"REP: PUSHFD" Anti-Tracing Trick

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//An anti-tracing trick that works against OllyDbg v1.10. Prefixing "PUSHFD" with "REP:" can fool
// OllyDbg v1.10 into thinking it is not a PUSHFD instruction.


#include "stdafx.h"
#include "windows.h"
#include "stdio.h"


int main(int argc, char* argv[])
{
    unsigned long eflags=0;
    printf("Welcome\r\n");
    __asm
    {
        __emit 0xF3
        __emit 0xF3
        __emit 0xF3
        __emit 0xF3
        __emit 0xF3
        pushfd
        pop eax
        mov eflags,eax
    }
    if(eflags&0x100)    printf("Being traced\r\n");
    else                printf("Expected behavior\r\n");

    return 0;
}