I am reading Eldad Eilam's book titled Reversing. In Chapter 11: Breaking Protections, there is a crackme called Defender, which creates a dedicated thread, which repeats the following steps:
1. Invokes `rdtsc` and saves the time-stamp counter (`t1`) 2. Relinquishes the CPU 3. Invokes `rdtsc` again, from the result (`t2`) subtracts the previous value: `dt=t2-t1` 4. If `dt` is greater than some hardcoded value, terminates; otherwise goes to 1.
The goal is to detect if the process is stopped in a debugger. Is the idea behind this method the fact that after hitting a breakpoint all threads will be stopped? Because as far as I know this can be prevented in
gdb by issuing
set pagination off and
set non-stop on. Or is there something I am missing?