File Corrupted! This Program Has Been Manipulated

[kimpurcell]

Describe the bug
Running certain executables within a NiceHash sandbox causes the executable to fail with the message:
"File corrupted! This program has been manipulated and maybe it's infected by a Virus or cracked. This file won't work anymore."

Specific executable to test with: https://github.com/NebuTech/NBMiner/releases/download/v39.0/NBMiner_39.0_Win.zip

To Reproduce
Steps to reproduce the behavior:

1. Download NBMiner: https://github.com/NebuTech/NBMiner/releases/download/v39.0/NBMiner_39.0_Win.zip
2. Extract
3. Run a hardened Sandboxie command line.
4. Execute the NBMiner.exe file within Sandboxie.

Expected behavior
A clear and concise description of what you expected to happen.
Running this outside of the Sandbox does not throw the error.

Screenshots
If applicable, add screenshots to help explain your problem.

System details and installed software (please provide the following information):

• What is your Windows edition and version? (i.e. Windows 10 Pro 20H2).
  Windows 10 Pro 20H2
• What is your current Sandboxie edition and version? (i.e. Sandboxie Plus 0.7.2).
  Sandboxie Plus 0.9.3
• Please mention in which version this bug got introduced, because it acts as a guide for testers and developers.
  All versions
• Please mention any security software running in the background, even if the real-time protection is disabled.
  None

Additional context
Add any other context about the problem here.

Sandboxie configuration
If applicable, consider to attach your sandboxie.ini configuration by copying the content at https://gist.github.com and sharing the resulting link here. If you decide to paste the configuration directly here, make sure to use the backticks around strings, like in this working example:

My initial sandboxie.ini settings

[GlobalSettings]

FileRootPath=??%SystemDrive%\Sandbox%USER%%SANDBOX%
SeparateUserFolders=y
KeyRootPath=\REGISTRY\USER\Sandbox_%USER%%SANDBOX%
IpcRootPath=\Sandbox%USER%%SANDBOX%\Session%SESSION%
NetworkEnableWFP=n
EditAdminOnly=n
ForceDisableAdminOnly=n
ForgetPassword=n
Template=WindowsRasMan
Template=WindowsLive
Template=RpcPortBindings
Template=OfficeLicensing
Template=OfficeClickToRun

[UserSettings_0820019F]

SbieCtrl_AutoStartAgent=SandMan.exe
SbieCtrl_EnableAutoStart=y

[NiceHash]

Enabled=y
AutoRecover=n
BlockNetworkFiles=y
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Desktop%
BorderColor=#00FFFF,ttl
Template=OpenBluetooth
Template=SkipHook
Template=FileCopy
Template=qWave
Template=BlockPorts
Template=LingerPrograms
Template=Chrome_Phishing_DirectAccess
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
ConfigLevel=9
DropAdminRights=y
ClosePrintSpooler=y
ClosedFilePath=E:
ClosedFilePath=,InternetAccessDevices

[DavidXanatos]

please see #1120 this error is apparently generated by some 3rd party exe packer/protector on purpose i.e. som sort of DRM software.

I will not waste my limited spare time in getting adversarial DRM contaminated programs to be compatible with sandboxie!
The file is deemed corrupted because the DRM code examinations the image in memory which is altered by various code hooks sandboxie needs to operate.

If you desperately need that to work I can take a look at a rate of 500€/hour with no guarantees of success.

[isaak654]

See also #1034 (comment)

[bastik-1001]

As the software you are trying to use is open-source it should be possible to build a version without this check.

My guess is that it is just in place to prevent malicious tampering with the file.

[kimpurcell]

As the software you are trying to use is open-source it should be possible to build a version without this check.

My guess is that it is just in place to prevent malicious tampering with the file.

Unfortunately, there's no source code actually. I unzipped their source file and just found some readme files. Kinda sus if you ask me.

Here's the link: https://github.com/NebuTech/NBMiner/releases/tag/v39.0

Source: https://github.com/NebuTech/NBMiner/archive/refs/tags/v39.0.zip