Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- //This function can be used to detect whether the processor still supports PIQ (Prefetch Input Queue).
- //At the time all processors supported PIQ, this was used as an anti-tracing trick.
- #include "stdafx.h"
- #include "windows.h"
- #include "iostream.h"
- bool IsPIQSupported()
- {
- unsigned long old;
- void* addr=0;
- //-----------Get EIP----------------
- unsigned long result=0;
- __asm
- {
- pushad
- call here
- here:
- pop ebx
- mov addr,ebx
- popad
- }
- //-------------------------Allow Write Access-----------------------
- VirtualProtect(addr,100,PAGE_EXECUTE_READWRITE,&old);
- //-------------------------Check for support------------------------
- __asm
- {
- pushad
- XOR EAX,EAX
- XOR ECX,ECX
- MOV AL,0x40
- MOV CL,0x6
- MOV EDI,offset shit
- STD
- REP STOS BYTE PTR ES:[EDI]
- NOP
- NOP
- NOP
- shit:
- NOP
- CLD
- mov result,eax
- popad
- };
- //----------------------Restore Original-----------------------
- VirtualProtect(addr,100,old,&old);
- if(result==0x44) return true;
- return false;
- }
- int main(int argc, char* argv[])
- {
- unsigned long old;
- void* addr=0;
- if(IsPIQSupported())
- {
- cout<<"PIQ is supported"<<endl;
- }
- else
- {
- cout<<"PIQ is not supported"<<endl;
- }
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement