Created the Monday 14 September 2020. Updated 2 years ago.

Newer processors support a new instruction called RDTSCP which does the exact same thing as RDTSC, except that it does so serializing (meaning it waits for all instructions to execute before reading the counter. and that the possible reordering of the execution of the instructions is won that does not happen).

This instruction can be used to calculate the delta of the timestamp counter in the same way as RDTSC and thus detect whether the program is being debugged, emulated or executed in a virtual environment.

Technique Identifier


Technique Tag


Code Snippets

 include    windows.inc
 include    kernel32.inc
 includelib kernel32.lib
 include    user32.inc
 includelib user32.lib
 include    masm32.inc
 includelib masm32.lib
  pat                  db 'rdtscp delta=%d, rdtsc delta=%d',13,10,0
  rdtscp_not_supported db 'rdtscp not supported'
  buf db 64 dup (?)
rdtscp macro
  db 0Fh, 01h, 0F9h
assume fs:nothing
RDTSCP  proc
  LOCAL _retval:DWORD
   mov  _retval,0
   push OFFSET e
   push dword ptr fs:[0]
   mov  dword ptr fs:[0], esp
   mov ebx,eax
   sub  eax,ebx
   mov  _retval,eax
   jmp  no_e
   mov  esp, [esp + 8]
   pop  dword ptr fs:[0]
   add  esp, 4
   mov  _retval,-1
   jmp  _ret
   pop  dword ptr fs:[0]
   add  esp, 4
   mov eax,_retval
RDTSCP  endp
   mov ebx,eax
   sub  eax,ebx
   mov  ebp,eax
   call RDTSCP
   .if eax==-1
       invoke  StdOut,OFFSET rdtscp_not_supported
       invoke  wsprintfA,OFFSET buf,OFFSET pat,eax,ebp
       invoke  StdOut,OFFSET buf
   invoke ExitProcess,0
END Start

Additional Resources

External Links

Subscribe to our Newsletter

The information entered into this form is mandatory. It will be subjected to computer processing. It is processed by computer in order to support our users and readers. The recipients of the data will be : contact@unprotect.it.

According to the Data Protection Act of January 6th, 1978, you have at any time, a right of access to and rectification of all of your personal data. If you wish to exercise this right and gain access to your personal data, please write to Thomas Roccia at contact@unprotect.it.

You may also oppose, for legitimate reasons, the processing of your personal data.