www.sandboxie.com :: View topic

Posted: Thu Jun 28, 2012 12:27 pm

Version 3.81.01 turns on the ASLR bit for SbieDll, for both 32-bit and 64-bit versions of the DLL, and so far I haven't run into any problems with that.

I want to retract what I said earlier:

tzuk wrote:

Nevertheless people seem to be concerned, so I said I wouldn't mind adding ASLR at some point. But it turns out you can't limit ASLR to select a random DLL address in the lower 2GB of the address space. And for various reasons, SbieDll needs to be loaded in the lower 2GB of the address space. So this means that I can turn on the ASLR bit in the 32-bit SbieDll, but not in the 64-bit DLL. For the 64-bit DLL, I would have to rework SbieDll a bit, so it can load in the higher addresses. And test this change.

Turns out Windows ASLR takes that under consideration and if the original base address is in the lower 2GB, which is the case for the 64-bit SbieDll, then ASLR randomizes the address in the lower 2GB of the address space. So that means I really only had to turn on one bit somewhere and ASLR takes care of everything else. I apologize for not looking into this earlier, I just assumed the randomization would not care about low-2GB DLLs.

(I removed some contentious posts in this topic, in the interest of a smooth sailing. I hope no one minds.)

Posted: Thu Jun 28, 2012 12:42 pm

tzuk wrote:

(I removed some contentious posts in this topic, in the interest of a smooth sailing. I hope no one minds.)

Finally I will be able to sleep quietly at nights! <g>

Posted: Thu Jun 28, 2012 2:27 pm

They were all mine Razz

, but I'm ok as long as Buster can finally have some rest Smile

Posted: Sat Jun 30, 2012 2:17 am

Accoring to a bloke at Wilders ASLR doesn't seem to be enabled by Sandboxie (latest ver): http://www.wilderssecurity.com/showpost.php?p=2079647&postcount=3

Thought I'd let you know just in case something isn't working well.

Posted: Sat Jun 30, 2012 3:13 pm

Silly me. I enabled the bit once during testing, but forgot to update the build sequence accordingly. Embarassed

Version 3.81.02 should fix that.

Posted: Sun Jul 01, 2012 10:09 am

SbieCtrl.exe doesn't have aslr support, maybe because it is merely a gui component?

Posted: Mon Jul 02, 2012 1:26 pm

It's becausee I only enabled ASLR for the DLL. Chances are that I can turn ASLR for all the EXEs in the distribution with no negative side effects. I'll test and might enable it in beta version .03.

Posted: Tue Jul 03, 2012 5:47 pm

In version 3.81.03, I enabled ASLR on all the EXEs in Sandboxie. I see that Process Explorer says ASLR is enabled for the process, but it doesn't look like Windows is really randomizing the load address for the primary module, i.e. the EXE itself.

Posted: Tue Jul 03, 2012 7:53 pm

tzuk wrote:

I see that Process Explorer says ASLR is enabled for the process, but it doesn't look like Windows is really randomizing the load address for the primary module, i.e. the EXE itself.

Mmmh, I could be wrong, but there are interesting answers here:
http://stackoverflow.com/a/6396484
http://blogs.msdn.com/b/vcblog/archive/2009/05/21/dynamicbase-and-nxcompat.aspx

Posted: Wed Jul 04, 2012 10:12 am

Thanks for the links Max100. The problem is that I had relocation data removed from the final EXE. Without this data, Windows doesn't know how to load an EXE to an address other than the address specified in the EXE as the default address. Having relocation data in executables (both EXE and DLLs) is a requirement for ASLR.