"Run in Sandbox" doesn't work on Windows 11 24H2

[Black-Seraph]

Windows 11 24H2 removed madrid.dll from its API pool, having absorbed its functionality into WindowsSandbox.exe. We'll have to reverse engineer a few components to get the Run in Sandbox option running again.

• [x] RE 24H2 cmclient.dll
• [x] RE 24H2 CmService.dll
• [x] RE 24H2 computecore.dll
• [x] RE 24H2 computenetwork.dll
• [ ] Implement Persistant Sandbox option
• [ ] Regression test against Windows 11 23H2

UPDATE: My internal build now runs fine on 24H2, but it needs some more cleanup and regression testing against 23H2 before I can release it to all of you.

As part of my reversal of several Windows library files I also found a way to make the sandboxed instances persistent, which I hope to implement in a future build of Duo as another configuration toggle.

[zzfuture]

Does that change also exists in KB5041587 update for 23H2?

[Black-Seraph]

KB5041587

Not sure.

You can check real quick by opening C:\Windows\System32 and checking if you've got a madrid.dll there or not.

[m33ts4k0z]

I will move this here since you closed #164 so that we keep this in one thread 😊 Thanks for looking into this 😊. I just tried formatting a 3rd time now but the same thing happens. Example image. The windows update entry had to be where the red rectangle is. Also notice the apps entries missing

I used the 24H2 iso that I got using Rufus and fully updated it. I then formatted using a USB stick with Ventoy.

Some notes: When you tried, did you perform these steps?

• Clean install, formatting the drive and not reseting or upgrading, using the iso file downloaded either using Rufus or from here.
• Restarted the PC after installing Duo 1.4.9.

The issue started after restarting when I installed Duo. I was able to run Duo normally before the restart. Basically Duo installed all the dependencies and then it installed itself. That is that I didn't have to re-run the installer after restarting as the message at the end of the installation suggests. Windows needed about 6-7 minutes to "customizing features" after the restart.

Also what are your memory integrity/core isolation settings? Could this matter too?

Thanks again for diving into this directly 😊

PS: I noticed now that I can't even create a new Windows account 🤔

PS2: I tried even with my Unraid VM again and exactly the same happens after installing in a totally blank drive. I am quite certain that this is not only my system since the Unraid server is at a remote location running different hardware.

PS3: I tried on a third computer. Lenovo Legion Go. Exactly the same.

PS4: I tried again with 23H2 and no issues there. Everything works correctly. So its a 24H2-only issue.

[Black-Seraph]

PS: 24H2 added extra crap to prevent the creation of local accounts, to what extend I'm not sure yet though. I guess they're really trying hard to force their Microsoft accounts.

PS2/PS3: Well, that's why we're looking into this. We'll figure it out given enough time.

PS4: Yeah, no issues at all on 23H2 on my end either.

As for WIP updates... I am about 10% done reverse engineering cmclient.dll. I can spawn sandbox containers again on 24H2, but haven't had the time to reverse engineer the I/O and process APIs that we need yet.

It's 3:30AM again, time for me to clock out. Got another doctor's appointment at 7:30AM.

[m33ts4k0z]

I hope you go through this completely soon 😊

[Black-Seraph]

All the required components have now been reverse engineered.

The internal build will undergo regression testing over the next few days, and if all checks out we'll roll this one up into a 1.5.0 release build.