[samis]

This code only supports x86.

Compiled with i686-w64-mingw32-gcc sandbox.c -s -O3

• Wine on i7-1165G7 (all cores enabled): 0.26
  
• Wine on i7-1165G7 (all cores except 1 parked): 0.24
  
• Native Windows 10 on Pentium Gold 4425Y: 4.19
  
• Native Windows 10 on Intel i5-5200U: 0.35
  
• Windows 7 on KVM (1 core): 9.07
  
• Windows 7 on KVM (8 cores): 9.89
  
• Triage Windows 7: 6.59
  
• any.run Windows 7: 48.79
  
• Triage Windows 10 1703: 6.09
  
• Triage Windows 10 2004: 7.23
  
• VirusTotal Microsoft Sysinternals: 30.91
  
• VirusTotal Jujubox: 157.27
  
• VirusTotal Zenbox: 6.13
  

Benchmark of 5 is perfect to avoid all of them.

C:

#include <windows.h>
#include <stdio.h>
#include <math.h>
#define THRESHOLD 5.0
#define ITERATIONS 1000000
int notdone, c;
DWORD WINAPI fp(void* data) {
    while(notdone){
        for(int i=0;i<10;i++) asm(".byte 0xd9\n\t.byte 0xf9"); //FYL2XP1
        c++;
    }
    return 0;
}

int main(){
    notdone=1;
    c=0;
    HANDLE thread = CreateThread(NULL, 0, fp, NULL, 0, NULL);
    for(int i=0;i<ITERATIONS;i++) asm("push %eax\n\tpush %ebx\n\tpush %ecx\n\tpush %edx\n\txor %eax, %eax\n\t.byte 0x0f\n\t.byte 0xa2\n\tpop %edx\n\tpop %ecx\n\tpop %ebx\n\tpop %eax"); //CPUID
    notdone=0;
    WaitForSingleObject(thread, INFINITE);
    c*=10;
    double ration = ((double)c)/((double)ITERATIONS);
    printf("c=%d, ratio=%f\n", c, ration);
    if(ration > THRESHOLD) printf("SANDBOX DETECTED!!!\n");
    double fscore = ((tanh(ration-THRESHOLD)+1)/2)*100;
    printf("%f%% confident sandbox\n", fscore);
    return 0;
}