INT 2E / Anti-Tracing Trick

Credit: @angealbertini (For discovery of this method for getting EIP value).

//Tested with Windows XP 32Bit
#include "stdafx.h"
#include "windows.h"
#include "stdio.h"

int __cdecl Handler(void*,void*,void*,void*)
{
    printf("Incompatible System\r\n");
    ExitProcess(0);
    return ExceptionContinueSearch;
}

void main_2E()
{
    unsigned long realPC=0;
    __asm
    {
        push offset Handler
        push dword ptr fs:[0]
        mov dword ptr fs:[0],esp
        xor eax,eax
        xor edx,edx
        int 0x2E
        nop
        mov realPC,edx
        pop dword ptr fs:[0]
        pop ebx
    }
    printf("EIP is %x\r\n",realPC);
    if(realPC==-1) printf("Being Traced\r\n");
    return;
}


void main_2C()
{
    unsigned long realPC=0;
    __asm
    {
        push offset Handler
        push dword ptr fs:[0]
        mov dword ptr fs:[0],esp
        xor eax,eax
        xor edx,edx
        int 0x2C
        nop
        mov realPC,edx
        pop dword ptr fs:[0]
        pop ebx
    }
    printf("EIP is %x\r\n",realPC);
    if(realPC==-1) printf("Being Traced\r\n");
    return;
}

void Test_Trace()
{
    unsigned long EFlags=0;
    __asm
    {
        xor eax,eax
        xor edx,edx
        int 0x2E
        pushfd
        pop eax
        mov EFlags,eax
    }
    if(EFlags & 0x100 /* TF */) printf("Being Traced\r\n");

}

void main()
{
    main_2C();
    main_2E();
    Test_Trace();
}