Fix container code

windows_sandbox/build.gradle.kts

@@ -47,6 +47,7 @@ project.afterEvaluate {
             compilerArgs.add("/wd4068")
             compilerArgs.add("/std:c++17")
             compilerArgs.add("/EHa")
+            compilerArgs.add("/fsanitize=address")
         }
     }
     val linkRelease: AbstractLinkTask by tasks

windows_sandbox/src/main/cpp/ContainerCreate.cpp

@@ -9,6 +9,9 @@
 #include "ContainerCreate.h"
 #include <algorithm>
 
+#ifndef DEBUG
+inline
+#endif
 void debug(...) {
 #ifdef DEBUG
     va_list args;
@@ -25,16 +28,15 @@ void debug(...) {
 WELL_KNOWN_SID_TYPE app_capabilities[] = {
         WinCapabilityInternetClientSid,
         WinCapabilityInternetClientServerSid, // allow both connection and binding to ports
-        /**
+        /*
          * binding to ports is allowed even though it might present a risk because it is useful for ipc, and additionally
          * blocking binding to ports presents no security benefit because reverse shells-type connections still work,
          * additionally it wouldn't help prevent c2s from causing problems on machines because c2s would not be able to
          * do much because it is sandboxed
          */
         WinCapabilityPrivateNetworkClientServerSid, // this is needed when the user is connected to a VPN which
                                                     // routes traffic through a local ip address.
-        // TODO: investigate removing this capability conditionally
-
+                                                    // it may also be needed in order to connect to local minecraft servers
 };
 WCHAR container_desc[] = L"Sandboxing Minecraft";
 
@@ -63,14 +65,14 @@ WCHAR* createContainerName(WCHAR *base_container_name, LPWSTR *rwMounts, LPWSTR
     uint64_t hash = 0xcbf29ce484222325;
     for (int i = 0; i < rwMountsCount; ++i) {
         size_t strlen = wcslen(rwMounts[i]);
-        for (size_t j = 0; j < strlen; j++) {
+        for (size_t j = 0; j < strlen; ++j) {
             hash *= 0x100000001b3;
             hash ^= rwMounts[i][j];
         }
     }
     for (int i = 0; i < roMountsCount; ++i) {
         size_t strlen = wcslen(roMounts[i]);
-        for (size_t j = 0; j < strlen; j++) {
+        for (size_t j = 0; j < strlen; ++j) {
             hash *= 0x100000001b3;
             hash ^= roMounts[i][j];
         }
@@ -126,11 +128,11 @@ BOOL RunExecutableInContainer(LPWSTR command_line, LPWSTR *rwMounts, LPWSTR *roM
         }
 
         for (int i = 0; i < rwMountsCount; i++) {
-            GrantNamedObjectAccess(sid, rwMounts[i], SE_FILE_OBJECT, FILE_ALL_ACCESS | FILE_LIST_DIRECTORY);
+            GrantNamedObjectAccess(sid, rwMounts[i], SE_FILE_OBJECT, STANDARD_RIGHTS_ALL | FILE_ALL_ACCESS | FILE_LIST_DIRECTORY);
         }
 
         for (int i = 0; i < roMountsCount; i++) {
-            GrantNamedObjectAccess(sid, roMounts[i], SE_FILE_OBJECT, GENERIC_READ);
+            GrantNamedObjectAccess(sid, roMounts[i], SE_FILE_OBJECT, GENERIC_READ | FILE_EXECUTE);
         }
 
         InitializeProcThreadAttributeList(nullptr, 1, 0, &attribute_size);
@@ -238,7 +240,7 @@ BOOL GrantNamedObjectAccess(PSID appcontainer_sid, LPWSTR object_name, SE_OBJECT
     BOOL success = FALSE;
 
     do {
-        explicit_access.grfAccessMode = GRANT_ACCESS;
+        explicit_access.grfAccessMode = SET_ACCESS;
         explicit_access.grfAccessPermissions = access_mask;
         explicit_access.grfInheritance = OBJECT_INHERIT_ACE | CONTAINER_INHERIT_ACE;
 
@@ -273,9 +275,6 @@ BOOL GrantNamedObjectAccess(PSID appcontainer_sid, LPWSTR object_name, SE_OBJECT
 
     } while (FALSE);
 
-    if (original_acl)
-        LocalFree(original_acl);
-
     if (new_acl)
         LocalFree(new_acl);
 

windows_sandbox/src/main/cpp/gq_malwarefight_nosession_win_WindowsSandbox.cpp

@@ -27,13 +27,13 @@ LPWSTR objectArrayToLPWSTR(JNIEnv *env, jobjectArray args) {
     }
 
     auto string = static_cast<LPWSTR>(malloc(sizeof(WCHAR) * to_allocate));
-    ZeroMemory(&string, sizeof(WCHAR) * to_allocate);
+    ZeroMemory(&string[0], sizeof(WCHAR) * to_allocate);
 
     size_t index = 0;
     for (jsize i = 0; i < env->GetArrayLength(args); i++) {
         auto jstring_element = static_cast<jstring>(env->GetObjectArrayElement(args, i));
         auto chars = env->GetStringChars(jstring_element, nullptr);
-        for (jsize j = 0; j < env->GetStringLength(jstring_element); i++) {
+        for (jsize j = 0; j < env->GetStringLength(jstring_element); j++) {
             string[index] = chars[j];
             index++;
         }
@@ -47,12 +47,13 @@ LPWSTR objectArrayToLPWSTR(JNIEnv *env, jobjectArray args) {
 
 LPWSTR* objectArrayToLPWSTRArray(JNIEnv *env, jobjectArray array) {
     auto newArray = static_cast<LPWSTR *>(malloc(sizeof(LPWSTR) * env->GetArrayLength(array)));
-    ZeroMemory(&newArray, sizeof(LPWSTR) * env->GetArrayLength(array));
+    ZeroMemory(&newArray[0], sizeof(LPWSTR) * env->GetArrayLength(array));
     for (jsize i = 0; i < env->GetArrayLength(array); i++) {
         auto jstring_element = static_cast<jstring>(env->GetObjectArrayElement(array, i));
         auto chars = env->GetStringChars(jstring_element, nullptr);
-        newArray[i] = static_cast<LPWSTR>(malloc(sizeof(WCHAR) * env->GetStringLength(jstring_element)));
-        for (jsize j = 0; j < env->GetStringLength(jstring_element); i++) {
+        newArray[i] = static_cast<LPWSTR>(malloc(sizeof(WCHAR) * env->GetStringLength(jstring_element) + sizeof(WCHAR)));
+        ZeroMemory(&newArray[i][0], sizeof(WCHAR) * env->GetStringLength(jstring_element) + sizeof(WCHAR));
+        for (jsize j = 0; j < env->GetStringLength(jstring_element); j++) {
             newArray[i][j] = chars[j];
         }
     }
@@ -65,10 +66,10 @@ extern "C" {
 
 /*
  * Class:     gq_malwarefight_nosession_win_WindowsSandbox
- * Method:    runSandboxed
+ * Method:    runProcess
  * Signature: ([Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/String;)Z
  */
-JNIEXPORT jboolean JNICALL Java_gq_malwarefight_nosession_win_WindowsSandbox_runSandboxed
+JNIEXPORT jboolean JNICALL Java_gq_malwarefight_nosession_win_WindowsSandbox_runProcess
         (JNIEnv *env, jclass, jobjectArray rwMounts, jobjectArray roMounts, jobjectArray args) {
     auto lpw_args = objectArrayToLPWSTR(env, args);
     auto lpw_rwMounts = objectArrayToLPWSTRArray(env, rwMounts);