I recently came across this anti-debug technique being used in the wild.
In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section
A debugger will interfere with the single-stepping, resulting in a different count of instructions compared to when a debugger is not present.
From experimenting with this technique a bit, it seems that when you set a hardware breakpoint in x64dbg, the debug registers of all threads are not only set, but also frozen - so that for example - if the program calls SetThreadContext to change these registers, x64dbg seems to change them back.
Given how x64dbg works, and that the technique relies on these debug registers, isn't this technique limited to detecting the presence or modification of hardware breakpoints?
