My favorite is having an XOR opcode modifying the operand of its next IMUL operand.

Fools QEMU and makes for a good "am I on a VM" logic test.

A function of precalculating XOR operand inadvertly twice at QeMU TLB compute time AFTER retrieval of and toward its cached IMUL operand value.

In short, emulation doing preparation of registers twice (negating XOR)

Now you have a logic test revealing QEMU thru minute differential of IMUL operand value and its different multiplication results.

ROT13, anyone?

Disclaimer: works only on RXW memory page. It is literally a self-modifying code.