Newer processors support a new instruction called RDTSCP which does the exact same thing as RDTSC, except that it does so serializing (meaning it waits for all instructions to execute before reading the counter. and that the possible reordering of the execution of the instructions is won that does not happen).
This instruction can be used to calculate the delta of the timestamp counter in the same way as RDTSC and thus detect whether the program is being debugged, emulated or executed in a virtual environment.
.586 .MODEL FLAT,STDCALL include windows.inc include kernel32.inc includelib kernel32.lib include user32.inc includelib user32.lib include masm32.inc includelib masm32.lib .data pat db 'rdtscp delta=%d, rdtsc delta=%d',13,10,0 rdtscp_not_supported db 'rdtscp not supported' .data? buf db 64 dup (?) .code rdtscp macro db 0Fh, 01h, 0F9h endm assume fs:nothing RDTSCP proc LOCAL _retval:DWORD mov _retval,0 pushad push OFFSET e push dword ptr fs: mov dword ptr fs:, esp rdtscp mov ebx,eax rdtscp sub eax,ebx mov _retval,eax jmp no_e e: mov esp, [esp + 8] pop dword ptr fs: add esp, 4 popad mov _retval,-1 jmp _ret no_e: pop dword ptr fs: add esp, 4 popad _ret: mov eax,_retval ret RDTSCP endp Start: rdtsc mov ebx,eax rdtsc sub eax,ebx mov ebp,eax call RDTSCP .if eax==-1 invoke StdOut,OFFSET rdtscp_not_supported .else invoke wsprintfA,OFFSET buf,OFFSET pat,eax,ebp invoke StdOut,OFFSET buf .endif invoke ExitProcess,0 END Start