Break the limits of winrt com (package app) in the sandbox

[lmou523]

As a result of my in-depth research, the reason why the packaged application cannot run in the sandbox is because some winrt com objects in the sandbox are not working properly

winrt's com is roughly divided into 3 categories (similar to classic com)
1)Does not rely on any out-of-process services/processes
2)Relies on out-of-process services, but not out-of-process com
3)Out-of-process winrt com components

For classic com components, sandboxie has a com proxy component and com scm (rpcss dcomlaunch).
However, for the com of winrt, the current sandbox cannot realize the multiple opening of winrt components in the sandbox and the proxy winrt components

It is for these reasons that the packaged application cannot be run/invoked in the sandbox (Explorer missing menu item).
I hope that one day sandbox will solve these problems and let store apps run in the sandbox

There are probably two directions：
1）Release the service/out-of-process winrt components associated with winrt com in the sandbox
2）Related components double in the sandbox

This one may take a long time and be very difficult (I can't do it). But I hope to overcome these problems

remark:
Some unprovisioning of services：
、、、
#放开沙盒内packmanager的 winrt 包管理类
RpcPortBinding=AppXDeploymentClient.dll,{00000000-0000-0000-0000-000000000000},Resolve=AppXSvc,Server=AppXSvc
RpcPortBindingIfId=AppXSvc,{ae2dc901-312d-41df-8b79-e835e63db874}
#放开usermanager服务 打包应用程序打开文件不卡死
OpenClsid={0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}
RpcPortBinding=usermgrcli.dll,'b18fbab6-56f8-4702-84e0-41053293a869@ncalrpc:',Resolve=UserMgr
RpcPortBindingIfId=UserMgr,{b18fbab6-56f8-4702-84e0-41053293a869}
、、、

Some winrt classes are not supported in the sandbox：
"Windows.Internal.StateRepository.ApplicationExtension"
"Windows.Internal.StateRepository.Application"
"Windows.Internal.StateRepository.User"
"Windows.Internal.StateRepository.FileTypeAssociation"

[lmou523]

If you are interested in this matter, we can discuss it here

[DavidXanatos]

Thank you for the in depth analysis.
Do you know of any good samples that uses this functionality i could use for testing and debugging, instead of explorer & co?

[lmou523]

Thank you for the in depth analysis. Do you know of any good samples that uses this functionality i could use for testing and debugging, instead of explorer & co?

You can write a demo that calls the RoGetActivationFactory
Use iunknown and these class names
"Windows.Internal.StateRepository.ApplicationExtension"
"Windows.Internal.StateRepository.Application"
"Windows.Internal.StateRepository.User"
"Windows.Internal.StateRepository.FileTypeAssociation"

winrtcom objects can be obtained outside the sandbox, but will fail inside the sandbox

---

、、、(addto sbieini)
#放开沙盒内packmanager的 winrt 包管理类
RpcPortBinding=AppXDeploymentClient.dll,{00000000-0000-0000-0000-000000000000},Resolve=AppXSvc,Server=AppXSvc
RpcPortBindingIfId=AppXSvc,{ae2dc901-312d-41df-8b79-e835e63db874}
#放开usermanager服务 打包应用程序打开文件不卡死
OpenClsid={0DC1AB8B-A52D-4BA8-BD76-E2819386FB2F}
RpcPortBinding=usermgrcli.dll,'b18fbab6-56f8-4702-84e0-41053293a869@ncalrpc:',Resolve=UserMgr
RpcPortBindingIfId=UserMgr,{b18fbab6-56f8-4702-84e0-41053293a869}
、、、
These configurations allow some winrtcom methods to be allowed in the sandbox(windows.management.deployment.packagemanager::AddPackageByUriAsync).