"Prefix+PUSHFD" Anti-Tracing Trick

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//Prefixing "PUSHFD" with 0x66 or 0x67 can fool OllyDbg v1.10 and v2.x into thinking the instruction
// is not a PUSHFD. This can be used as an anti-tracing trick.

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"


int main(int argc, char* argv[])
{
    unsigned long eflags=0;
    printf("Welcome\r\n");
    __asm
    {
        __emit 0x67
        __emit 0x67
        __emit 0x67
        __emit 0x67
        pushfd
        xor ebx,ecx
        push bx
        pop eax
        shr eax,0x10
        mov eflags,eax
    }
    if(eflags&0x100)    printf("Being traced\r\n");
    else                printf("Expected behavior\r\n");

    return 0;
}