Tuluka - 反rootkit工具


未知
Windows

软件简介

Tuluka 是一个新的、功能强大的反rootkit工具。

Rootkit 是指其主要功能为隐藏其他程式进程的软件,可能是一个或一个以上的软件组合;广义而言,Rootkit也可视为一项技术。

它具有如下特色:

  • 检测隐藏进程,驱动和设备(Detects hidden processes, drivers and devices)
  • 检测IRP HOOK(Detects IRP hooks)
  • 鉴别DRIVER_OBJECT结构中被替换的项(Identifies the substitution of certain fields in DRIVER_OBJECT structure)
  • 检查驱动签名(Checks driver signatures)
  • 检测和恢复 SSDT HOOK(Detects and restores SSDT hooks)
  • 检测全局描述符表中的恶意描述符(Detects suspicious descriptors in GDT)
  • IDT HOOK检测(IDT hook detection)
  • SYSENTER hook 检测(SYSENTER hook detection)
  • 显示列举系统中的所有线程并允许你终止它们(Displays list of system threads and allows you to suspend them)
  • IAT和 Inline hook检测 (IAT and Inline hook detection)
  • 显示调试寄存器的值,即使这些寄存器正被人控制(Shows the actual values of the debug registers, even if reading these registers is controlled by someone)
  • 可以通过地址找出模块中的系统模块地址(Allows you to find the system module by the address within this module)
  • 可以显示内核内存的内容并可以将其保存至磁盘(Allows you to display contents of kernel memory and save it to disk)
  • 可以dump内核驱动和所有进程的主要模块(Allows you to dump kernel drivers and main modules of all processes)
  • 可以终止任何进程(Allows you to terminate any process)
  • Is able to dissasemble interrupt and IRP handlers, system services, start routines of system threads and many more
  • Allows to build the stack for selected device

介绍内容来自 http://www.pulog.org/tools/1859/Tuluka/