OllyDbg v1.10 INT3/POPFD TRICK + PAGE_EXECUTE_WRITECOPY

//http://waleedassar.blogspot.com (@waleedassar)
#include "stdafx.h"
#include "windows.h"



#pragma comment(linker,"/incremental:no")
#pragma comment(linker,"/entry:main")

int __cdecl Handler(EXCEPTION_RECORD* pRec,void*,unsigned char* pContext,void* disp)
{
    (*(unsigned long*)(pContext+0xB8))++;
    return ExceptionContinueExecution;
}


#pragma comment(linker,"/SECTION:xyz,ERW")
#pragma code_seg("xyz")
int main2()
{
            __asm
            {
                push offset Handler
                push dword ptr fs:[0x0]
                mov dword ptr fs:[0x0],esp
            }
//-----------------The following x86 asm sequence force Olly to WriteProcessMemory---------------
            __asm
            {
                pushfd
                int 3
                popfd

                pushfd
                int 3
                popfd

                pushfd
                int 3
                popfd

                pushfd
                int 3
                popfd

                pushfd
                int 3
                popfd
            }
            __asm
            {
                pop dword ptr fs:[0x0]
                pop eax
            }
//-----------------------------------------------------------------------------------------------
            void* base=&main2;//????
            MEMORY_BASIC_INFORMATION MBI={0};
            VirtualQuery(base,&MBI,sizeof(MBI));
            if(MBI.Protect!=PAGE_EXECUTE_WRITECOPY)
            {
                 MessageBox(0,"BeingDebugged","waliedassar",0);
                 ExitProcess(-2);
            }
            return 0;
}
#pragma code_seg()

int main(int argc, char* argv[])
{
            main2();
            MessageBox(0,"That is okay","waliedassar",0);
            return 0;
}