A forum for reverse engineering, OS internals and malware analysis 

Forum for announcements and questions about tools and software.
 #5484  by Buster_BSA
 Tue Mar 15, 2011 8:03 pm
Released Buster Sandbox Analyzer version 1.27.


+ Added a feature to include file entropy information of Win32 files.

+ Added a feature to include file type information on new created files.

+ Added an option to remember last position on screen.
 #5581  by gjf
 Mon Mar 21, 2011 3:23 pm
Buster_BSA, can you help with pretty strange issue? Here is sandboxie.ini:
Code: Select all
[GlobalSettings]
 
FileRootPath=C:\Sandbox\%SANDBOX%
 
[DefaultBox]
 
ConfigLevel=7
AutoRecover=y
Template=BlockPorts
Template=LingerPrograms
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
RecoverFolder=%Personal%
RecoverFolder=%Favorites%
RecoverFolder=%Desktop%
Enabled=y
 
[UserSettings_07E20193]
 
SbieCtrl_UserName=edde
SbieCtrl_ShowWelcome=n
SbieCtrl_NextUpdateCheck=865300541260
SbieCtrl_UpdateCheckNotify=y
SbieCtrl_BoxExpandedView_DefaultBox=y
SbieCtrl_AutoApplySettings=n
SbieCtrl_BoxExpandedView_bsa=y
SbieCtrl_ReloadConfNotify=n
SbieCtrl_EditConfNotify=n
SbieCtrl_EnableLogonStart=y
SbieCtrl_EnableAutoStart=y
SbieCtrl_AddDesktopIcon=n
SbieCtrl_AddQuickLaunchIcon=n
SbieCtrl_AddContextMenu=y
SbieCtrl_AddSendToMenu=y
SbieCtrl_HideWindowNotify=n
SbieCtrl_WindowLeft=292
SbieCtrl_WindowTop=271
SbieCtrl_WindowWidth=660
SbieCtrl_WindowHeight=450
SbieCtrl_ActiveView=40021
SbieCtrl_ColWidthProcName=250
SbieCtrl_ColWidthProcId=70
SbieCtrl_ColWidthProcTitle=310
 
[bsa]
 
InjectDll=C:\Program Files\Sandboxie\Buster Sandbox Analyzer\sbiextra.dll
InjectDll=C:\Program Files\Sandboxie\Buster Sandbox Analyzer\antidel.dll
InjectDll=C:\Program Files\Sandboxie\Buster Sandbox Analyzer\LAPI.dll
OpenWinClass=TFormBSA
Enabled=y
ConfigLevel=7
Template=BlockPorts
Template=LingerPrograms
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
BoxNameTitle=n
BorderColor=#0000FF
NeverDelete=n
NotifyInternetAccessDenied=y
ClosedFilePath=InternetAccessDevices
NotifyStartRunAccessDenied=y
Sandbox folder to check = C:\Sandbox\BSA\ in BSA.

But anyway there is no logs for registry changes and file system, but they should be according to all other BSA+Sandboxie installations (on other systems).

Any suggestions?

UPD: Problem is solved in a quite interesting way (bug?): BSA doesn't work properly started from context menu. When started using shortcut on Desktop it works pretty well.
 #5684  by Buster_BSA
 Mon Mar 28, 2011 8:57 am
Released Buster Sandbox Analyzer 1.28.

+ Included two versions of LOG_API.DLL: One of them will not show file/registry operations so BSA will run faster

+ Invalid Win32 PE files will be reported

+ Added a feature to include Digital Signature information for dropped files

+ Added a feature to rename automatically processed files to their proper extension

+ Added a feature to do not process unknown file types

+ Added a feature that allows to adjust the time limit in minutes or seconds

+ Added a feature to take screenshots of sandboxed windows when running in automatic mode

+ When a non PE file is processed the file being processed will appear at report and the application that launched it too
  • 1
  • 6
  • 7
  • 8
  • 9
  • 10
  • 32