🚀 go-pugleaf

"Dustin Cook" wrote in message 
news:Xns998EA87D63A2CHHI2948AJD832@69.28.186.121...
> "Vanguard" wrote:
>
>> "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in
>>>>> Have you tried Sandboxie?
>>>>>
>>>>> I find it's an invaluable tool for analyzing software.
>>>>
>>>>
>>>> Neither Sandboxie or VMWare will tell you what got changed by an
>>>> installtion.
>>>
>>> Actually, Sandboxie will leave every single file created/modified 
>>> by
>>> the
>>> installation as well as a copy of the modified registry hive. All 
>>> of
>>> this
>>> information is available in the sandbox when you terminate the
>>> processes.
>>>
>>> I'm confused as to why you don't think this would give you the
>>> information on what was changed then?
>>
>> I don't see any tracking information.  I can explore the sandbox 
>> but
>> that shows me its current state, not what changes were made to get
>
> If you compare the files inside the sandbox with the real 
> counterparts,
> outside the sandbox, you have your changes list. :)

Yes, that can be done manually.  I don't relish having to do a manual 
directory compare to find files that are missing (deleted), new 
(created), or modified even when using something like windiff.

The sandbox does not provide a *log* of deletions, creations, and 
modifications.  I would have to go hunting for them by doing all those 
manual compares you speak of.  Then I would have to save my own log of 
all these changes so that I could later refer to that saved log if I 
needed to later investigate on what changes were made without having 
to go through the entire process again.  I would have to repeat the 
manual exercise of doing all those file and registry comparisons for 
each "snapshot" at which I wanted to analyze what happened to get to 
that state.  If I sandboxed or used a VM to monitor an install, I 
snapshot before the install (because the VM is not in the same state 
as the real host), after the install, after running the program, and 
after uninstalling the program.  That's 4 snapshots minimum, and 4 
times I would have to do all that manual comparing along with manual 
logging of what I found.  While I could manually log all those 
changes, having to then compare between, say, the pre-install state to 
the after first-run state (to see what the program changed) or 
pre-install state to the after-UNinstall state (to see what garbage 
gets left behind) is still more manual effort to generate logs of 
those differences.

> Those registry files are hardly unreadable. You can mount/open them 
> using
> regedit. It's a real copy of the registry with any/all
> modifications/additions made since the execution of the sandboxed
> program.

When I attempt to open the RegHive file (outside the sandbox), a 
message pops up saying that contents of this file will get "added" to 
my current registry.  The popup is unclear if this means a separate 
hive load will occur or if it is like importing a .reg file that would 
merge its contents into my registry.  Instead I open regedit and then 
use the File -> Load Hive function.  So now I get to see those 
registry entries.  The user has to be careful how to look at RegHive.

Thanks for that tip about using regedit.  I didn't know what the 
RegHive file was for since the help for Sandboxie is not searchable 
(its a web site rather than a local help file with search capability). 
Of course, we're back to performing a manual comparison and with no 
logging.

> Everything you ask and more is available to you via sandboxie. Your
> failure to understand what your doing with the provided information
> doesn't change that. :)

Available is not the same as easy (or fast).  I've seen plenty of 
programmers that think a workaround is a reasonable solution. 
Workarounds are not substitutes for ease-of-use features. 
InstallWatch or several of the uninstall tools that take snapshots and 
provide the comparisons between them along with logging is certainly 
easier than manually digging around to generate the same info and also 
log it.

If I didn't have a dishwasher, yes, then I would have to do the dishes 
by hand.  So washing was "available".  But I do have a dishwasher so I 
use it to facilitate accomplishing the same task.  I use InstallWatch 
or other tools to tell me the differences between one, or more, 
snapshots so that I don't have to manually perform the "available" 
methods (plus I get logging rather than doing it through "available" 
manual means).

However, thanks for the info regarding how Sandboxie retains info on 
the *current* state of its sandbox.  I've only begun using Sandboxie a 
little while ago and haven't had time to dig down into it, but then 
most of my trialing and snapshot logging has been done using VMWare 
even though Sandboxie was installed at the time.  It's a pity the help 
is on a web site rather than in a searchable help file.  A lot of time 
can be wasted trying to dig around through web or wiki pages trying to 
find a topic only to find it isn't discussed or you merely missed 
finding it.