From Collaborative RCE Tool Library
PhantOm
| Tool name: | PhantOm |
|
||
|---|---|---|---|---|
| Author: | Hellsp@wn & Archer | |||
| Website: | N/A | |||
| Current version: | 1.30 | |||
| Last updated: | July 7, 2008 | |||
| Direct D/L link: | Locally archived copy | |||
| License type: | Free | |||
| Description: | Plugin (with driver) for hiding OllyDbg from following methods of detection: // driver - extremehide.sys [+] NtQueryInformationProcess. [+] SetUnhandledExceptionFilter. [+] OpenProcess. [+] Invalid Handle. [+] NtSetInformationThread. [+] RDTSC. [+] NtYieldExecution. [+] NtQueryObject. [+] NtQuerySystemInformation. [+] Windows hide. [+] GetProcessTimes. [+] NtSetContextThread. // plugin - PhantOm.dll [+] PEB BeingDebugged. [+] PEB NtGlobalFlag. [+] GetStartupInfo. [+] Process Heaps. [+] GetTickCount. [!] Protect DRx. [!] Hide DRx. [!] Fake Windows version. [!] Custom Handler. [+] BlockInput What's new - 1.30 [*] Captions of main and cpu windows can be manually set (CAPTEXT and PRETEXT in OllyDbg's ini-file). By default, they are named "PhantOm" and "o_O". [*] Fixed some bugs in "custom handler exceptions" feature [*] Other minor fixes What's new - 1.26 [*] Fixed bug with loading driver [*] Fixed bug with memory breakpoints (Now, when "custom handler exceptions" option is checked - memory breapoints on access/write will work, but break-on-access won't work) [*] Fixed bug with updating plugin (after previous version) What's new - 1.25 [*] Now you can manually set names of services (HIDENAME and RDTSCNAME) [*] Fixed some minor bugs [*] Fixed bug with memory breakpoints What's new - 1.20 [*] Added own exception handler (C0000005) [*] Added option to change caption of main OllyDbg window [*] Added own exception handler (OUTPUT_DEBUG_STRING_EVENT) [*] Impoved removing of int 3 breakpoint at EP, when pause is set to "system breakpoint" [*] Added hook for BlockInput (only for Windows XP) [*] Added own exception handler (C0000094) [*] Added hide from GetStartupInfo [*] Fixed bug with plugin options [*] Added protection from detecting driver |
|||
| Related URLs: |
|
|||
| Screenshot: |
|---|
 |
Feed containing all updates for this tool.
(please also edit it if you think it fits well in some additional category, since this can also be controlled)
