//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar
//In OllyDbg, upon receiving an EXCEPTION_BREAKPOINT, it checks code in ExceptionAddress to ensure it is 
//0xCC or similar. If it is not, the behavior depends on the OllyDbg version.
//In versions prior to 2.01, the exception is swallowed and the exception handler is not called.
//In version 2.01 (alpha 4), several error messages pop up and process terminates.
// Only version 2.01 (beta 2) handles it properly.
//The following is code that exploits this bug to detect the presence of OllyDbg.
#include "stdafx.h"
#include "windows.h"
#include "stdio.h"

int __cdecl Hhandler(EXCEPTION_RECORD* pRec,void*,unsigned char* pContext,void*)
{
	if(pRec->ExceptionCode==EXCEPTION_BREAKPOINT)
	{
		(*(unsigned long*)(pContext+0xB8))++;
		MessageBox(0,"Expected","waliedassar",0);
		ExitProcess(0);
	}
	return ExceptionContinueSearch;
}
void main()
{
	__asm
	{
		push offset Hhandler
		push dword ptr fs:[0x0]
		mov dword ptr fs:[0x0],esp
	}
	RaiseException(EXCEPTION_BREAKPOINT,0,1,0);
	__asm
	{
		pop dword ptr fs:[0x0]
		pop eax
	}
	MessageBox(0,"OllyDbg Detected","waliedassar",0);
}