介绍

官方网站：https://github.com/sandboxie-plus/Sandboxie

沙盘英文名sandbox(sandboxie)，也叫沙箱，顾名思义可以看做是一种容器，里面所做的一切都可以推倒重来。沙盘也为HIPS 的一种，称为沙盘 HIPS。目前 Sophos 高兴地宣布，我们正在使 Sandboxie 成为一种免费工具，并计划将其转换为开源工具。所以，在完全开源之前现在提供的版本已经完全没有任何限制，您也不需要再去找特别版了。

软件截图

软件特点

Sandboxie 原理引用官方网站的一段话：电脑就像一张纸，程序的运行与改动，就像将字写在纸上。而 Sandboxie 就相当于在纸上放了块玻璃，程序的运行与改动就像写在了那块玻璃上，除去玻璃，纸上还是一点改变都没有的。

Sandboxie（英译“沙盘”）允许你在“沙盘环境”中运行浏览器或其他程序，这个“沙盘”个人感觉就是跟“影子”一样的概念罢了。因此，在沙盘中运行的程序所产生的变化可以随时删除。可用来保护浏览网页时真实系统的安全，也可以用来清除上网、运行程序的痕迹，还可以用来测试软件，测试病毒等用途。即使在沙盘进程中下载的文件，也可以随着沙盘的清空而删除。

如果大家对“影子”/“沙盘”这2个概念还不清楚的话，这里引用官方的一段话：电脑就像一张纸，程序的运行与改动，就像将字写在纸上。而 Sandboxie 就相当于在纸上放了块玻璃，程序的运行与改动就像写在了那块玻璃上，除去玻璃，纸上还是一点改变都没有的。
如果还需要再解释一下的话，Sandboxie 就是相当于在你要运行的程序与系统之间建立一个隔离层，当我们运行程序的时候，就会将程序直接调入该隔层中，此后，程序对系统所做的修改，都会被限制在这个隔离层中，而不会真正地去触及系统。这样的话，就算电脑感染了病毒和木马，也不会对系统造成真正的伤害。

是不是跟影子系统很像？呵呵，王军恒老师认为其实它们之间还有一个很大的区别，就是影子系统是对整个系统进行保护，而 Sandboxie 是对电脑的局部进行保护。Sandboxie 一般是设置某个程序在“沙盘”中运行，而不是将整个Windows都置于“影子”模式下。也就是可以很灵活地设置一个或几个觉得“危险”的程序运行在“沙盘”，而其他一切则正常运行。因此，对普通用户来说，Sandboxie 的局部保护功能可能会更加方便。而且，用户还可以设置让 Sandboxie 像影子系统一样对整个系统进行保护的哦。

Sandboxie 优点与缺陷

Sandboxie 是非常适合专业技术人员测试，学习的一款优秀产品，但是在用户亲和力方面，用户体验方面，学习成本方面就非常不适合大多数普通计算机用户，并且Sandboxie 和大多数沙盒产品一样都没有虚拟桌面，影子系统技术实现原理，功能和 Sandboxie 类沙盒产品一样，区别在于影子系统自带虚拟桌面弥补了大多数沙盒产品在亲和力和用户体验方面的缺陷，比较适合大多数普通计算机用户使用。

上网无忧，在沙盘中运行浏览器
提醒：Sandboxie 本身只能对第一个IE浏览器进程进行保护，不过用桌面上 Sandboxie 的保护 IE 的快捷方式来上网，无论打开多少个 IE 浏览器，都在保护状态下。

Sandboxie 测试程序

木马和病毒总是比杀毒软件抢先一步。所以我们在安装程序的时候，即使杀毒软件没有报毒，也存在一定的风险。但使用 Sandboxie 后，就会将风险降低为零了。
选要安装或解压的不明程序，按鼠标右键，选择“用沙盘运行”（图3），就会以保护的形式来安装或解压该程序。同样，在程序的安装窗口中会发现标题栏上有两个“[#]”符号代表受保护。笔者在安装一个捆绑木马的程序时做了保护措施。恢复系统之后，发现在这期间安装的程序包括木马都消失了，相当的安全。

Sandboxie 安全性

Sandboxie 还提供整个电脑的保护，在 Sandboxie 中选择“功能”菜单，然后“选择运行沙盘→Windows 资源管理器”，就会自动弹出有两个“[#]”符号的“我的电脑”窗口。之后对整个电脑进行任意操作，包括格式化分区、删除文件、拷贝文件等都很安全。恢复的方法很简单。在 Sandboxie 主界面选择“配置 →沙盘设置→设置自动清理选项”，将隔离层中的内容清除即可。

更新日志

• fixed kernel pool out-of-bounds write in Api_CopyStringFromUser, which placed the terminator one character past its allocation and copied two bytes beyond the caller's string (reached through API_UPDATE_CONF)
• fixed Session_ListLock and the raised IRQL being leaked for the lifetime of the driver when the monitor put handlers faulted on a user mode string
• fixed API_MONITOR_GET_EX copying eight bytes of the log buffer past each entry, and its bounds check being defeated by a USHORT cast and a signed underflow
• fixed kernel stack buffer overflow in _wntoi when a box's NetworkAccess rule carried a long port token
• fixed BlockLocalLoop never blocking IPv4 loopback, because WFP_isLoopback tested the last octet of the address instead of the first
• fixed kernel pool over-read in the rename/link minifilter path, where FileNameLength out of the caller's information buffer was used as a length without being checked against that buffer
• fixed the new LPC implementation leaking the per-connection port handle and any pending reassembly buffer on every disconnect
• fixed concurrent requests on one LPC connection racing the shared reassembly state, which could free it twice
• fixed stack buffer overflow in MSGID_SBIE_INI_SET_DAT, where the unterminated setting field was appended to a fixed size path buffer
• fixed SbieIniServer abandoning its critical section when a handler faulted, which left every later INI request blocked on it
• fixed value_len being truncated while scaled to bytes in the INI setting and template handlers, so a large value passed the bounds check and was then read far past the message
• fixed GUI_MAP_WINDOW_POINTS copying more points out of a request than it actually carried, returning service heap to the caller
• fixed WndHookRegisterSlave returning while holding m_SlavesLock on two caller reachable rejections, which wedged the GUI proxy for the rest of the session
• fixed GUI_GET_RAW_INPUT_DEVICE_INFO truncating its size while scaling it to bytes, so an over large cbSize skipped both bounds checks and was handed to the OS as a buffer size
• fixed the desktop startExplorer and startRun actions launching as LocalSystem rather than with the calling user's token
• fixed PORT_DATA_INFO being read without requiring the whole structure to lie inside the LPC message
• fixed the ALPC connect reply returning its uninitialised tail - up to PIPE_MAX_DATA_LEN of service heap - to the caller
• fixed global ("asterisk") queue names having no session scoping, which let any unsandboxed process squat a well known name such as the interactive queue
• fixed the UAC packet being accepted with no minimum length, and its string offsets being used without being checked against it
• fixed the ICMP echo reply fix-up writing a whole ICMP_ECHO_REPLY past a caller sized reply buffer when the echo itself failed
• fixed request_size not being checked against the message in the ICMP echo handler, which put up to 64 KB of service heap on the wire
• fixed m_WorkersList being mutated without taking the lock that exists for it, so concurrent startup requests could close and free the same worker twice
• fixed UserServer::OpenFile using unvalidated request offsets, and matching the box's file rules against a path that was not canonical
• fixed a WCHAR/byte length confusion in the SbieDrv API_GET_FILE_NAME handler that over-read the file-object name into the caller's buffer
• fixed two paged-pool leaks in the SbieDrv API_RENAME_FILE handler (an early return and a faulting user copy) reachable by a sandboxed process
• fixed the SbieDrv API_OPEN_FILE handler not checking its allocation and leaking it when the user copy faulted
• fixed the spooler ALPC message filter being dead code on Windows 8.1+ (the driver compared the port id against the wrong literal, so the filter never armed)
• fixed a kernel NULL-pointer dereference and a NonPagedPool leak in the NetworkAccess firewall-rule parser (netfw.c)
• fixed a wrong range-overlap test in the firewall-rule parser that could insert overlapping ranges and make a Block rule stop matching
• fixed two paged-pool leaks on the error paths of the driver configuration variable expander (Conf_Expand_2)
• fixed the SbieDrv API_IS_BOX_ENABLED handler dereferencing an unprobed user SID pointer in kernel mode
• fixed proc->file_lock and the raised IRQL being leaked if WFP_UpdateProcess faulted in the SbieDrv API_REFRESH_FILE_PATH_LIST handler
• fixed a use-after-free of a protected-root list entry in the file minifilter (the node was read after its lock was released)
• fixed proc->threads_lock being leaked if the output write faulted in the itok/ttok paths of the SbieDrv process-query handler
• fixed the duplicated-handle access re-validation being skipped for Directory/SymbolicLink/Job objects in Syscall_DuplicateHandle_3 (a loop counter clobbered the type length before the suffix test)
• fixed the SbieDrv API_OPEN_PROCESS handler dereferencing the terminated-process sentinel with a lock held when asked for PID 0
• fixed two token references and a handle being leaked if the output write faulted in the SbieDrv API_FILTER_TOKEN handler
• fixed a 32-bit truncation of the entry size in the driver monitor-log writer that could overflow the log buffer
• fixed SandMan over-reading an unterminated file path out of a queue reply (MAN_FILE_MIGRATION), which a sandboxed process could use to crash the UI
• fixed ini section names not being rejected for CR/LF or brackets, which let a caller forge additional sections/settings and bypass a per-section EditAdminOnly lock
• fixed the SbieSvc USER_SHELL_EXEC handler using an unvalidated, possibly-unterminated wire path offset
• fixed the SbieSvc MSGID_SBIE_INI_SET_DAT handler using an unvalidated value_len as the write length, reading past the request buffer
• fixed the INI setting handlers not terminating their fixed-size section/setting/password wire fields before use
• fixed a per-message heap leak in the SbieSvc log drain loop (DriverAssist::LogMessage)
• fixed GUI_CHANGE_DISPLAY_SETTINGS passing an unterminated device name and an unbounded DEVMODE to the display API
• fixed GUI_GRANT_HANDLE leaking the two bitmaps GetIconInfo creates on every call
• fixed GUI_GET_WINDOW_PROP and GUI_FIND_WINDOW treating a caller-chosen value outside the atom range as a raw string pointer
• fixed GUI_SET_CLIPBOARD_DATA not validating the request length and not bounding the caller-supplied data length
• fixed the SbieSvc process-info handler disclosing any process's command line/image path to any local user (now restricted to the caller's session or administrators)
• fixed the SbieSvc WOW64 registry-open handler indexing a fixed prefix of KeyPath without checking its length or termination
• fixed the SbieSvc named-pipe read handler returning the uninitialised tail of its reply buffer (information disclosure)
• fixed the SbieSvc terminal GetName handler leaking uninitialised stack into its reply and terminating the wrong buffer
• fixed the four SbieSvc terminal query handlers having no caller gate and taking a session id off the wire, letting any user query other sessions as SYSTEM; QUERY_INFO now also allow-lists the information class
• fixed the SbieSvc ImBox QueryHandler leaking its critical section (and deadlocking the mount subsystem) when the queried mount raced to NULL
• fixed the SbieSvc queue server accepting an unbounded number of undrained requests (per-queue cap added)
• fixed Import Boxes not letting the user choose where the imported sandboxes are created

下载地址

本地下载        豆包网盘        光鸭云盘        蓝奏云