RDTSCP

Created the Monday 14 September 2020. Updated 2 months, 1 week ago.

Newer processors support a new instruction called RDTSCP which does the exact same thing as RDTSC, except that it does so serializing (meaning it waits for all instructions to execute before reading the counter. and that the possible reordering of the execution of the instructions is won that does not happen).

This instruction can be used to calculate the delta of the timestamp counter in the same way as RDTSC and thus detect whether the program is being debugged, emulated or executed in a virtual environment.

Technique Identifier

U1304

Technique Tag

RDTSCP

Featured Windows API's

Below, you will find a list of the most commonly used Windows API's that are currently utilized by malware authors for current evasion technique. This list is meant to provide an overview of the API's that are commonly used for this purpose. If there are any API's that you feel should be included on this list, please do not hesitate to contact us. We will be happy to update the list and provide any additional information or documentation that may be helpful.

ExitProcess

Code Snippets

.586
.MODEL FLAT,STDCALL
 include    windows.inc
 include    kernel32.inc
 includelib kernel32.lib
 include    user32.inc
 includelib user32.lib
 include    masm32.inc
 includelib masm32.lib
.data
  pat                  db 'rdtscp delta=%d, rdtsc delta=%d',13,10,0
  rdtscp_not_supported db 'rdtscp not supported'
.data?
  buf db 64 dup (?)
.code
rdtscp macro
  db 0Fh, 01h, 0F9h
endm
assume fs:nothing
RDTSCP  proc
  LOCAL _retval:DWORD
   mov  _retval,0
   pushad
   push OFFSET e
   push dword ptr fs:[0]
   mov  dword ptr fs:[0], esp
   rdtscp
   mov ebx,eax
   rdtscp
   sub  eax,ebx
   mov  _retval,eax
   jmp  no_e
 e:
   mov  esp, [esp + 8]
   pop  dword ptr fs:[0]
   add  esp, 4
   popad
   mov  _retval,-1
   jmp  _ret
 no_e:
   pop  dword ptr fs:[0]
   add  esp, 4
   popad
_ret:
   mov eax,_retval
   ret
RDTSCP  endp
  Start:
   rdtsc
   mov ebx,eax
   rdtsc
   sub  eax,ebx
   mov  ebp,eax
   call RDTSCP
   .if eax==-1
       invoke  StdOut,OFFSET rdtscp_not_supported
   .else
       invoke  wsprintfA,OFFSET buf,OFFSET pat,eax,ebp
       invoke  StdOut,OFFSET buf
   .endif
   invoke ExitProcess,0
END Start

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Hexacorn | Blog RDTSCP – a recooked AntiRe trick

RDTSCP

Technique Identifier

Technique Tag

Featured Windows API's

Code Snippets

Additional Resources

External Links

Subscribe to our Newsletter