PhantOm.plugin.1.30

---[ PhantOm plugin 1.30  ]--------------------------------------------------
      by Hellsp@wn & Archer

| 厥外奄?音???
|  Bronco, kioresk, RSI, lord_Phoenix, HoBleen, Grim Fandango,
|  Guru.eXe, vad8787, PE_Kill, Executioner.
-----------------------------------------------------------------------------

拳說妖 秧 仲終震 OllyDbg (筍嚴鎭 ?崖纖橓尊?.
淃溢侁奄 剪 衆抑策陷?靭桎哀?翟壯宗蓮杖:

// 崖纖橓?- extremehide.sys

[+] NtQueryInformationProcess.
[+] SetUnhandledExceptionFilter.
[+] OpenProcess.
[+] Invalid Handle.
[+] NtSetInformationThread.
[+] RDTSC.
[+] NtYieldExecution.
[+] NtQueryObject.
[+] NtQuerySystemInformation.
[+] Windows hide.
[+] GetProcessTimes.
[+] NtSetContextThread.

// 町說妖 - PhantOm.dll

[+] PEB BeingDebugged.
[+] PEB NtGlobalFlag.
[+] GetStartupInfo.
[+] Process Heaps.
[+] GetTickCount.
[!] Protect DRx.
[!] Hide DRx.
[!] Fake Windows version.
[!] Custom Handler.
[+] BlockInput

燐?狀脣莘 - 1.30
[*] 屢渟綜 裔莘依脣?適壯 ?穽淹凹?CPU, 溢悅?裔菴循潗 荀綵腸?
      CAPTEXT ?PRETEXT, 禎-脹鏑妬杖?"PhantOm" ?"o_O".
[*] 희穽設音狀 張仲鏑獪?蓀莘??"custom handler exceptions".
[*] 희穽設音狀 張仲鏑獪?靭凝撓 蓀莘?

燐?狀脣莘 - 1.26
[*] 희穽設音?蓀??裔藎滄惟?崖纖橓調.
[*] 厥?盾誼特牆迹 全打?"custom handler exceptions" 調灑診
     memory breakpoints on access, write 狀 張 修怏?調灑診潗
     break-on-access.
[*] 희穽設音?蓀?穽?翟狀瞬孼僚 町說妖?

燐?狀脣莘 - 1.25
[*] 屢渟綜 溢悅?焌溢壬 裔菴循潗 夭 遵躁尿荻
     HIDENAME ?RDTSCNAME.
[*] 희穽設音狀 張仲鏑獪?靭凝撓 蓀莘?
[*] 희穽設音?蓀??memory breakpoints.

燐?狀脣莘 - 1.20
[*] 쿡蓀瞬孼?櫛衰軫孼壯 翟調灑叱?尿幽孼僥 (C0000005).
[*] 쿡蓀瞬孼?全打 重孼?裔莘依盾?紳設狀莘 適壯.
[*] 쿡蓀瞬孼?櫛衰軫孼壯 翟調灑叱?尿幽孼僥 (OUTPUT_DEBUG_STRING_EVENT).
[*] int 3 壯 EP 惟拙焉帙?昶贍奄?, 嚴泣 盾誼特壯 前診狀盾?
     壯 茁增諺狀?桎把?前診狀循.
[*] 쿡蓀瞬孼 渟釣騶城 BlockInput. (桎蟻惟 WinXP)
[*] 쿡蓀瞬孼?櫛衰軫孼壯 翟調灑叱?尿幽孼僥 (C0000094).
[*] 쿡蓀瞬孼?仲終震?剪 GetStartupInfo.
[*] 희穽設音?蓀??壯增尊隅閃?町說妖?
[*] 쿡蓀瞬孼?裔陷診 剪 翟壯宗蓮杖 崖纖橓尊?

燐?狀脣莘 - 1.15
[*] 희穽設音狀 張仲鏑獪?蓀莘?

燐?狀脣莘 - 1.10
[*] hook GetProcessTimes - 渟釣張晝??崖纖橓?
[*] hook NtSetContextThread - 渟釣張晝??崖纖橓?
[*] 희穽設音壯 廛矮魏 ?昶贍孼猥?"EP break".
[*] 희穽設音狀 張仲鏑獪?蓀莘? 竣裔牆紅 ?裔藎滄惟?壯增尊焉.
[*] ?ini 哀蓀瞬孼?全打 "DELTARDTSC", 禎譽鏑? 釣身泣尊循潗 調詣尊?RDTSC.

燐?狀脣莘 - 1.04
[*] 희穽設音?衰賊 穽?裔藎滄劉 崖纖橓調.

燐?狀脣莘 - 1.03
[*] 희穽設音?蓀??適壯麟.

燐?狀脣莘 - 1.01
[*] 희穽設音?蓀??崖纖橓釣.

燐?狀脣莘 - 1.00
[*] 쿡蓀瞬孼?裔陷診 適廛焉 OllyDbg.
[*] 屢渟綜 OllyDbg 檉迭嶢劃 張裔淳茁溢 剪 ImageBase.

燐?狀脣莘 - 0.60
[*] 쿡蓀瞬孼?櫛衰軫孼壯 翟調灑叱?尿幽孼僥 (C000001E, 80000001, C000001D).
[*] 쿡蓀瞬孼?昶贍孼猥 int3 ?EntryPoint.
[*] 희穽設音?蓀??GetTickCount.
[*] 쿡蓀瞬孼?靭桎液 陝震-鴨鎭攸??崖纖橓?

燐?狀脣莘 - 0.58
[*] 희穽設音?蓀??Hide from peb 壯 張惟桎終?茁增諺性.

燐?狀脣莘 - 0.57
[*] 희穽設音?蓀?穽?城診特 ?穽專嚴憎.
[*] 쿡蓀瞬孼?裔陷診 剪 GetProcessTimes.
[-] 帶調壯 全打 Fake Windows version (壯 荀諺).
 
燐?狀脣莘 - 0.55
[*] 宅綵袍壯 夭窓打 GetTickCount.
[*] 쿡蓀瞬孼?喜窓打 RDTSC.
[*] 尿穽設音?蓀??張 翟腸音杖諺 ServicePack.
[*] 袞日謫?全震麟預尊循?惟?

燐?狀脣莘 - 0.53
[*] 鎭渟綜 崖纖橓?壯軸怏秩 ?釣憎猝性.
[*] 哀蓀瞬孼?裔陷診 剪 NtSetInformationThread.
[*] 尿穽設音?蓀??Fake Windows version.

燐?狀脣莘 - 0.51
[*] 尿穽設音?蓀??GetTickCount
[*] 尿穽設音?蓀??檉迭諺 PEB'?

// 厥夭円陝?:

- 張 釣惟靭庄暢秩 裔艇仲城?灑音?賊狀?惟炡?OllyDbg, 穽?盾誼特牆迹 全打?
   load driver.

- 嚴泣 述 禎靭?泣 壯增尊隅??町說妖? 狀 ?循?剪愉泓 魏惟?桎 牒雨 ?OllyDbg,
   桎 壯哀 翟裔鎭蟻狀 渟釣裔艇增嶢?(Ctrl+F2) 穽謫調壹?

- 町說妖 述脣怏?剪乙哀杷酷 櫛翟緘杖 ?Log (Alt+L), 禎憙佃?穽?渟躁佃 裔艇仲?
   釣惟靭庄暢秩 述增設嶢?蓴?全打??穽績壯泣預尊循潗 Log 壯 穽抑靭?廛矮適.

- 鎭增寮荻贍前?桎蟻惟 壯 Windows 2000 SP4, XP SP2.

- 穽?調灑鎭 ?町說妖佃, 釣惟靭庄暢秩 述幽嶢?穽謫調壹? 惟桎終?溢身 禎靭胞潗
   裔藎滄劉 崖纖橓調 (잿震淳宗證, 牒儼脣薏).

- 穽?張惟拙焉帙迹 調灑鎭 町說妖?釣惟靭庄暢秩 禎穽翟荻城?壯 典嵬妖贍茴迹 OllyDbg,
   悚?禎增典佺杖?町說妖荻.

// 樂梧 ?設桎尊?
 www : hellspawn.nm.ru
 mail: for.hellspawn@gmail.com
------------------------------------------------------------[ 07.07.2008 ]---

invalid-file

올리 디버거 플러그 인으로 안티 디버거 기능으로 보호된고있는 프로그램에 대한 분석을 할때 사용합니다.