I am reading Eldad Eilam's book titled Reversing. In Chapter 11: Breaking Protections, there is a crackme called Defender, which creates a dedicated thread, which repeats the following steps:
1. Invokes `rdtsc` and saves the time-stamp counter (`t1`)
2. Relinquishes the CPU
3. Invokes `rdtsc` again, from the result (`t2`) subtracts the previous value: `dt=t2-t1`
4. If `dt` is greater than some hardcoded value, terminates; otherwise goes to 1.
The goal is to detect if the process is stopped in a debugger. Is the idea behind this method the fact that after hitting a breakpoint all threads will be stopped? Because as far as I know this can be prevented in gdb
by issuing set pagination off
and set non-stop on
. Or is there something I am missing?