diff --git a/pafish/gensandbox.c b/pafish/gensandbox.c index 8b4e3e0..4efee78 100644 --- a/pafish/gensandbox.c +++ b/pafish/gensandbox.c @@ -12,6 +12,11 @@ #include "gensandbox.h" #include "utils.h" +/** + * Prototype for IsNativeVhdBoot, which is only available in >= Windows 8 + */ +typedef BOOL (WINAPI * IsNativeVhdBoot) (BOOL *); + int gensandbox_mouse_act() { POINT position1, position2; GetCursorPos(&position1); @@ -164,3 +169,13 @@ int gensandbox_uptime() { return GetTickCount() < 0xAFE74 ? TRUE : FALSE; } +int gensandbox_IsNativeVhdBoot() { + BOOL isnative = FALSE; + IsNativeVhdBoot fnnative = (IsNativeVhdBoot) GetProcAddress( + GetModuleHandleA("kernel32"), "IsNativeVhdBoot"); + /* IsNativeVhdBoot always returns 1 on query success */ + if (fnnative) + fnnative(&isnative); + return (isnative) ? TRUE : FALSE; +} + diff --git a/pafish/gensandbox.h b/pafish/gensandbox.h index 0a8f27b..2128f0d 100644 --- a/pafish/gensandbox.h +++ b/pafish/gensandbox.h @@ -24,4 +24,6 @@ int gensandbox_less_than_onegb(); int gensandbox_uptime(); +int gensandbox_IsNativeVhdBoot(); + #endif diff --git a/pafish/main.c b/pafish/main.c index bcb8c2f..c92b359 100644 --- a/pafish/main.c +++ b/pafish/main.c @@ -146,6 +146,10 @@ int main(void) &gensandbox_uptime, "Sandbox traced by checking operating system uptime using GetTickCount()", "hi_sandbox_uptime"); + exec_check("Checking if operating system IsNativeVhdBoot()", + &gensandbox_IsNativeVhdBoot, + "Sandbox traced by checking IsNativeVhdBoot()", + "hi_sandbox_IsNativeVhdBoot"); /* Hooks detection tricks */ print_check_group("Hooks detection");