From f4dc13aec8c980df2c2ce8ca8389339238d5c216 Mon Sep 17 00:00:00 2001
From: Thorsten Sick <thorsten.sick@avira.com>
Date: Tue, 15 Jul 2014 13:47:51 +0200
Subject: [PATCH] Added GetDiskFreeSpace based disk space detection with the
 min size 60 GB

---
 pafish/gensandbox.c | 21 +++++++++++++++++++++
 pafish/gensandbox.h |  2 ++
 pafish/main.c       | 10 ++++++++++
 3 files changed, 33 insertions(+)

diff --git a/pafish/gensandbox.c b/pafish/gensandbox.c
index 696b6e4..a5bb73a 100644
--- a/pafish/gensandbox.c
+++ b/pafish/gensandbox.c
@@ -82,3 +82,24 @@ int gensandbox_drive_size() {
     }
     return 1;
 }
+
+
+int gensandbox_drive_size2() {
+    ULARGE_INTEGER bytes_available;
+    ULARGE_INTEGER total_bytes;
+    ULARGE_INTEGER total_number_free_bytes;
+
+    if (GetDiskFreeSpaceExA("C:\\", &bytes_available, &total_bytes, &total_number_free_bytes))
+    {
+        if (bytes_available.QuadPart / 1073741824 <= 60) { /* <= 60 GB */
+            return 0;
+        }
+        if (total_bytes.QuadPart / 1073741824 <= 60) { /* <= 60 GB */
+            return 0;
+        }
+        if (total_number_free_bytes.QuadPart / 1073741824 <= 60) { /* <= 60 GB */
+            return 0;
+        }
+    }
+    return 1;
+}
diff --git a/pafish/gensandbox.h b/pafish/gensandbox.h
index f41a382..df1197b 100644
--- a/pafish/gensandbox.h
+++ b/pafish/gensandbox.h
@@ -10,4 +10,6 @@ int gensandbox_path();
 
 int gensandbox_drive_size();
 
+int gensandbox_drive_size2();
+
 #endif
diff --git a/pafish/main.c b/pafish/main.c
index 171e0bf..95d608b 100644
--- a/pafish/main.c
+++ b/pafish/main.c
@@ -113,6 +113,16 @@ int main(int argc, char *argv[])
     else {
         print_not_traced();
     }
+
+    printf("[*] Checking if disk size by GetDiskFreeSpace <= 60GB ... ");
+    if (gensandbox_drive_size2() == 0) {
+        print_traced();
+        write_log("Sandbox traced by checking disk size GetDiskFreeSpace <= 60GB");
+        write_trace("hi_sandbox_drive_size_2");
+    }
+    else {
+        print_not_traced();
+    }
     
     /* Hooks detection tricks */
     printf("\n[-] Hooks detection\n");