technical matters: Why did sandboxie replace openwith

[lmou523]

sandboxie changes the way a file is opened by double-clicking it. Instead of starting openwith.exe, it starts start.exe.
I looked up the code and said openwith needed a uwp environment (but that wasn't the root cause).
While debugging, I found that openwith threw an exception when calling the com interface (createwindowinband function failed).
But I did not find the root cause of the failure of createwindowinband (configuration requires openwinclass=Open With).

[lmou523]

I reverse the openwith program, which internally calls createwindowsinband

The key reason it fails is because the last parameter is ZBID_IMMERSIVE_NOTIFICATION (4).getlasterror = 5
If I change this argument to ZBID_DEFAULT(0),The openwith window will open（That's not a good idea）
Eventually NtUserCreateWindowEx will be called and then syscall (I don't know if the sbie driver is blocking some operation causing the problem)

[lmou523]

You are advised to add the following parameters to the sandbox configuration：

UnfilteredToken=y
OriginalToken=y
UnrestrictedToken=y
NoSecurityIsolation=y
OpenCredentials=y
RunServicesAsSystem=y

OpenFilePath=*
OpenKeyPath=*
OpenWinClass=Open With

[isaak654]

technical matters: Why did sandboxie replace openwith
sandboxie changes the way a file is opened by double-clicking it. Instead of starting openwith.exe, it starts start.exe.

Maybe it happened because of issue #1138, feel free to check it out.

[lmou523]

emmmm According to my research, this conclusion is probably wrong
The cause of the error is not rpc, but CreateWindowInBand error， It doesn't seem like a modern app

[DavidXanatos]

interesting find, were you testing on windows 10 or 11?

[lmou523]

Windows 11
The sandbox requires these configurations

UnfilteredToken=y
OriginalToken=y
UnrestrictedToken=y
NoSecurityIsolation=y
OpenCredentials=y
RunServicesAsSystem=y

OpenFilePath=*
OpenKeyPath=*
then:
1.change {C2F03A33-21F5-47FA-B4BB-156362A2F239} from closepath to openpath
2.Added OpenWinClass=OpenWith.exe,Open With
3.When openwith calls createwindowinband, change its last argument 4->0
This is the sandbox I worked with

Windows 10 also works, but not quite the same as Windows 11 (this is what I've dealt with)

[lmou523]

At least one thing's for sure: it's not a modern application