Trust No Program

SandDiff

Utilities designed for use with Sandboxie

Postby Buster » Wed Oct 14, 2009 7:24 am

That may be the reason. I will do some research when I have time.
Buster
 
Posts: 2378
Joined: Mon Aug 06, 2007 7:38 pm

Postby kxsq » Fri Oct 23, 2009 4:13 pm

sanddiff1.04 sounds good
thank u
kxsq
 

Postby wraithdu » Fri Oct 23, 2009 4:14 pm

I took a look through Everything's forums and found the reason NETSTAT.EXE is not found in system32. It is because netstat (and many other system32 files) are actually hardlinks. You can google the term. I don't know how this affects opening or running an app via ShellExecute().
wraithdu
 
Posts: 1410
Joined: Fri Jun 29, 2007 7:54 pm

Postby Brummelchen » Fri Oct 23, 2009 4:31 pm

why is netstat neccessary for this program? explain!
Brummelchen
 
Posts: 308
Joined: Mon Oct 13, 2008 2:13 am

Postby wraithdu » Fri Oct 23, 2009 7:24 pm

Part of the program can monitor ports that an application has open/listening.
wraithdu
 
Posts: 1410
Joined: Fri Jun 29, 2007 7:54 pm

Postby Brummelchen » Fri Oct 23, 2009 8:53 pm

And what is the relationship to the reghive and files in sandbox?

is sanddiff working when the box is active or not active?

its a bit like watching an electron (heisenberg): you cannot determine position and impulse same time ;)
Brummelchen
 
Posts: 308
Joined: Mon Oct 13, 2008 2:13 am

Postby Buster » Fri Oct 23, 2009 10:34 pm

Brummelchen wrote:And what is the relationship to the reghive and files in sandbox?

is sanddiff working when the box is active or not active?

its a bit like watching an electron (heisenberg): you cannot determine position and impulse same time ;)


Sanddiff works when Sandboxie is not active.

SandDiff compares 2 moments of a given sandbox. Let´s call them "before and "after".

In the "before" moment the sandbox folder can be empty or contain information.

In the "after" moment the sandbox folder must contain information if not it´s pointless.

Between the "before" and the "after" you must run sandboxed whatever you want.

When you are done you terminate all processes and you are ready for comparision.

Sanddiff compares the file, registry and port differences between the "before" and the "after" states of the sandbox.

Relationship to the reghive and files in sandbox? None. It´s just another source of information to compare.

I think it´s pretty simple to understand. Let me know if something is not clear.

The next version of SandDiff will contain a new feature. It will check for malware activity and present results to the user based in the differences.
Buster
 
Posts: 2378
Joined: Mon Aug 06, 2007 7:38 pm

Postby Brummelchen » Sat Oct 24, 2009 6:22 pm

i understand your explanation - i can reproduce both ways.
what i NOT understand is the use of netstat in that combination.
if there is nothing active what to determine?
(except looking into registry i dont know a way to determine if
a sandbox is still active, never though about it till now)
Brummelchen
 
Posts: 308
Joined: Mon Oct 13, 2008 2:13 am

Postby Buster » Sat Oct 24, 2009 7:46 pm

Brummelchen wrote:i understand your explanation - i can reproduce both ways.
what i NOT understand is the use of netstat in that combination.
if there is nothing active what to determine?
(except looking into registry i dont know a way to determine if
a sandbox is still active, never though about it till now)


Netstat is used to obtain the state of the ports.

Netstat automatically retrieves port information when you press "before".

Optionally you can press "Meanwhile" button and obtain port information before you press "after".

You decide when you press "Meanwhile" or even if you want to press it.

The user must press "after" when he has finished sandboxed processes. SandDiff doesn´t determine if a sandbox is still active.
Buster
 
Posts: 2378
Joined: Mon Aug 06, 2007 7:38 pm

Postby Brummelchen » Sat Oct 24, 2009 8:59 pm

Netstat automatically retrieves port information

and that is the point i dont understand.
if sanddiff does not care about activity what to determine at open ports and listening apps?

#hmm - just startet sanddif 1.04 - netstat is needed for the "meanwhile" option and open apps?
Brummelchen
 
Posts: 308
Joined: Mon Oct 13, 2008 2:13 am

Postby Buster » Sat Oct 24, 2009 10:28 pm

Brummelchen wrote:and that is the point i dont understand.
if sanddiff does not care about activity what to determine at open ports and listening apps?

#hmm - just startet sanddif 1.04 - netstat is needed for the "meanwhile" option and open apps?


Who did say SandDiff doesn´t care about port activity?

Yes, netstat is needed for the "meanwhile".
Buster
 
Posts: 2378
Joined: Mon Aug 06, 2007 7:38 pm

Postby Buster » Tue Oct 27, 2009 10:02 am

I have fixed the problem with deleted keys/values.

As soon as tzuk adds the feature I requested I will release a new version.
Buster
 
Posts: 2378
Joined: Mon Aug 06, 2007 7:38 pm

Postby Buster » Tue Oct 27, 2009 9:09 pm

wraithdu wrote:I took a look through Everything's forums and found the reason NETSTAT.EXE is not found in system32. It is because netstat (and many other system32 files) are actually hardlinks. You can google the term. I don't know how this affects opening or running an app via ShellExecute().


I have a computer with Windows XP and Windows 7 installed and when I´m running Windows XP I can see NETSTAT.EXE in \Windows\System32 and does not look like a hard link. The file is 32kb long. :?
Buster
 
Posts: 2378
Joined: Mon Aug 06, 2007 7:38 pm

Postby wraithdu » Wed Oct 28, 2009 3:27 am

The hardlink is only in Win7. Maybe Vista, but I don't have it to test anymore. And the hardlink will seem exactly the same as the real file - properties, size, appearance, etc. - except the Compatibility settings will be greyed out.
wraithdu
 
Posts: 1410
Joined: Fri Jun 29, 2007 7:54 pm

Feature Request: Save Differences in Reg Format

Postby brahman » Thu Oct 29, 2009 12:14 pm

Hi,

thanks for this great app.

It would be very nice if it could save registry differences automatically in Windows Registry Editor Version 5 format.

Thanks.

B.
brahman
 
Posts: 1
Joined: Thu Oct 29, 2009 12:09 pm

PreviousNext

Return to Contributed Utilities

Who is online

Users browsing this forum: No registered users and 1 guest