:

1. You can not install sandboxie, or as far as I see it install anything that uses Inno Setup, as it creates a unsigned binary in the temp folder and SAC does not allow that to run.
2. You can just paste an unpacked signed sandboxie installation and it will work with SAC not just in evaluation but activated
3. When SAC fully is activated sandboxed edge crashes complaining that it can not load SbieDll.dll that will need to be fixed if possible, but given that other processes start its probably som parameter when creating edges worker processes which we can kill being injected in the main process