PhantOm V1.25 修正 [PhantOm plugin 1.25 ] by Hellsp @ wn & Archer / / spring aggravation: / / IHA! PEOPLE WITH ALL DAY! SPRING WALKS! BEER begins! GULYAYTE DEVUSHKAMI X! / / ZHIVITE FULL LIFE! | Privety fly to: | Bronco, kioresk, RSI, lord_Phoenix, HoBleen, Grim Fandango, | Guru.eXe, vad8787, PE_Kill. ————————————————– ————————— The plug to hide OllyDbg (with driver). Helps detection of the following methods: / / driver - extremehide.sys [+] NtQueryInformationProcess. [+] SetUnhandledExceptionFilter. [+] OpenProcess. [+] Invalid Handle. [+] NtSetInformationThread. [+] RDTSC. [+] NtYieldExecution. [+] NtQueryObject. [+] NtQuerySystemInformation. [+] Windows hide. [+] GetProcessTimes. [+] NtSetContextThread. / / plug - PhantOm.dll [+] PEB BeingDebugged. [+] PEB NtGlobalFlag. [+] GetStartupInfo. [+] Process Heaps. [+] GetTickCount. [!] Protect DRx. [!] Hide DRx. [!] Fake Windows version. [!] Custom Handler. [+] BlockInput What’s New - 1.25 You may now ask the very name services HIDENAME and RDTSCNAME. Some minor bugs. Fixed bug with memory breakpoints. What’s New - 1.20 Added own processing exceptions (C0000005). Added the title change of the main window. Added own processing exceptions (OUTPUT_DEBUG_STRING_EVENT). int 3 at EP correctly removed if the stop at the point of the system failed. Added BlockInput interception. (WinXP only) Added own processing exceptions (C0000094). Added hide from GetStartupInfo. Fixed bug with the settings plug. Added protection from detection drivers. What’s New - 1.15 Several bugs. What’s New - 1.10 hook GetProcessTimes - moved to the driver. hook NtSetContextThread - moved to the driver. The bug and removing the “EP break.” Several bugs related to downloading options. In ini added “DELTARDTSC which will regulate the spread RDTSC. What’s New - 1.04 Fixed bsod while loading drivers. What’s New - 1.03 Fixed bug with windows. What’s New - 1.01 Fixed bug in the driver. What’s New - 1.00 Added protection OllyDbg windows. Now OllyDbg patchitsya regardless of ImageBase. What’s New - 0.60 Added own processing exceptions (C000001E, 80000001, C000001D). Added removal int3 with EntryPoint. Fixed bug with GetTickCount. Added methods in anti-detekta driver. What’s New - 0.58 Fixed bug with Hide from peb on some systems. What’s New - 0.57 Fixed bug with the attachment to the process. Added protection from GetProcessTimes. [-] Removed option Fake Windows version (at the time). What’s New - 0.55 Improved imulyatsiya GetTickCount. Added emulation RDTSC. Fixed bug with not zeroing ServicePack. A bit optimized code. What’s New - 0.53 Now the driver is in resources. NtSetInformationThread added protection. Fixed bug with Fake Windows version. What’s New - 0.51 Fixed bug in the GetTickCount Fixed bug with a patch PEB ‘and / / Notes: – if you have changed the settings in the plug, but you open any file in OllyDbg, necessarily have to restart it (Ctrl-F2) program. – plug-in displays debug messages Log (Alt + L), so the first run advised to put all the options and examine the Log for errors. – tested only on Windows 2000 SP4, XP SP2. – with the plug, it is recommended to turn off programs that can prevent loading drivers (Antivirus, PC). – incorrect in the work are encouraged to try to plug the “native” OllyDbg, without extraneous plugins.

Immunity Debugger v1.73修改版+支持OD所有插件 更换了个图标.基本上支持OD所有的插件.目前发现不支持海风大牛的StrongOD. 压缩包里有个原版本的ImmunityDebugger.exe,因为ImmunityDebugger不支持修 改plugin目录名,所以稍微修改了下,使用原版的ImmunityDebugger.exe对应的插 件目录是old_plugin.修改版本支持OD插件的名字为ollydbg.exe,使用的时候不要 更改文件名,否则无法正确加载OD插件.

OD插件汉化版

od插件开发包plug1101.rar

OD插件开发实战.doc

OllyFindAddr.dll 搜寻特定指令用的插件 插件出自《0day》一书

一个很好用的断点/注释/标签保存插件 ，方便下次调试时载入。不需要UDD文件。

打开软件OD，使用快捷键 Ctrl+G 打开表达式窗口， 输入WinApi名称，可以显示Win32 API列表. 使用方法：复制 IdaFicator.dll文件到plusin目录下，即可。 适用版本 OD2.01 吾爱专版等。

OD插件开发中文帮助手册 API MSDN OLLYDBG OD 必备的插件开发手册

用于OllyDbg,复制到OD目录下PLUGIN就可以了。