Can not run Sandboxie when build source code from github

[tienlhp1]

Describe the bug
When i download source code from github to build, my build is not working

To Reproduce
Steps to reproduce the behavior:

1. Build source by Visual studio code 2019
2. Build SandboxieInstall64.exe by run SandboxieVS.nsi
3. Run SandboxieInstall64.exe
4. Wait for SandboxieInstall64.exe to finish running but sandboxie not auto run
5. When run again sandboxie control show error

List error

SBIE1102 Sandboxie driver (SbieDrv) unloading
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE1401 Configuration file not found, using defaults
SBIE1101 Sandboxie driver (SbieDrv) version 5.52.0 initialized
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE9234 Service startup error level 9361 status=C000A000 error=-1073700864
SBIE2331 Service start failed:  [22 / 5] Access is 

Expected behavior
I think it happens because file SbieDrv.sys but I don't know why it doesn't work. I want to know how to build sandboxie and run normal.

Screenshots

System details and installed software (please provide the following information):

• Windows 10 Home Single Language 21H1.
• Sandboxie Classic 5.51.6

[hg421]

Your driver is missing a trusted signature so Windows refuses to load it.

To test the driver on your own machine you will have enable test signing (bcdedit /set testsigning on) and reboot, then it will accept any signed driver (trusted or not). Be aware of the security implications though.

[cuonguet]

I was created EV code signing and signature on all Partner Center for Windows Hardware submissions. I get signed package, build and installed sandboxie but I can't a trusted signature file SbieDrv.sys on windows refuses to load it.
How to trusted signature file SbieDrv.sys on windows and sandboxie worked.

[t-anh]

Dear @DavidXanatos
I'm having the same issue. Could you tell me what was wrong?

After registering the Windows Hardware Developer Program and uploading the EV code signing,
I follow the steps in ReadMe.txt file to create the SandboxieInstall64.exe file.

https://github.com/sandboxie-plus/Sandboxie/blob/master/Sandboxie/install/ReadMe.txt

1. Sign the binaries (if applicable).

I signed Bin\x64\SbieRelease\SbieDrv.sys file by Microsoft.
Sign others exe and dll files in Bin\x64\SbieRelease folder by signtool.

signtool.exe" sign /a /n "Company name" /tr http://timestamp.globalsign.com/tsa/r6advanced1 /td SHA256 /fd SHA256 "file path"

And

2. Set the #defines in \common\my_version.h (SBIE_INSTALLER_PATH, etc.) to the location of your binaries. (These #defines are read by SandboxieVS.nsi).
3. Edit \install\SandboxieVS.nsi and uncomment the !define _BUILDARCH for the version you want to create an installer for.
4. In Explorer, right-click on \install\SandboxieVS.nsi, and select "Compile NSIS Script".
   The resulting installer binary (SandboxieInstall64.exe or SandboxieInstall32.exe) will be saved to SBIE_INSTALLER_PATH (from my_version.h).
5. Sign the installers.

I signed Bin\x64\SandboxieInstall64.exe file by signtool.

signtool.exe" sign /a /n "Company name" /tr http://timestamp.globalsign.com/tsa/r6advanced1 /td SHA256 /fd SHA256 "file path to SandboxieInstall64.exe"

After installing SandboxieInstall64.exe file, [SBIE2331 Service start failed: [22 / 5] Access is denied.] error occurred.

[DavidXanatos]

The procedure in the reedme is only valid for the old style non MSFT mediated code signing. Please reffer to MSFT documentation how to sign a driver properly nowadays.

[isaak654]

The procedure in the reedme is only valid for the old style non MSFT mediated code signing. Please reffer to MSFT documentation how to sign a driver properly nowadays.

If someone posts here the updated instructions for Sandboxie, I will consider to create a pull request to update the readme file.

[cuonguet]

The procedure in the reedme is only valid for the old style non MSFT mediated code signing. Please reffer to MSFT documentation how to sign a driver properly nowadays.

@DavidXanatos ,
I followed " https://docs.microsoft.com/en-us/windows-hardware/drivers/develop/signing-a-driver-for-public-release" MSFT document. That right?

[DavidXanatos]

No that's outdated there are no more cross signign certificates.

[cuonguet]

@DavidXanatos ,
I didn't found "MSFT documentation how to sign a driver ".
Can you send link of documentation signing drive with EV code signing for me? Please!

[DavidXanatos]

https://techcommunity.microsoft.com/t5/windows-hardware-certification/driver-signing-changes-in-windows-10/ba-p/364859

Beginning with the release of Windows 10, all new Windows 10 kernel mode drivers must be submitted to and digitally signed by the Windows Hardware Developer Center Dashboard portal . Windows 10 will not load new kernel mode drivers which are not signed by the portal.

How do I sign a driver so that it is compatible with Vista, Windows 7, Windows 8, Windows 8.1, and Windows 10?
Simple. All you need to do is run the HLK tests for Windows 10, and run the HCK tests for Windows 8.1 and earlier versions as you have in the past. Then, submit your driver and the merged HLK/HCK test results to the Windows Hardware Developer Center Dashboard portal . The portal will sign the driver the right way so that it will work on all platforms that you indicate the driver is applicable for.

the submitted test result report contains your driver files and once MSFT deams everything to be in order you will be able to download the signed drivers form the portal

[t-anh]

@DavidXanatos
After building Sandboxie from source code and downloading signed "SbieDrv.sys" file from the portal, create installer file and install it, Sandboxie still doesn't work.
Compare with installed files from release installer, i don't found "SbieSvc.exe.sig" in my files.
If I copy "SbieSvc.exe" and "SbieSvc.exe.sig" from release installer and put/overwrite my files, Sandboxie will works normally.
Could you tell me how to create "SbieSvc.exe.sig" file?

[DavidXanatos]

you can generate sig fiels using ProcessHackers SignTool, ofcause you will need to put your own private key into the driver.
Alternatively you could disable signature checking in your driver build

[isaak654]

ProcessHacker's SignTool: https://github.com/processhacker/processhacker/tree/master/tools/CustomSignTool
In case of success, please write the updated instructions in a new post as specified here.