Tuluka

Tuluka 介绍

Tuluka 是一个新的、功能强大的反rootkit工具。

Rootkit 是指其主要功能为隐藏其他程式进程的软件，可能是一个或一个以上的软件组合；广义而言，Rootkit也可视为一项技术。

它具有如下特色：

检测隐藏进程，驱动和设备(Detects hidden processes, drivers and devices)
检测IRP HOOK(Detects IRP hooks)
鉴别DRIVER_OBJECT结构中被替换的项(Identifies the substitution of certain fields in DRIVER_OBJECT structure)
检查驱动签名(Checks driver signatures)
检测和恢复 SSDT HOOK(Detects and restores SSDT hooks)
检测全局描述符表中的恶意描述符(Detects suspicIoUs descriptors in GDT)
IDT HOOK检测(IDT hook detection)
SYSENTER hook 检测(SYSENTER hook detection)
显示列举系统中的所有线程并允许你终止它们(displays list of system threads and allows you to suspend them)
IAT和 Inline hook检测 (IAT and Inline hook detection)
显示调试寄存器的值,即使这些寄存器正被人控制(Shows the actual values of the debug registers, even if reading these registers is controlled by someone)
可以通过地址找出模块中的系统模块地址(Allows you to find the system module by the address within this module)
可以显示内核内存的内容并可以将其保存至磁盘(Allows you to display contents of kernel memory and save it to disk)
可以dump内核驱动和所有进程的主要模块(Allows you to dump kernel drivers and main modules of all processes)
可以终止任何进程(Allows you to terminate any process)
Is able to dissasemble interrupt and IRP handlers, system services, start routines of system threads and many more
Allows to build the stack for selected device