Windows Time-Based Anti-Tampering System

A comprehensive C++ security library for Windows ARM64 that uses precise timing and integrity checks to detect debugging, hooking, and runtime tampering.

Features

Three-Tier Protection System

• Tier 1 (Single-Step Detection): Detects single-stepping debuggers using cycle-accurate timing
• Tier 2 (Drift Detection): Monitors scheduler micro-delays and timing inconsistencies
• Tier 3 (Hypervisor/VM Detection): Identifies virtualization environments

Core Components

1. Time Check Macros (time_check_macros.h)

   • TIME_CHECK_BEGIN() / TIME_CHECK_END() - Basic protection
   • TIME_CHECK_TIER1() / TIME_CHECK_TIER2() / TIME_CHECK_TIER3() - Individual tiers
   • TIME_CHECK_PROBABILITY(n) - Randomized internal checks
   • TIME_CHECK_ADAPTIVE - Self-adjusting check frequency
   • TIME_CHECK_FATAL(msg) - Custom failure handler

2. Time Verification Module (time_verification.cpp)

   • Drift detection between KUSER_SHARED_DATA and RtlGetSystemTimePrecise
   • Sleep/suspend detection using biased vs unbiased interrupt time
   • Comprehensive snapshot comparison

3. Watchdog System (watchdog_demo.cpp)

   • CRC32 integrity validation of critical functions
   • API hook detection
   • Execution time monitoring
   • Timer-based periodic checks

Requirements

• Platform: Windows 10/11 ARM64
• Compiler: MSVC (Visual Studio 2022) or MinGW-w64 (ARM64)
• Architecture: ARM64 (for CNTVCT_EL0 system register access)
• Privileges: User-mode (no admin required)

Building

MSVC (Visual Studio 2022)

cl /EHsc /O2 /std:c++17 /D TIME_CHECK_DEMO time_check_demo.cpp /link ntdll.lib