Are there ideas to make Sandboxie more resistant?

[bastik-1001]

Do you have an idea on how to improve the stability of Sandboxie or how to make it more resistant?

Each release of Sandboxie makes it better, by fixing long-standing bugs, by adding new features, by improving performance, by improving the usability, by improving compatibility and other advancements. There are still issues, but they can be fixed or resolved.

Are there ideas on how to make Sandboxie more stable, how to reduce the risk of BSODs, crashes or errors in the codebase? Any defense-in-depth on the code and the driver and its resistance?

[DavidXanatos]

Well for the driver I'm running my test VM's with driver verifier enabled, this should catch most BSOD bugs before they get rolled out.

About compatibility, the way sandboxie operates in non compartment style boxes is prone to incompatibilities as it is very intrusive and limiting in what an application can actually do.
The old approach here was to add specific workarounds wherever required, which meant that more fringe apps that run into the same issue would still experience it. My approach is to get rid of all application specific workarounds in favorer of more generic once, like for example 'UseSbieDeskHack' 'UseSbieWndStation' mechanisms which perviously were only used for chrome, and derivatives, only.

As about errors in the codebase, most of sandboxie is very old school plain C code, if one would really want to improve on that we would need to re write sbiedll.dll to use modern C++ but that would take very long time and the benefits would be limited, the code works mostly fine, most issue we had were not related to bugs in the code but the apps using more and more modern windows features which simply are not yet supported.

[isaak654]

1. Hopefully most of the open issues in this repo will be fixed or closed someday, otherwise the risk is to discourage the reporting of new GitHub issues.

2. Secondarily, I think the feature request Adding a troubleshooting wizard in Sandboxie #1875 should be part of the Sandboxie roadmap, possibly with a data collection module. A data collection module would help to know things like the number of processes that used certain system calls, if the processes ever hit a particular code block in SbieDll or what third-party DLLs are loaded into sandboxed processes which may cause issues.

[bastik-1001]

BTW, I know that you had ideas, since you are working on it. The discussion, was more to collect ideas, the community might have. The reply is still awesome, thank you.