---[ PhantOm plugin 1.20  ]--------------------------------------------------
      by Hellsp@wn & Archer

|   : 
|  Bronco, kioresk, RSI, lord_Phoenix, HoBleen, Grim Fandango,
|  Guru.eXe, vad8787, PE_Kill.
-----------------------------------------------------------------------------

   OllyDbg (  ).
    :

//  - extremehide.sys

[+] NtQueryInformationProcess.
[+] SetUnhandledExceptionFilter.
[+] OpenProcess.
[+] Invalid Handle.
[+] NtSetInformationThread.
[+] RDTSC.
[+] NtYieldExecution.
[+] NtQueryObject.
[+] NtQuerySystemInformation.
[+] Windows hide.
[+] GetProcessTimes.
[+] NtSetContextThread.

//  - PhantOm.dll

[+] PEB BeingDebugged.
[+] PEB NtGlobalFlag.
[+] GetStartupInfo.
[+] Process Heaps.
[+] GetTickCount.
[!] Protect DRx.
[!] Hide DRx.
[!] Fake Windows version.
[!] Custom Handler.
[+] BlockInput

  - 1.20
[*]     (C0000005).
[*]      .
[*]     (OUTPUT_DEBUG_STRING_EVENT).
[*] int 3  EP  ,    
        .
[*]   BlockInput. ( WinXP)
[*]     (C0000094).
[*]    GetStartupInfo.
[*]     .
[*]     .

  - 1.15
[*]   .

  - 1.10
[*] hook GetProcessTimes -   .
[*] hook NtSetContextThread -   .
[*]     "EP break".
[*]   ,    .
[*]  ini   "DELTARDTSC",    RDTSC.

  - 1.04
[*]     .

  - 1.03
[*]    .

  - 1.01
[*]    .

  - 1.00
[*]    OllyDbg.
[*]  OllyDbg    ImageBase. 

  - 0.60
[*]     (C000001E, 80000001, C000001D).
[*]   int3  EntryPoint.
[*]    GetTickCount.
[*]   -  .

  - 0.58
[*]    Hide from peb   .

  - 0.57
[*]      .
[*]    GetProcessTimes.
[-]   Fake Windows version ( ).
 
  - 0.55
[*]   GetTickCount.
[*]   RDTSC.
[*]      ServicePack.
[*]   . 

  - 0.53
[*]     .
[*]    NtSetInformationThread.
[*]    Fake Windows version.

  - 0.51
[*]    GetTickCount
[*]     PEB'

// :

-      ,     -   OllyDbg,
       (Ctrl+F2) .

-      Log (Alt+L),     
         Log   .

-    Windows 2000 SP4, XP SP2.

-    ,   ,    
     (, ).

-        "" OllyDbg,
     .

//   : 
 www : hellspawn.nm.ru 
 mail: for.hellspawn@gmail.com
------------------------------------------------------------[ 17.09.2007 ]---