PspSetContext Nested Task EFlag Anti-Tracing Trick

//http://www.twitter.com/waleedassar

//Trick originally discovered by @nickeverdox

//The following is an anti-tracing trick that depends on the fact that the "nt!PspSetContext" function
//filters some bits/flags of the RFlags register. Among filtered Rflags is NT, Nested Task Flag.
PAGE:000000014036B4D7                 mov     eax, [r8+44h]   ; EAX is now pContext->EFlags  (64Bit _CONTEXT)
PAGE:000000014036B4DB                 cmp     r9b, r13b       ; PreviousMode
PAGE:000000014036B4DE                 jz      KernelMode
PAGE:000000014036B4E4                 and     eax, 210DD5h    ; Filter RFlags
PAGE:000000014036B4E4                                         ; This is one nice anti-debug/anti-trace.
PAGE:000000014036B4E9                 bts     eax, 9          ; IF (Interrupt Flag) is only set by Ring0
//This means that each time the "SetThreadContext" function is called by the debugger e.g. during tracing,
//the flag is cleared.

//Tested With Windows 7 (64Bit) SP1.

void main()
{
    unsigned long EFL=0;
    __asm
    {
        push offset Handler
        push dword ptr fs:[0x0]
        mov dword ptr fs:[0x0],esp

        pushfd
        pop ecx


        or ecx,0x4000
        push ecx
        popfd

        pushfd
        pop eax
        mov EFL,eax
next:
        pop dword ptr fs:[0x0]
        pop eax
    }

    if(EFL & 0x4000)    printf("Normal\r\n");
    else printf("Being traced EFlags: %x\r\n",EFL);
}