Detecting Sandboxes Without Syscalls

constexpr uint32_t TICKS_PER_SECOND = 10'000'000;

const PEB* peb = GetPeb();
const KUSER_SHARED_DATA* ksd = GetKUserSharedData();

const uint32_t boot_count = ksd->BootId;

const uint32_t cpu_core_count1 = peb->NumberOfProcessors;
const uint32_t cpu_core_count2 = ksd->ActiveProcessorCount;

const double ram_size = static_cast<double>(ksd->NumberOfPhysicalPages) * 4096 / 1024 / 1024 / 1024;  // in gigabyte

const LARGE_INTEGER time1 = { .LowPart = ksd->InterruptTime.LowPart, .HighPart = ksd->InterruptTime.High2Time };
const uint32_t uptime = time1.QuadPart / TICKS_PER_SECOND / 60 / 60;  // in hours

const uint32_t os_major_version1 = ksd->NtMajorVersion;
const uint32_t os_major_version2 = peb->OSMajorVersion;

const bool license_valid = ksd->SystemExpirationDate.QuadPart == 0;

const bool secure_boot_enabled = ksd->DbgSecureBootEnabled;

const wchar_t* filepath = peb->ProcessParameters->ImagePathName.Buffer;

const LARGE_INTEGER time2 = { .LowPart = ksd->TimeZoneBias.LowPart, .HighPart = ksd->TimeZoneBias.High2Time };
const double timezone_offset = -1 * static_cast<double>(time2.QuadPart) / TICKS_PER_SECOND / 60 / 60;  // in hours from UTC

const wchar_t* env = peb->ProcessParameters->Environment;
const wchar_t* computername = GetEnvVar(env, L"COMPUTERNAME");
const wchar_t* userdomain = GetEnvVar(env, L"USERDOMAIN");
const wchar_t* username = GetEnvVar(env, L"USERNAME");

const wchar_t* workdir = peb->ProcessParameters->CurrentDirectory.DosPath.Buffer;