Big update, source is private(vxforum.net). Best of existing addons(phantom & strong is crap!).
Code:
Int 0x2e(rEcx & rEdx)
NtQueryInformationProcess(ProcessDebugObjectHandle)
NtQueryInformationProcess(ProcessDebugPort)
NtQueryInformationProcess(ProcessDebugFlags)
NtQueryInformationProcess(InheritedFromUniqueProcessId)
NtTerminateProcess
NtClose(#IH)
NtOpenProcess(Name)
NtOpenProcess(Debug privilege)
NtSetInformationThread(ThreadHideFromDebugger)
NtSetInformationThread(ThreadBreakOnTermination)
NtQueryInformationThread(ThreadBreakOnTermination)
NtCreateFile("\??\SYSER" etc)
NtSetDebugFilterState
NtContinue
NtQueryPerformanceCounter
NtQuerySystemInformation(SystemKernelDebuggerInformation)
NtQuerySystemInformation(SystemProcessInformation, InheritedFromUniqueProcessId)
NtQueryObject(ObjectAllTypesInformation, "DebugObject")
NtRemoveProcessDebug
NtQuerySystemTime
NtSetSystemInformation(SystemVerifierInformation)
NtSetSystemInformation(SystemFlagsInformation)
NtSystemDebugControl
NtQueryObject
- NtQueryInformationProcess(ProcessBreakOnTermination)
- NtSetInformationProcess(ProcessBreakOnTermination)
FindWindow("OLLYDBG" etc)
RtlQueryProcessDebugInformation(RTL_QUERY_PROCESS_HEAP_ENTRIES)
BlockInput()
Time log:
SetTimer()
NtSetTimer
NtDelayExecution
NtWaitForKeyedEvent
NtReleaseKeyedEvent
NtSignalAndWaitForSingleObject
NtWaitForSingleObject
NtWaitForMultipleObjects
NtQuerySystemInformation(SystemTimeOfDayInformation)
Flt.zip
Bookmarks