gistfile1.c

#include <windows.h>
#include <stdio.h>

typedef enum _STORAGE_QUERY_TYPE {PropertyStandardQuery = 0,PropertyExistsQuery,PropertyMaskQuery,PropertyQueryMaxDefined} STORAGE_QUERY_TYPE, *PSTORAGE_QUERY_TYPE;
typedef enum _STORAGE_PROPERTY_ID {StorageDeviceProperty = 0,StorageAdapterProperty} STORAGE_PROPERTY_ID, *PSTORAGE_PROPERTY_ID;
typedef struct _STORAGE_PROPERTY_QUERY {
	STORAGE_PROPERTY_ID PropertyId;
    STORAGE_QUERY_TYPE QueryType;
    UCHAR AdditionalParameters[1];
	
} STORAGE_PROPERTY_QUERY, *PSTORAGE_PROPERTY_QUERY;
typedef struct _STORAGE_DEVICE_DESCRIPTOR {
    ULONG Version;
    ULONG Size;
    UCHAR DeviceType;
    UCHAR DeviceTypeModifier;
    BOOLEAN RemovableMedia;
    BOOLEAN CommandQueueing;
    ULONG VendorIdOffset;
    ULONG ProductIdOffset;
} STORAGE_DEVICE_DESCRIPTOR, *PSTORAGE_DEVICE_DESCRIPTOR;

#define IOCTL_STORAGE_QUERY_PROPERTY CTL_CODE(IOCTL_STORAGE_BASE, 0x0500, METHOD_BUFFERED, FILE_ANY_ACCESS)

bool IsSandboxed()
{
	HANDLE hPhysicalDriveIOCTL = 0;
	int j = 0,k = 0;
	char szModel[128],szBuffer[128];
	char *szDrives[] = {
		"qemu",
		"virtual",
		"vmware",
		NULL
	};
	
	hPhysicalDriveIOCTL = CreateFile ("\\\\.\\PhysicalDrive0", 0,FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,OPEN_EXISTING, 0, NULL);
	if (hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
	{
		STORAGE_PROPERTY_QUERY query;
		DWORD cbBytesReturned = 0;
		memset ((void *) & query, 0, sizeof (query));
		query.PropertyId = StorageDeviceProperty;
		memset (szBuffer, 0, sizeof (szBuffer));
		memset (szModel, 0, sizeof (szModel));
		if (DeviceIoControl(hPhysicalDriveIOCTL, IOCTL_STORAGE_QUERY_PROPERTY,& query,sizeof (query),& szBuffer,sizeof (szBuffer),& cbBytesReturned, NULL)){ 
			STORAGE_DEVICE_DESCRIPTOR *descrip = (STORAGE_DEVICE_DESCRIPTOR*)&szBuffer;
			int pos = descrip->ProductIdOffset;
			int m = 0;
			for(int g = pos;szBuffer[g] != '\0';g++){
				szModel[m++] = szBuffer[g];
			}
			CharLowerBuff(szModel,strlen(szModel));
			for (int i = 0; i < (sizeof(szDrives)/sizeof(LPSTR)) - 1; i++ ) {
				if (szDrives[i][0] != 0) {
					if(strstr(szModel,szDrives[i]))
						return TRUE;
				}
			}
		}
		CloseHandle (hPhysicalDriveIOCTL);
	}
	return FALSE;
}

int main(void) {
	if(IsSandboxed()) {
		printf("Hmm.. i don't think i want to be here... :(\n");
		ExitProcess(1);
	} else {
		//evil code
	}
	system("pause");
	return 0;
}