print "we are ok!all right be mindful of the indentation in the code blocks abovewe start by defining some variables to track the timing of mouse-clicksand some thresholds with regard to how many keystrokes or mouse-clicks we're happy with before considering ourselves running outside sandbox we randomize these thresholds with each runbut you can of course set thresholds of your own based on your own testing we then retrieve the elapsed time since some form of user input has been registered on the systemand if we feel that it' been too long since we've seen input (based on how the infection took place as mentioned previously)we bail out and the trojan dies instead of dying hereyou could also choose to do some innocuous activity such as reading random registry keys or checking files after we pass this initial checkwe move on to our primary keystroke and mouse-click detection loop we first check for keypresses or mouse-clicks and we know that if the function returns valueit is the timestamp of when the mouse-click occurred next we calculate the time elapsed between mouse-clicks and then compare it to our threshold to determine whether it was double-click along with double-click detectionwe're looking to see if the sandbox operator has been streaming click events into the sandbox to try to fake out sandbox detection techniques for exampleit would be rather odd to see double-clicks in row during typical computer usage if the maximum number of double-clicks has been reached and they happened in rapid succession we bail out our final step is to see if we have made it through all of the checks and reached our maximum number of clickskeystrokesand double-clicks if sowe break out of our sandbox detection function encourage you to tweak and play with the settingsand to add additional features such as virtual machine detection it might be worthwhile to track typical usage in terms of mouse-clicksdoubleclicksand keystrokes across few computers that you own ( mean possess -not ones that you hacked into!to see where you feel the happy spot is depending on your targetyou may want more paranoid settings or you may not be concerned with sandbox detection at all using the tools that you developed in this can act as base layer of features to roll out in your trojanand due to the modularity of our trojaning frameworkyou can choose to deploy any one of them [ download pyhook here[ to learn all about device contexts and gdi programmingvisit the msdn page here[ as canvas is commercial tooltake look at this tutorial for generating metasploit pay-loads here