Detect OllyDbg v1.10 & v2.x

// http://waleedassar.blogspot.com -  (@waleedassar)
#include "stdafx.h"
#include "windows.h"

typedef struct _PROCESS_BASIC_INFORMATION {
    unsigned long Reserved1;
    unsigned long PebBaseAddress;
    unsigned long Reserved2[2];
    unsigned long UniqueProcessId;
    unsigned long ParentProcessId;
}PROCESS_BASIC_INFORMATION;
extern "C"
{
    int __stdcall ZwQueryInformationProcess(HANDLE,int,PROCESS_BASIC_INFORMATION*,int,unsigned long*);
}

int main(int argc, char* argv[])
{
    //---------------Get parent process's PID----------------------------------
    PROCESS_BASIC_INFORMATION PBI={0};
    ZwQueryInformationProcess(GetCurrentProcess(),0,&PBI,sizeof(PBI),0);
    HANDLE h=OpenProcess(PROCESS_VM_READ,FALSE,PBI.ParentProcessId);
    if(!h) return 0;
    //----------------Get Info about parent------------------------------------
    ZwQueryInformationProcess(h,0,&PBI,sizeof(PBI),0);
    unsigned long parent_IB=0;
    ReadProcessMemory(h,(void*)((PBI.PebBaseAddress)+0x8),&parent_IB,4,0);
    //---------------Start reading from PE header of parent process------------
    IMAGE_DOS_HEADER DOS={0};
    ReadProcessMemory(h,(void*)parent_IB,&DOS,sizeof(DOS),0);
    IMAGE_NT_HEADERS INH={0};
    if(ReadProcessMemory(h,(void*)(parent_IB+DOS.e_lfanew),&INH,sizeof(INH),0))
    {
        if((INH.OptionalHeader.DataDirectory[2].VirtualAddress)==0) return 0;

        unsigned long addr=parent_IB+INH.OptionalHeader.DataDirectory[2].VirtualAddress; //resource data directory

        IMAGE_RESOURCE_DIRECTORY IRSD={0};
        if(ReadProcessMemory(h,(void*)addr,&IRSD,sizeof(IRSD),0))
        {
            if((IRSD.NumberOfNamedEntries+IRSD.NumberOfIdEntries)==0 ) return 0;  //no entries found.
            //----Get the first entry---------------------
            IMAGE_RESOURCE_DIRECTORY_ENTRY IRSE={0};
            if(ReadProcessMemory(h,(void*)(addr+sizeof(IRSD)),&IRSE,sizeof(IRSE),0))
            {
                if(IRSE.NameIsString)
                {
                    unsigned long sz=0;
                    unsigned str_addr=addr+IRSE.NameOffset;
                    if(ReadProcessMemory(h,(void*)str_addr,&sz,0x2,0))
                    {
                          if(sz)
                          {
                              wchar_t* pStr=(wchar_t*)LocalAlloc(LMEM_ZEROINIT,(sz+1)*2);
                              if(ReadProcessMemory(h,(void*)(str_addr+2),pStr,sz*2,0))
                              {
                                   if(!lstrcmpiW(pStr,L"KNOWNRESTYPE"))
                                   {
                                       MessageBox(0,"OllyDbg detected","waliedassar",0);
                                   }
                              }
                              LocalFree(pStr);
                          }
                    }
                }
            }
        }
    }
    return 0;
}