diff --git a/pafish/gensandbox.c b/pafish/gensandbox.c index 696b6e4..a5bb73a 100644 --- a/pafish/gensandbox.c +++ b/pafish/gensandbox.c @@ -82,3 +82,24 @@ int gensandbox_drive_size() { } return 1; } + + +int gensandbox_drive_size2() { + ULARGE_INTEGER bytes_available; + ULARGE_INTEGER total_bytes; + ULARGE_INTEGER total_number_free_bytes; + + if (GetDiskFreeSpaceExA("C:\\", &bytes_available, &total_bytes, &total_number_free_bytes)) + { + if (bytes_available.QuadPart / 1073741824 <= 60) { /* <= 60 GB */ + return 0; + } + if (total_bytes.QuadPart / 1073741824 <= 60) { /* <= 60 GB */ + return 0; + } + if (total_number_free_bytes.QuadPart / 1073741824 <= 60) { /* <= 60 GB */ + return 0; + } + } + return 1; +} diff --git a/pafish/gensandbox.h b/pafish/gensandbox.h index f41a382..df1197b 100644 --- a/pafish/gensandbox.h +++ b/pafish/gensandbox.h @@ -10,4 +10,6 @@ int gensandbox_path(); int gensandbox_drive_size(); +int gensandbox_drive_size2(); + #endif diff --git a/pafish/main.c b/pafish/main.c index 171e0bf..95d608b 100644 --- a/pafish/main.c +++ b/pafish/main.c @@ -113,6 +113,16 @@ int main(int argc, char *argv[]) else { print_not_traced(); } + + printf("[*] Checking if disk size by GetDiskFreeSpace <= 60GB ... "); + if (gensandbox_drive_size2() == 0) { + print_traced(); + write_log("Sandbox traced by checking disk size GetDiskFreeSpace <= 60GB"); + write_trace("hi_sandbox_drive_size_2"); + } + else { + print_not_traced(); + } /* Hooks detection tricks */ printf("\n[-] Hooks detection\n");