How to detect a debugger using some "time" checking strategies?

Question

I have seen several anti-debug strategies, and I am wondering if there are some anti-debugger methods that can evaluate the program running time, thus detecting the exist of debugger.

Answer 1

This is pretty broad subject :-) There are several examples:

1. GetTickCount() - Retrieves the number of milliseconds that have elapsed since the system was started. Putting those in different parts of the program and then checking the difference can give you some primitive detection.
2. time() - Get the current calendar time.
3. RDTSC - Gets the current value of the processor's time-stamp counter. This one could be hard to find if placed wisely.

The thing is, that all those could be neutralized once the researcher became aware of them. There are various debugger plugins which will make that happen by patching APIs, installing drivers and etc. Of course, it could be done manually in most cases.

What you really should think of is placing and integrating those inside your code, so it will be less evident what the real purpose of the calls to the APIs/instruction.

Answer 2

There are CPU instructions and OS APIs that can achieve this, such as

RDPMC
RDTSC
GetLocalTime
GetSystemTime
GetTickCount
KiGetTickCount
QueryPerformanceCounter
timeGetTime

The result is achieved by requesting the current time, performing some kind of CPU-intensive operation (or requiring that someone debugging the code does so, such as single-stepping), requesting the time again, and then calculating the delta between the two. If the delta is significantly larger than you would expect in native execution mode, then it suggests the presence of the debugger. Note, however, that this is far from an accurate method, since that result is indistinguishable from a system under heavy load.

This is covered in some detail in section "(C) Execution Timing" in my "Ultimate" Anti-Debugging Reference (http://pferrie.host22.com/papers/antidebug.pdf)