[Reopen] BSOD of AIS Sandbox

[pk]

You said I need to install CTM in all installed OSes. Since my PC has about 10 different OS configurations, I tested CTM only under VMWare.

[Lisandro]

Thanks.
Seems that changes in the beta changed the behavior (conflicting)... Who knows...
I'll post elsewhere the problems I'm facing sandboxing Firefox.

[Lisandro]

Seems that changes in the beta changed the behavior (conflicting)... Who knows...

No. It's not. My computer BSODed again.
aswSnx.sys
0x00000050 (0xCAADC70C, 0x00000000, 0x8BAD052A, 0x00000000).
Seems I need to wait for the next CTM version (middle of September) to test avast sandbox again.

[pk]

0x00000050 (0xCAADC70C, 0x00000000, 0x8BAD052A, 0x00000000)

please send me your aswSnx.sys driver, I'll follow the numbers to find the location...
do you have GMER on your computer? please run it (or download here: http://www.gmer.net/#files), go to Modules tab, find aswSnx.sys and copy&paste its memory address, thanks

Seems I need to wait for the next CTM version (middle of September) to test avast sandbox again.

how come?

[Lisandro]

please send me your aswSnx.sys driver, I'll follow the numbers to find the location...
do you have GMER on your computer? please run it (or download here: http://www.gmer.net/#files), go to Modules tab, find aswSnx.sys and copy&paste its memory address, thanks

pk, I'll be traveling 5 days and will have very little connection.
I'll send it to you but, you know, it will be difficult to continue testing these days. Sorry.

[Lisandro]

This BSOD come again...
COMODO DID NOT SOLVE IT AS THEY HAVE PROMISSED 
https://forums.comodo.com/bug-reports-ctm/ctmfltsys-bsods-0x000000f7-with-175-beta-t58907.0.html;msg427463#msg427463

0x00000050 (0xC9190634, 0x00000000, 0x8FE28EF9, 0x00000000)
aswSnx.sys
PAGE_FAULT_IN_NONPAGED_AREA

Is there anything you can do for me pk?

[pk]

Is there anything you can do for me pk?

sure, send me your aswSnx.sys driver and run gmer.exe (http://www.gmer.net/#files), go to Modules tab, find aswSnx.sys and tell me its Address value

[Lisandro]

sure, send me your aswSnx.sys driver and run gmer.exe (http://www.gmer.net/#files), go to Modules tab, find aswSnx.sys and tell me its Address value

Well, it does not BSODed yet, so I can get this information. I'll keep the computer on and test.
The aswSnx.sys address is: 8BCBB000 and size: 364544
I'll send the file by email for you. By the way, why is it different from the file you can get installing AIS in your computer?

[Lisandro]

I can reproduce the BSOD with easy.
It always occur when I try to attach a file (screenshot .png file) to the forums while Firefox is sandboxed.
When I try to upload the file, immediately, the computer BSODs.

8BCC6EF9 base at 8BCBB000 DateStamp 4C865205
0x00000050 (0xD2526024, 0x00000000, 0x8BCC6EF9, 0x00000000)
aswSnx.sys
PAGE_FAULT_IN_NONPAGED_AREA

[pk]

Thanks for the file and address - I was able to find the source line where it crashed; it seems our driver deceived invalid filename request, it should be fixed now.

By the way, why is it different from the file you can get installing AIS in your computer?

I use internal avast build, which is usually newer than the official build => BSOD address doesn't match in it.

[Lisandro]

Thanks for the file and address - I was able to find the source line where it crashed; it seems our driver deceived invalid filename request, it should be fixed now.

Many thanks!
Can you give me a new version (internal) of this specific file?
Can I overwrite the one in my computer? Will it pass the check?

[Lisandro]

Can you give me a new version (internal) of this specific file?
Can I overwrite the one in my computer? Will it pass the check?

pk

[Lisandro]

pk, right now, when I try to access the sandbox expert settings, the computer bsods.
I can't further test it.
Can you give me an updated driver?

[Lisandro]

pk... I'm not able to use/test the sandbox...

[pk]

Hello,

sorry for delay, we (pk/vlk/lukor) are currently out of office.

please download new internal aswSnx version:
x86: http://public.avast.com/~kurtin/snx/01/x86/aswSnx.sys
x64: http://public.avast.com/~kurtin/snx/01/x64/aswSnx.sys

copy them into \Windows\System32\drivers and reboot.
To check if the driver was loaded correctly, execute cmd.exe and type: fltmc and aswSnx must be listed.
If you don't have right-click context menu, then driver isn't loaded or GUI wasn't able to connect with the driver.

New aswSnx.sys driver converts your snx_lconfig.xml file to the format (e.g. all file paths are converted into \??\Volume{xx} guid form). So, if you want to downgrade to old avast version, just delete that file from avast data folder, because old version wouldn't recognize that file format.

If you get BSOD, just write me BSOD numbers - I'll be able to find the problematic code without dump.