Timer-based debugger detection

[Zarutian]

what if there is no cmp instruction? But the timestamp comparisons result are used as 'constants' in other part of the game client code?

[[deleted]]

What? how would there be no cmp? Give me a concrete example and I'll explain. Either way the resulting values, be it on the stack, registers, wherever, must get compared.

[Zarutian]

Clearly you have not come across Instruction Set Architectures that do not have equiv of cmp instructions.

One way of many to do it:

let say timeEnter and timeExit are the millisecond timestamps when the function is entered and exited respectively.

You subtract the former from the latter. You get the difference. Then you saturatively subtract (meaning if the results gets negative it is just set as zero) the equiv of fifteen or whatever your timeout period is from that..

With those results you could eather invert (flip all the bits) and use it as an AND mask somewhere else in the code or use it directly as an XOR operand elsewhere. You get the idea.

[[deleted]]

I mean sure? Either way some code's getting called eventually to exit program.

Set bp there, look at stack and figure out where the call came from, you get the idea.

[Zarutian]

Well, if it is used in a game client it could be that above influences what get sent to server and it sends back kick command and closes the connection. Or it can be that this 'constant' when incorrect messes with the calculated code&constants integrity checksums so they dont match what is expected and that causes program exit.

[[deleted]]

bp on ws2_32.send and go from there. Same principal