sandboxie-plus/Sandboxie
Sandboxie
Sandboxie is an operating system-level virtualization tool designed to run Windows applications in isolated, secure environments. By intercepting system calls and redirecting file system and registry modifications to a separate, discardable storage area, it prevents untrusted software from making permanent changes to the host system. This containment ensures that browser history, temporary files, and potential malware remain trapped within the sandbox, protecting the integrity and privacy of the underlying host.
The software distinguishes itself through granular control over the isolation environment, including the ability to emulate administrative privileges for compatibility without granting actual elevated rights. It supports complex security policies such as per-sandbox network filtering, proxy redirection, and DNS control, alongside the ability to define specific breakout rules for documents or applications. Users can manage these environments through snapshots, encrypted storage, and volatile memory mapping, which allows for high-speed performance and automatic data clearing upon process termination.
Beyond core isolation, the platform provides comprehensive lifecycle management for virtualized workspaces, including automated deployment for removable drives and programmatic configuration via a command-line interface. It enforces strict resource usage limits and access rules to maintain system stability while offering tools for data recovery and state management. The software is distributed as a utility for Windows environments, providing a centralized interface for monitoring and maintaining these isolated execution containers.
Features
- Desktop Privacy Protection Tools - Provides a solution that traps browser history, cookies, and temporary files within a discardable container to prevent sensitive data leakage.
- Sandbox and Isolation - Isolates Windows applications in virtualized environments to prevent permanent host system changes.
- Security Isolation Mechanisms - Runs untrusted software in a contained environment to prevent permanent changes or malicious modifications to the host operating system.
- Storage Redirection - Redirects file system and registry modifications to a discardable storage area to protect host integrity.
- OS-Level Virtualization - Provides OS-level virtualization to isolate Windows applications from the host system.
- Containerized and Isolated Workspaces - Creates containerized workspaces that restrict process access to system resources and hardware.
- Network Policy Enforcement - Controls network traffic per sandbox using firewalls, proxy routing, and DNS redirection to isolate communication.
- Host Privacy Protection Mechanisms - Traps browser history, cookies, and temporary files within an isolated container to prevent sensitive data from leaking onto the host.
- Kernel-Mode Interception Mechanisms - Intercepts system calls and file system requests at the kernel level to redirect operations into isolated storage containers.
- Secure Storage Virtualization - Uses encrypted disk images and volatile memory to protect sensitive information while ensuring data is wiped after the process terminates.
- Network Isolation - Applies per-sandbox firewall rules, proxy routing, and DNS filtering to control and monitor the connectivity of isolated applications.
- State Management - Provides snapshotting and state restoration capabilities to revert isolated environments to a clean state.
- Container Isolation Technologies - Contains downloaded files and browser data within isolated environments to prevent malware infection.
- Traffic Redirection Tools - Routes application network requests through internal proxies and DNS filters to control connectivity and prevent unauthorized external communication.
- User-Mode API Hooking Frameworks - Injects dynamic link libraries into target processes to intercept and filter application requests before they reach the operating system.
- Sandbox Lifecycle Controls - Creates, configures, and deletes virtualized environments through scripts or automated tools to maintain clean and secure testing workspaces.
- Privacy Protection - Traps browser history and temporary files within isolated containers to protect host privacy.
- Process Token Restriction Utilities - Modifies the security tokens of sandboxed processes to strip administrative privileges and limit interaction with the host operating system.
- System Resource Constraints - Constrains memory allocation and process counts for isolated applications to prevent resource exhaustion on the host system.
- Volatile Memory Mapping Systems - Mounts virtualized file systems directly into system RAM to provide high-speed storage that is automatically cleared upon process termination.
- Virtualized Storage Overlays - Utilizes RAM-based virtual disks for high-speed volatile storage and encrypted disk images to protect sensitive data.
- Isolation Policies - Restricts access to external hardware by sandboxing USB devices to prevent unauthorized data transfer.
- Network Traffic Filters - Applies per-sandbox firewall rules, proxy redirection, and DNS filtering to control application connectivity.
- Sandbox State Management Systems - Captures and restores the state of a sandbox to revert unwanted changes or preserve specific configurations for later use.
- Access Control - Defines granular rules to permit or restrict access to files, registry keys, and system objects.
- Path-Based - Enforces granular security policies by evaluating every file, registry, and network request against a defined set of access rules.
- Virtualised Registry Overlays - Merges a private, sandbox-specific registry hive with the host system registry to simulate configuration changes without modifying the actual system.
- In-Memory Data Stores - Uses volatile memory to store temporary sandbox files for high-speed performance and automatic cleanup.
- Command Line Configuration Interfaces - Provides a command-line interface to programmatically query and modify isolation settings for virtual environments.
- Sandbox Deployment Automators - Automatically triggers isolation for connected USB drives and adds shortcuts for sandboxed applications directly to the host operating system menu.
- Memory-Based Sandboxing - Uses system memory to host virtualized environments for high-speed performance and automatic data clearing.
- Process Restriction Policies - Limits sandboxed application capabilities by dropping administrative rights and blocking unauthorized interactions.
- Software Testing - Executes potentially malicious or unknown applications in a contained space to observe behavior without risking the host system.
