1.使用RDTSC來anti-debug
如下內如引用intel指令手冊。
//引用開始
RDTSC—Read Time-Stamp Counter
Opcode Instruction Description
0F 31 RDTSC Read time-stamp counter into EDX:EAX
Description
Loads the current value of the processor’s time-stamp counter into the EDX:EAX registers. The
time-stamp counter is contained in a 64-bit MSR. The high-order 32 bits of the MSR are loaded
into the EDX register, and the low-order 32 bits are loaded into the EAX register. The processor
increments the time-stamp counter MSR every clock cycle and resets it to 0 whenever the
processor is reset.
The time stamp disable (TSD) flag in register CR4 restricts the use of the RDTSC instruction.
When the TSD flag is clear, the RDTSC instruction can be executed at any privilege level; when
the flag is set, the instruction can only be executed at privilege level 0. The time-stamp counter
can also be read with the RDMSR instruction, when executing at privilege level 0.
The RDTSC instruction is not a serializing instruction. Thus, it does not necessarily wait until
all previous instructions have been executed before reading the counter. Similarly, subsequent
instructions may begin execution before the read operation is performed.
This instruction was introduced into the IA-32 Architecture in the Pentium processor.
Operation
IF (CR4.TSD ← 0) OR ((CR4.TSD ← 1) AND (CPL=0))
THEN
EDX:EAX ← TimeStampCounter;
ELSE (* CR4 is 1 and CPL is 1, 2, or 3 *)
#GP(0)
FI;
Flags Affected
None.spa
Protected Mode Exceptions
#GP(0) If the TSD flag in register CR4 is set and the CPL is greater than 0.
Real-Address Mode Exceptions
#GP If the TSD flag in register CR4 is set.
Virtual-8086 Mode Exceptions
#GP(0) If the TSD flag in register CR4 is set..net
英文太多,我也看不懂多少,大概的意思是這樣,將計算機啓動以來的CPU運行週期數放到EDX:EAX裏面,EDX是高位,EAX是低位。
CPU運行週期數指的是CPU的一個時鐘觸發吧,就是應該是一個上升沿或者一個降低沿表示一個週期。
有一點你應該明白
週期數/CPU主頻=CPU通電以來的執行秒數,也就是GetTickcount乾的事情。
或者這樣說使用兩次RDTSC,把兩次的結果相減,獲得「間隔週期數」,間隔週期數/CPU主頻=CPU執行這兩條指令間的秒數
這樣咱們就能使用來作一些anti了
基本的思想是:
RDTSC
mov temp_1,eax ;edx估計不會改變
RDTSC
sub eax,temp_1
cmp eax,isDebug_number ;isDebug_number是一個自定義的小數目做爲判斷臨界值
jg @F
;若是比isDebug_number小,說明沒有Debug
@@:
;若是比 isDebug_number大,說明有Debug
由於在使用Debug的單步跟蹤的時候,咱們就算怎麼迅速的press F7(F8)須要的時間也大概要0.0幾秒吧,若是讓CPU來執行這些指令那麼就可能只用0.0000000幾秒....
因此說這個isDebug_number臨界值仍是很好選取的!
好了基本上能夠來總結一下了:
RDTSC的anti就是象GetTickcount同樣,使用判斷兩個指令間執行的週期數(時間)來判斷是否有debug,由於咱們確信cpu執行的週期數(時間)會遠遠低於某個值,解除他的辦法也很簡單,好比說你能夠找到cmp eax,isDebug_number這一句,而後就不用我說什麼了。
附:
GetTickcount返回的是本次Windows啓動以來的ms數,獲得的時間數值直接在eax中返回,因爲這是一個32位的整數,能夠表示的範圍是1~ffffffffh ms,因此當Windows連續運行49.7天之後,計數器會清零並從新開始。debug