SbieDrv.sys causes BSOD when Driver Verifier is launched

[gjf]

Steps to reproduce:

1. OS should be Windows 10 x64 Pro 1909.
2. Install Sandboxie.
3. Start "verifier" in command prompt. Select normal test for all drivers then reboot.
4. BSOD at the logon screen because of SbieDrv.sys.

[DavidXanatos]

hmm... i have tested that and the crash seams to originate in GetThreadTokenOwnerPid,
but I don't see anything obviously wrong with the code in that function, may be some more intricate issue.

[rugabunda]

This happened for me as well, back when I was using sophos's version... they did not bother having the the driver approved by microsoft... I asked them about this personally and the developer told me personally they had no plans on doing this because it would negate the functionality of the driver... that it modifies certain functionality in windows that would never be approved, or some such thing. That was in the old forums. If i can find a link to those forums I can dig it all up.

[rugabunda]

Here is some of the info I dug up, some of my post from sysnative

"I was told by sandboxie developers that "driver verifier does not work with sandboxie"... so if you can determine which dump was related to the sandboxie driver, and let me know what the results were, aka memory corruption and the like, that would be appreciated."

[rugabunda]

Read "Due to the nature of Sandboxie, MS Driver Verifier will not work with SbieDrv.sys." He goes into extensive detail why, as I grilled him on it quite heavily, you can find the rest if you dig around
https://github.com/Sandboxie-Website-Archive/sandboxie-website-archive.github.io/blob/c39bd0ffd7aae669cf01a446b195e758b88f1495/www.sandboxie.com/old-forums/search70b370b3.html

[DavidXanatos]

Various Driver Verifier issues will be fixed in the next build, including the BSOD on boot.
I can't guarantee I find all other minor once on my first go through, but currently everything seams fine, I can start FireFox and windows explorer sand boxed without any BSOD's.
Yea!!!!!!

Seriously why Invincia never fixed them it wasn't so hard...

[nefarius]

😁