[Bug] WarFault.exe errors for all applications on the latest Win11 ARM

[ZaberKo]

Describe what you noticed and did

After upgrading to the lastest Win11 ARM, All sandboxie box cannot open any application anymore. WarFault.exe is raised after running any application, even by right-clicking "Run Program", then it immediately quits. And I cannot get any trace or mem_dump info. I can confirm only the latest system upgrade cause this issue through disk-level snapshot (I use VM).

I think maybe microsoft upgrades their APIs that break some dependencies to sandboxie. Any ideas?

System Info:

Edition Windows 11 IoT Enterprise LTSC
Version 24H2
OS build 26100.2454
Experience Windows Feature Experience Pack 1000.26100.36.0

PS: I use a fresh installed Windows VM on MacOS through Parallel Desktop.

How often did you encounter it so far?

Always after upgrade.

Expected behavior

Normally open any application in boxes of sandboxie just like what it is before the windows upgrade.

Affected program

All

Download link

Not available

Where is the program located?

Not relevant to my request.

Did the program or any related process close unexpectedly?

Yes, it did, but no .dmp file has been created in the system.

Crash dump

Not available

What version of Sandboxie are you running now?

Sandboxie Plus 1.15.3 64-bit (ARM64)

Is it a new installation of Sandboxie?

I recently did a new clean installation.

Is it a regression from previous versions?

No

In which sandbox type you have this problem?

All sandbox types (I tried them all).

Can you reproduce this problem on a new empty sandbox?

I can confirm it also on a new empty sandbox.

What is your Windows edition and version?

Windows 11 IoT Enterprise LTSC 24H2 (ARM64)

In which Windows account you have this problem?

Not relevant to my request.

Please mention any installed security software

Microsoft Defender

Did you previously enable some security policy settings outside Sandboxie?

No

Trace log

No response

Sandboxie.ini configuration

No response

[ZaberKo]

A screenshot:

[7qCyZyMs]

In fact, the issue you mentioned has been present on the ARM64 platform for over ten months. When the Windows Insider Preview reached the 26xxx GE release, this problem was already existing. Under any configuration, the sandbox exhibits the symptoms shown in your image and fails to start successfully.

Interestingly, on Windows Server ARM build 26334, you can run the sandbox normally just like on x86_64. However, I am not sure whether Sandboxie support is still maintained after it moved to version 27xxx.

I believe the Sandboxie maintainers should set up an accessible ARM64 machine, which doesn’t need to have high performance—a Raspberry Pi 5 would suffice—to test the impact of the latest Windows on ARM translation mechanisms on the code.

[DavidXanatos]

I'll look into this issue soon, I have ordered one of the new Qualcom laptops for that purpose,
last time I checked WoR only supported older windows 11 versions so a Pi seams useless here.

[7qCyZyMs]

我很快就会解决这个问题，为此我已经订购了一台新的 Qualcom 笔记本电脑，上次我检查 WoR 仅支持较旧的 Windows 11 版本，因此 Pi 接缝在这里毫无用处。

You can use a hexadecimal editor to modify the contents of WoR.exe at offset 0x00010DF8:
Before --- 20 4B 62 00 00
After ----- 20 FF FF FF 7F
This way, you can bypass the restriction that only supports Windows build 25163 and enter the Canary Insider to receive updates. However, due to the requirement for the ARMv8.1 instruction set, you must use a Pi 5.

[DavidXanatos]

where to get "Windows Server ARM" version?

[7qCyZyMs]

从哪里获取“Windows Server ARM”版本？

https://uupdump.net/selectedition.php?id=738f71e0-a8bf-40f5-a5a0-971e2fcc176a&pack=en-us

[DavidXanatos]

This way, you can bypass the restriction that only supports Windows build 25163 and enter the Canary Insider to receive updates. However, due to the requirement for the ARMv8.1 instruction set, you must use a Pi 5.

I have a Pi 5 so I'll try but my experience with the pi4 and the older builds were everything but great, so I'm eagerly awaiting the new Hardware and with 32GB ram I can properly run test VMs on an arm system that will be a great development aid.

EDIT: my bad just an other pi 4, so i have no pi 5 yet and now i also remember why I don't want to buy a pi for windows with less then 16GB ram, so I'll have to look into the Pi 5 compute module as they come with up to 16 GB if I want one, but IMHO that's not needed now as the Qualcom based laptop is on its way with even more RAM.