> I think Saberhagen's Berserkers actually had this feature.
Yes. Code decoded other code, etc. So if the code wasn't running normally, it couldn't be analyzed.
It was handwaving back then, but it may become real.
It was standard coding practices if you were selling games - to prevent people from hacking the license key stuff. Or by cheating software to prevent detection by anti-cheat software. One of the hooks built into Windows is "is a debugger connected" helps the virus/cheat code determine if it is "safe" to run or not.
You can be sure that it matches if the vendor (1) doesn't use an obfuscated binary, or (2) provides exact details of how the obfuscated binary was constructed (presumably including some kind of seed for the obfuscator).
This was the point behind Reflections on Trusting Trust - you can't trust it. Unless you build the entire compiler/linker tool chain from source that you've already inspected.
I think Saberhagen's Berserkers actually had this feature.