Changelog
Added

Sandboxie now applies by default "Close...=!,..." directives to non-excluded images if they are located in a sandbox
-- added 'AlwaysCloseForBoxed=n' to disable this behaviour as it may not be always desired, and it doesn't provide extra security
added process image information to Sandman UI
localized template categories in the Plus UI
added "DisableResourceMonitor=y" to disable resource access monitor for selected boxes
added option to show trace entries only for the selected sandbox
added "UseVolumeSerialNumbers=y" that allows drive letters to be suffixed with the volume SN in the \drive\ sandbox location
-- it helps to avoid files mixed together on multiple pendrives using the same letter
-- note: this option is not compatible with the recovery function of the Classic UI, only SandMan UI is fully compatible

Changed

portable cleanup message now has y/n/c options
consolidated Proc_CreateProcessInternalW and Proc_CreateProcessInternalW_RS5 to remove duplicate code
the ElevateCreateProcess fix, as sometimes applied by the Program Compatibility Assistant, will no longer be emulated by default
-- use 'ApplyElevateCreateProcessFix=y' or 'ApplyElevateCreateProcessFix=program.exe,y' to enable it
trace log gets disabled only when it has no entries and the logging is stopped

Fixed

fixed APC issue with the new global hook emulation mechanism and WoW64 processes
fixed IPv6 issues with BlockPort options
fixed an issue with CheatEngine when "OpenWinClass=*" was specified
fixed memory corruption in SbieDrv
fixed crash issue with process elevation on CreateProcess calls
fixed process elevation when running in the built-in administrator account
fixed template preview resetting unsaved entries in box options window
fixed an issue with driver verifier and user handles
fixed driver memory leak of FLT_FILE_NAME_INFORMATION objects
fixed broken clipboard introduced in 5.50.0
fixed dcom launch issue on windows 7 32 bit introduced in 5.50.0
properly fixed an issue with Driver Verifier and user handles
fixed an issue with CreateWindow function introduced with 0.8.0
fixed issue with outdated BoxDisplayOrder entries being retained

Added

added Privacy enhanced mode, sandboxes with "UsePrivacyMode=y" will not allow read access to locations containing user data
-- all locations except generic Windows system paths will need to be opened explicitly for read and/or write access
-- using "NormalFilePath=...", "NormalKeyPath=...", "NormalIpcPath=..." allows to open locations to be readable and sandboxed

added new "App Compartment" mode of operation, it's enabled by adding "NoSecurityIsolation=y" to the box configuration
-- in this mode, security is traded in for compatibility, it should not be used for untrusted applications
-- note: in this mode, file and registry filtering are still in place, hence processes run without administrative privileges
-- it is reasonably safe, all filtering can be disabled with "NoSecurityFiltering=y"

added experimental use of ObRegisterCallbacks to filter object creation and duplication
-- this filtering is independent from the regular SbieDrv's syscall-based filtering, hence it also applies to App Compartments
-- with it enabled, an application running in a compartment will not be able to manipulate processes running outside the sandbox
-- Note: this feature improves the security of unisolated App Compartment boxes
-- to enable this feature, set "EnableObjectFiltering=y" in the global section and reload the driver
-- when globally activated, the filtering can be disabled for individual boxes with "DisableObjectFilter=y"

added "DontOpenForBoxed=n", this option disables the discrimination of boxed processes for open file and open key directives
-- this behaviour does not really improve security anyways, but may be annoying, also app compartments always disable this

added setting to entirely open access to the COM infrastructure

Changed

reworked the resource access path matching mechanism to optionally apply more specific rules over less specific ones
-- for example "OpenFilePath=C:\User\Me\AppData\Firefox takes precedence over "WriteFilePath=C:\User\Me"
-- to enable this new behaviour, add "UseRuleSpecificity=y" to your Sandboxie.ini, this behaviour is always enabled in Privacy enhanced mode
-- added "NormalFilePath=..." to restore default Sandboxie behaviour on a given path
-- added "OpenConfPath=...", which similarly to "OpenPipePath=..." is a "OpenKeyPath=..." variant which applies to executables located in the sandbox
removed option to copy a box during creation, instead the box context menu offers a duplication option
reworked the box creation dialog to offer new box types

Fixed

fixed SBIE1401 notification during Sandboxie Plus uninstall (by mpheath) 68fa37d
fixed memory leak in driver handling FLT_FILE_NAME_INFORMATION (by Therzok) #1371