OllyDbg v1.10 LoadDll.hFile Trick

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar
//Upon receiving LOAD_DLL_DEBUG_EVENT debug events, debuggers should save the value of
//the "hFile" member of LOAD_DLL_DEBUG_INFO somewhere so that it can close it upon receiving
//the corresponding UNLOAD_DLL_DEBUG_INFO.

//OllyDbg v1.10 does not follow this rule and consequently we can easily detect its presence
//simply by trying to acquire exclusive access to the Dll file after FreeLibrary.
//Executable can be found at:
//http://code.google.com/p/ollytlscatch/downloads/detail?name=Olly_LoadDll_Trick.exe
#include "stdafx.h"
#include "windows.h"
#include "stdio.h"
#define IDR_WALIED2                     102
void main()
{
        //For the following code to work, embed any dummy DLL as a resource of TYPE "WALIED"
        //and id of 0x102.
    HRSRC h=FindResource(0,MAKEINTRESOURCE(IDR_WALIED2),"WALIED");
    if(h)
    {
        HGLOBAL hG=LoadResource(0,h);
        if(hG)
        {
            void* pDll=LockResource(hG);
            if(pDll)
            {
                char path[MAX_PATH]={0};
                GetCurrentDirectory(MAX_PATH,path);
                unsigned long len=strlen(path);
                if(path[len-1]!='\\') path[len]='\\';
                strcat(path,"walied.dll");
                HANDLE hFile=CreateFile(path,
                                GENERIC_READ,FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
                                0,OPEN_EXISTING,0,0);
                if(hFile==INVALID_HANDLE_VALUE)
                {
                    hFile=CreateFile(path,
                                        GENERIC_READ|GENERIC_WRITE,
                                        FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE,
                                        0,CREATE_ALWAYS,0,0);
                }
                if(hFile==INVALID_HANDLE_VALUE) ExitProcess(0);
                else
                {
                    unsigned long writ;
                    WriteFile(hFile,pDll,SizeofResource(0,h),&writ,0);
                    CloseHandle(hFile);
                    FreeLibrary(LoadLibrary(path));
                    hFile=0;
                    hFile=CreateFile(path,GENERIC_WRITE,0,0,OPEN_EXISTING,0,0);
                    if(hFile!=INVALID_HANDLE_VALUE)
                    {
                        MessageBox(0,"Expected behavior","waliedassar",0);
                        CloseHandle(hFile);
                    }
                    else
                    {
                        MessageBox(0,"Debugger detected","waliedassar",0);
                    }
                    DeleteFile(path);
                }
            }
        }
    }
}