Tuluka
Tuluka 是一个新的强大的 AntiRootkit，它具有以下特点：
检测隐藏的进程、驱动程序和设备
检测 IRP 钩子
标识 DRIVER_OBJECT 结构中某些字段的替换
检查驱动程序签名
检测并恢复 SSDT 钩子
检测 GDT 中的可疑描述符
IDT 钩子检测
SYSENTER 钩子检测
显示系统线程列表并允许您挂起它们
IAT 和内联挂钩检测
显示调试寄存器的实际值，即使读取这些寄存器是由某人控制的
允许您通过此模块内的地址找到系统模块
允许您显示内核内存的内容并将其保存到磁盘
允许您转储所有进程的内核驱动程序和主要模块
允许您终止任何进程
能够分解中断和 IRP 处理程序、系统服务、启动系统线程的例程等等
允许为所选设备构建堆栈
多得多..
(Tuluka is a new powerful AntiRootkit, which has the following features:
Detects hidden processes, drivers and devices
Detects IRP hooks
Identifies the substitution of certain fields in DRIVER_OBJECT structure
Checks driver signatures
Detects and restores SSDT hooks
Detects suspicious descriptors in GDT
IDT hook detection
SYSENTER hook detection
Displays list of system threads and allows you to suspend them
IAT and Inline hook detection
Shows the actual values of the debug registers, even if reading these registers is controlled by someone
Allows you to find the system module by the address within this module
Allows you to display contents of kernel memory and save it to disk
Allows you to dump kernel drivers and main modules of all processes
Allows you to terminate any process
Is able to dissasemble interrupt and IRP handlers, system services, start routines of system threads and many more
Allows to build the stack for selected device
Much more..)
页:
[1]