Detecting single-stepping using timing techniques

There are multiple ways to get the exact time with millisecond accuracy from the moment the system is on until the execution of the current instruction. There is an x86 instruction called rdtsc that returns the time in EDX:EAX registers. By calculating the difference between the time before and after executing a certain instruction, any delay will be clearly shown, which represents reverse-engineering tracing through the code. An example of this is shown in the following screenshot:

Figure 5: The rdtsc instruction to detect single-stepping

This instruction is not the only way to get the time at any given moment. There are multiple APIs supported by Windows that help programmers get the exact time, as follows:

• GetLocalTime
• GetSystemTime
• GetTickCount
• KiGetTickCount (in kernel mode)
• QueryPerformanceCounter
• timeGetTime
• timeGetSystemTime

This technique is widely used and more common than the SS segment register trick. The best solution is...