KUSER_SHARED_DATA time checks

[ghost]

trafficstars

Add please this check.

[ayoubfaouzi]

Hello,

This trick is already implemented here: https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SharedUserData_KernelDebugger.cpp

If you mean something else, feel free to open the issue again.

[ayoubfaouzi]

ah seems the time checks, I taught the debugger check, sorry.

[dererror33]

@LordNoteworthy yes

[hfiref0x]

@lurumdare It is the the same as GetTickCount and already used in this project as generic detect if time was accelerated. The other usage can be like in Upatre trojan -> https://unit42.paloaltonetworks.com/ticked-off-upatre-malwares-simple-anti-analysis-trick-to-defeat-sandboxes/. Pure usage, for example how many ticks between two instructions, is false-positive generator.

Please elaborate yourself.