Skip to content

SBIE2328

Message SBIE2328 Failed to resolve chrome sandbox hook %2

Severity: Error (popup)

Note

In some builds the explicit SBIE2328 popup is disabled in the hook installer. In that case the unresolved hook is recorded in the hook monitor / trace output (the monitor message includes "Chrome Hook Unresolved") and in hook statistics rather than showing a user-facing popup. If you do not see a popup, check the Monitor/Trace output, the resource/monitor windows in Sandboxie Manager, or enable API/hook tracing to collect diagnostic details.12

Description

This message indicates that Sandboxie's DLL hook code attempted to detect or follow a browser (Chromium/Chrome-derived or Firefox) runtime hook but was unable to resolve the target address. The message includes the name of the function it tried to resolve.

Sandboxie contains heuristic logic that recognises the way some browsers install an in-process hook (a small trampoline that jumps to a table of function pointers). When the pattern is recognised, Sandboxie will try to locate the real target function and hook it instead of the small trampoline. If that resolution fails, SBIE2328 is raised.1

Typical Causes

  • The browser or target module changed its internal code layout (new version), so the heuristic no longer finds the expected instruction pattern.1
  • The target module is packed, obfuscated, or compiled with a different toolchain, preventing recognition of the expected pattern.
  • The detected trampoline points at data or code that is not reachable or not in the expected format (for example, a different calling convention or relocated data).
  • A platform/architecture difference (x86 vs x64 vs ARM) where available heuristics do not cover the observed pattern.3

Suggested Actions

  1. Update Sandboxie to the latest release. Hook heuristics are occasionally updated to match browser changes.3
  2. If the issue occurs only for a specific browser version or vendor (Chrome, Vivaldi, some Firefox builds), test with a different browser build or disable Sandboxie hook tracing for that module.
  3. If you need to avoid the failure temporarily, configure the process or function to be skipped by the hook system using the FuncSkipHook or SkipHook settings (see advanced configuration). This prevents Sandboxie from attempting the Chrome-specific resolution for that function.
  4. Collect diagnostic information (module name, function name, process image) and open an issue with Sandboxie maintainers so they can adjust the heuristic or add explicit support for the new browser layout.
  • SBIE2303 — Generic hook error used for a variety of hook failures.
  • SBIE2329 — Failed to find a Fast-Forward Sequence (FFS) target or other hook-related resolution problems.
  • FuncSkipHook - Function-level setting: a list of API function names that Sandboxie should not attempt to hook. When a function matches an entry here the hook installer skips it.
  • SkipHook - Module/hook-name level setting: comma-separated module or image names and hook identifiers used to skip hooking for specific modules. This is consulted by callers that check Dll_SkipHook and prevents module-specific hooks where honored (note: not every hook-install path necessarily queries this setting).

Implementation Notes and Footnotes

Technical details below are intended for maintainers and advanced users who want to trace how the message can be generated. Exact line numbers are intentionally omitted.

  1. The hook-resolution logic is implemented in common/hook_util.c in the function Hook_CheckChromeHook(...). This code scans the machine instructions of the suspected trampoline and attempts to locate a table or pointer to the real target (separate logic exists for x86, x64 and ARM variants). If the pattern matching finds nothing usable it returns a special failure value which indicates the unresolved state. ↩↩↩

  2. In core/dll/dllhook.c, Sandboxie's hook installer calls Hook_CheckChromeHook(...). If the helper returns the special failure value, the code marks the hook with a CHROME_FAIL status and may emit SBIE2328 (the code path for this message is present beside the CHROME resolution logic). The hook code also records hook statistics (HOOK_STAT_CHROME_FAIL) to aid diagnostics. ↩

  3. The heuristics cover multiple browsers (Chrome, Chromium derivatives, and some Firefox/launcher variants) and multiple architectures; when browsers change their build toolchain or internal layout this logic requires updates. Providing the module image and function name helps maintainers reproduce and update the detection code. ↩↩