Is the VirtualAllocEx error normal?

[YuHuanTin]

Can a normal sandboxed program use VirtualAllocEx to hook a process outside the sandbox (like Frida)?
I get the error Failed to attach: unexpected error allocating memory in target process (VirtualAllocEx returned 0x00000005), is there a solution?

[bastik-1001]

This is part of how Sandboxie isolates software, By default a sandbox does not allow a sandboxed process to mess with the memory of another process that is not run in the same sandbox.

You can use OpenIPCPath to control that.

Here is an overview about the resource access types

[YuHuanTin]

I tried adding ipc to allow *.* program, but it doesn't seem to work

I ran VirtualAllocEx on a notepad program outside the sandbox and it failed.

the code

#include <Windows.h>

struct AutoHandle {
    HANDLE handle_;

    explicit AutoHandle(HANDLE hwnd) : handle_(hwnd) {}

    ~AutoHandle() {
        if (handle_ != nullptr) {
            CloseHandle(handle_);
            handle_ = nullptr;
        }
    }
};

int main(int argc, char *argv[]) {
    // disable output buffering
    setvbuf(stdout, nullptr, _IONBF, 0);

    std::println("the pid: ");
    int pid = 0;
    std::cin >> pid;

    auto handle = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
    if (handle == nullptr) {
        std::println("failed to open process");
        return 1;
    }

    AutoHandle autoHandle(handle);

    auto tryAlloc = VirtualAllocEx(autoHandle.handle_, 0, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (tryAlloc == nullptr) {
        std::println("failed to allocate memory, the error code: {}", GetLastError());
        return 1;
    }

    std::println("allocated memory at: 0x{:x}", reinterpret_cast<uintptr_t>(tryAlloc));

    BOOL result = VirtualFreeEx(autoHandle.handle_, tryAlloc, 0, MEM_RELEASE);
    if (!result) {
        std::println("failed to deallocate memory, the error code: {}", GetLastError());
        return 1;
    }

    std::println("deallocated memory");
}

[bastik-1001]

According to the documentation of OpenIpcPath it does not allow wildcards.

OpenIpcPath=$:program.exe
The line needs to be repeated per target process, program.exe needs to be replaced with the target process name. In your example it would be
OpenIpcPath=$:notepad.exe

If it does not work, it appears to require technical insight, which I lack, but someone else might be able to help you.

[offhub]

Can a normal sandboxed program use VirtualAllocEx to hook a process outside the sandbox...

I don't think so.

Specific

NoSecurityIsolation=y
OpenIpcPath=$:notepad.exe

All

NoSecurityIsolation=y
OpenIpcPath=$:*

[YuHuanTin]

OK, it's doable. But it seems to require a license haha