WerFault.exe errors for all applications on the latest Win11 ARM64

[ZaberKo]

Describe what you noticed and did

After upgrading to the lastest Win11 ARM, All sandboxie box cannot open any application anymore. WerFault.exe is raised after running any application, even by right-clicking "Run Program", then it immediately quits. And I cannot get any trace or mem_dump info. I can confirm only the latest system upgrade cause this issue through disk-level snapshot (I use VM).

I think maybe microsoft upgrades their APIs that break some dependencies to sandboxie. Any ideas?

System Info:

Edition Windows 11 IoT Enterprise LTSC
Version 24H2
OS build 26100.2454
Experience Windows Feature Experience Pack 1000.26100.36.0

PS: I use a fresh installed Windows VM on MacOS through Parallel Desktop.

How often did you encounter it so far?

Always after upgrade.

Expected behavior

Normally open any application in boxes of sandboxie just like what it is before the windows upgrade.

Affected program

All

Download link

Not available

Where is the program located?

Not relevant to my request.

Did the program or any related process close unexpectedly?

Yes, it did, but no .dmp file has been created in the system.

Crash dump

Not available

What version of Sandboxie are you running now?

Sandboxie Plus 1.15.3 64-bit (ARM64)

Is it a new installation of Sandboxie?

I recently did a new clean installation.

Is it a regression from previous versions?

No

In which sandbox type you have this problem?

All sandbox types (I tried them all).

Can you reproduce this problem on a new empty sandbox?

I can confirm it also on a new empty sandbox.

What is your Windows edition and version?

Windows 11 IoT Enterprise LTSC 24H2 (ARM64)

In which Windows account you have this problem?

Not relevant to my request.

Please mention any installed security software

Microsoft Defender

Did you previously enable some security policy settings outside Sandboxie?

No

Trace log

No response

Sandboxie.ini configuration

No response

[ZaberKo]

A screenshot:

[7qCyZyMs]

In fact, the issue you mentioned has been present on the ARM64 platform for over ten months. When the Windows Insider Preview reached the 26xxx GE release, this problem was already existing. Under any configuration, the sandbox exhibits the symptoms shown in your image and fails to start successfully.

Interestingly, on Windows Server ARM build 26334, you can run the sandbox normally just like on x86_64. However, I am not sure whether Sandboxie support is still maintained after it moved to version 27xxx.

I believe the Sandboxie maintainers should set up an accessible ARM64 machine, which doesn’t need to have high performance—a Raspberry Pi 5 would suffice—to test the impact of the latest Windows on ARM translation mechanisms on the code.

[DavidXanatos]

I'll look into this issue soon, I have ordered one of the new Qualcom laptops for that purpose,
last time I checked WoR only supported older windows 11 versions so a Pi seams useless here.

[7qCyZyMs]

我很快就会解决这个问题，为此我已经订购了一台新的 Qualcom 笔记本电脑，上次我检查 WoR 仅支持较旧的 Windows 11 版本，因此 Pi 接缝在这里毫无用处。

You can use a hexadecimal editor to modify the contents of WoR.exe at offset 0x00010DF8:
Before --- 20 4B 62 00 00
After ----- 20 FF FF FF 7F
This way, you can bypass the restriction that only supports Windows build 25163 and enter the Canary Insider to receive updates. However, due to the requirement for the ARMv8.1 instruction set, you must use a Pi 5.

[DavidXanatos]

where to get "Windows Server ARM" version?

[7qCyZyMs]

从哪里获取“Windows Server ARM”版本？

https://uupdump.net/selectedition.php?id=738f71e0-a8bf-40f5-a5a0-971e2fcc176a&pack=en-us

[DavidXanatos]

This way, you can bypass the restriction that only supports Windows build 25163 and enter the Canary Insider to receive updates. However, due to the requirement for the ARMv8.1 instruction set, you must use a Pi 5.

I have a Pi 5 so I'll try but my experience with the pi4 and the older builds were everything but great, so I'm eagerly awaiting the new Hardware and with 32GB ram I can properly run test VMs on an arm system that will be a great development aid.

EDIT: my bad just an other pi 4, so i have no pi 5 yet and now i also remember why I don't want to buy a pi for windows with less then 16GB ram, so I'll have to look into the Pi 5 compute module as they come with up to 16 GB if I want one, but IMHO that's not needed now as the Qualcom based laptop is on its way with even more RAM.

[DavidXanatos]

Update PI5 with 16GB ram just came out time to buy one.
That said my new arm laptop after some delivery delays also arrived and I'm investigating the issue, it seams that one of the NTDLL.dll hooks is failing when i comment it out apps start fine again except for the GdiDllInitialize issue #4415

My goal is to fix all the arm64 issues for the 1.15.5 release.

I will also set up a VM with the latest ARM64 Cannary insider for testing, I wonder does hyper-v work on raspi?

[7qCyZyMs]

I wonder does hyper-v work on raspi?

RPi5‘s non-standard hardware does not provide the full virtualization signal required for Hyper-V. But also a weird way to get the full Hyper-V experience, first installing ESXi and then nesting virtualized Windows.… Try setting arm_freq=xxxx to push for overclock, and experience more vcpus and virtual memory.

Also, need to throw rpi into the utility room or soundproof box after configuring remote, the UEFI under the fan is running at maximum speed to provide adequate heat dissipation and roaring.

Since your laptop has arrived, it is not recommended to buy RPI5, unless it is dealing with pure Linux problems.

[DavidXanatos]

@7qCyZyMs I think I'll release a intermediate test build, some issues are fixed but i see more like processes no mater which arm64 x64 x86 often don't terminate in time but it takes a couple of seconds to quit which is very strange for native arm64 processes.

[DavidXanatos]

please try the attached replacement sbiedll's
https://github.com/user-attachments/files/18435975/Sandboxie-Plus-v1.15.5-SbieDll.zip

[7qCyZyMs]

please try the attached replacement sbiedll's

Thank you for your work. A few hours ago, I reinstalled a WoA, and after importing the files you provided, the Box started working properly. I had built hundreds of Boxes on an x86_64 device before, and now I'm gradually copying them to ARM for testing. They are performing well in simple open-close scenarios with the yellow Box, though I haven't tested under higher loads yet. A very small number of failures to start might simply be due to the translate, which is unrelated to Sandboxie. Overall, the ARM Insider Preview's Sandboxie failure issue now be resolved. I'm looking forward to the official release of version 1.15.5

[DavidXanatos]

@7qCyZyMs Do you have experience with with proxmox on the raspberry pi and windows guest?

[7qCyZyMs]

@DavidXanatos https://github.com/jiangcuo/Proxmox-Port/wiki/Install-Proxmox-VE-on-Debian-bookworm Bad experience, but simple Windows installation and use scenarios is fine

[DavidXanatos]

Does the old WoR 2.3.1 work with pi 5?
Or is there anything more up to date?

[7qCyZyMs]

offset 0x00010DF8:
Before --- 20 4B 62 00 00
After ----- 20 FF FF FF 7F

Neither.
So patch it, then complete the installation using the rpi2/3 type with the default options, and finally add files to the EFI partition
https://github.com/worproject/rpi5-uefi