Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
#include <windows.h>
#include <stdio.h>
typedef enum _STORAGE_QUERY_TYPE {PropertyStandardQuery = 0,PropertyExistsQuery,PropertyMaskQuery,PropertyQueryMaxDefined} STORAGE_QUERY_TYPE, *PSTORAGE_QUERY_TYPE;
typedef enum _STORAGE_PROPERTY_ID {StorageDeviceProperty = 0,StorageAdapterProperty} STORAGE_PROPERTY_ID, *PSTORAGE_PROPERTY_ID;
typedef struct _STORAGE_PROPERTY_QUERY {
STORAGE_PROPERTY_ID PropertyId;
STORAGE_QUERY_TYPE QueryType;
UCHAR AdditionalParameters[1];
} STORAGE_PROPERTY_QUERY, *PSTORAGE_PROPERTY_QUERY;
typedef struct _STORAGE_DEVICE_DESCRIPTOR {
ULONG Version;
ULONG Size;
UCHAR DeviceType;
UCHAR DeviceTypeModifier;
BOOLEAN RemovableMedia;
BOOLEAN CommandQueueing;
ULONG VendorIdOffset;
ULONG ProductIdOffset;
} STORAGE_DEVICE_DESCRIPTOR, *PSTORAGE_DEVICE_DESCRIPTOR;
#define IOCTL_STORAGE_QUERY_PROPERTY CTL_CODE(IOCTL_STORAGE_BASE, 0x0500, METHOD_BUFFERED, FILE_ANY_ACCESS)
bool IsSandboxed()
{
HANDLE hPhysicalDriveIOCTL = 0;
int j = 0,k = 0;
char szModel[128],szBuffer[128];
char *szDrives[] = {
"qemu",
"virtual",
"vmware",
NULL
};
hPhysicalDriveIOCTL = CreateFile ("\\\\.\\PhysicalDrive0", 0,FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,OPEN_EXISTING, 0, NULL);
if (hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
{
STORAGE_PROPERTY_QUERY query;
DWORD cbBytesReturned = 0;
memset ((void *) & query, 0, sizeof (query));
query.PropertyId = StorageDeviceProperty;
memset (szBuffer, 0, sizeof (szBuffer));
memset (szModel, 0, sizeof (szModel));
if (DeviceIoControl(hPhysicalDriveIOCTL, IOCTL_STORAGE_QUERY_PROPERTY,& query,sizeof (query),& szBuffer,sizeof (szBuffer),& cbBytesReturned, NULL)){
STORAGE_DEVICE_DESCRIPTOR *descrip = (STORAGE_DEVICE_DESCRIPTOR*)&szBuffer;
int pos = descrip->ProductIdOffset;
int m = 0;
for(int g = pos;szBuffer[g] != '\0';g++){
szModel[m++] = szBuffer[g];
}
CharLowerBuff(szModel,strlen(szModel));
for (int i = 0; i < (sizeof(szDrives)/sizeof(LPSTR)) - 1; i++ ) {
if (szDrives[i][0] != 0) {
if(strstr(szModel,szDrives[i]))
return TRUE;
}
}
}
CloseHandle (hPhysicalDriveIOCTL);
}
return FALSE;
}
int main(void) {
if(IsSandboxed()) {
printf("Hmm.. i don't think i want to be here... :(\n");
ExitProcess(1);
} else {
//evil code
}
system("pause");
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment