md/writeup/linux_antidebug_5.md


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

title:Linux antidebug 5
keywords:math,statistics

# Linux antidebug 5

Content: When debugging program line by line or when running it
in some debugger then there can be some time delays when you
pressing buttons. We can measure them with asm command

```asm
rdtsc
```

this instruction read time-stamp counter into edx:eax in our
program will be enough values from
eax

function for c that uses rdtsc is

```c
extern int get_timer()
```

in fasm it looks like

```asm
get_timer:
    rdtsc
    ret
```

there is written code

```c
s = get_timer();
for (i=0;i<10000;i++)
{
}
e = get_timer();
d = e - s;
```

average time to execute 10000 is 70069 ticks for value
on with we detecting how fast working code i have choose
twice of average 120000 if execution time is larger then
probably it is debuged.

## Compile
```sh
make
```

## Download

http://archive.main.lv/files/writeup/linux_antidebug_5/antidebug5.zip