软件简介

Tuluka 是一个新的、功能强大的反rootkit工具。

Rootkit 是指其主要功能为隐藏其他程式进程的软件，可能是一个或一个以上的软件组合；广义而言，Rootkit也可视为一项技术。

它具有如下特色：

• 检测隐藏进程，驱动和设备(Detects hidden processes, drivers and devices)
• 检测IRP HOOK(Detects IRP hooks)
• 鉴别DRIVER_OBJECT结构中被替换的项(Identifies the substitution of certain fields in DRIVER_OBJECT structure)
• 检查驱动签名(Checks driver signatures)
• 检测和恢复 SSDT HOOK(Detects and restores SSDT hooks)
• 检测全局描述符表中的恶意描述符(Detects suspicious descriptors in GDT)
• IDT HOOK检测(IDT hook detection)
• SYSENTER hook 检测(SYSENTER hook detection)
• 显示列举系统中的所有线程并允许你终止它们(Displays list of system threads and allows you to suspend them)
• IAT和 Inline hook检测 (IAT and Inline hook detection)
• 显示调试寄存器的值,即使这些寄存器正被人控制(Shows the actual values of the debug registers, even if reading these registers is controlled by someone)
• 可以通过地址找出模块中的系统模块地址(Allows you to find the system module by the address within this module)
• 可以显示内核内存的内容并可以将其保存至磁盘(Allows you to display contents of kernel memory and save it to disk)
• 可以dump内核驱动和所有进程的主要模块(Allows you to dump kernel drivers and main modules of all processes)
• 可以终止任何进程(Allows you to terminate any process)
• Is able to dissasemble interrupt and IRP handlers, system services, start routines of system threads and many more
• Allows to build the stack for selected device

介绍内容来自 http://www.pulog.org/tools/1859/Tuluka/