Does sandboxie “grab” all the system calls?

Question

Sandboxie: http://www.sandboxie.com

Does sandboxie "grab" all the system calls, e.g.: filesystem calls? Or it "grabs" all the low level calls from a process?

Answer 1

As a quick starter for 10, see this page:

The driver component of Sandboxie could not complete initialization. This message indicates that Sandboxie asked the system to provide notifications when processes (applications) start and stop, but the system was not able to accomodate this request.

In technical terms, Sandboxie is asking to register a process notification routine, and this request has failed.

The call in question is PsSetCreateProcessNotifyRoutine

Then this page

The driver component of Sandboxie could not complete initialization. This message indicates that Sandboxie could not intercept and extend some system service.

So the answer is this package is installing a kernel level driver to hook system calls, or rather respond to kernel events and alter the outcome. My knowledge of kernel-mode programming is limited, but I suspect functions such as IoRegisterContainerNotification can be used to create hooks into IO activity and determine what to allow and what to block.

I should advise you - this level of operation is different from a rootkit only in terms of intent and install method, i.e. that you are consensually letting this driver be installed and that you trust it. This software appears entirely innocent but you should be careful when deciding whether or not to install software that does this sort of thing, so evaluate solutions like this carefully.

Edit Just for interests' sake I ran dumpbin /IMPORTS SbieDrv.sys. This driver imports functions from FLTMGR.SYS, the Microsoft File Filter Manager. It also imports amongst many other things PsSetCreateProcessNotifyRoutine from ntoskrnl.exe, the Windows kernel. Just to confirm the above.