Tuluka Kernel Inspector V1.0.394.77

ikimi

Tuluka 是一个新的、功能强大的反rootkit工具。

Tuluka is tested on the following operating systems(32-bit):

• Windows XP SP0 SP1 SP2 SP3
• Windows Server 2003 SP0 SP1 SP2 R2
• Windows Vista SP0 SP1 SP2
• Windows Server 2008 SP0 SP1 SP2
• Windows 7 SP0 SP1
  

Work on other versions of the operating system is not guaranteed.
You use this software at your own risk. The author makes no warranty.

它具有如下特色：

检测隐藏进程，驱动和设备(Detects hidden processes, drivers and devices)

检测IRP HOOK(Detects IRP hooks)

鉴别DRIVER_OBJECT结构中被替换的项(Identifies the substitution of certain fields in DRIVER_OBJECT structure)

检查驱动签名(Checks driver signatures)

检测和恢复 SSDT HOOK(Detects and restores SSDT hooks)

检测全局描述符表中的恶意描述符(Detects suspicious descriptors in GDT)

IDT HOOK检测(IDT hook detection)

SYSENTER hook 检测(SYSENTER hook detection)

显示列举系统中的所有线程并允许你终止它们(Displays list of system threads and allows you to suspend them)

IAT和 Inline hook检测 (IAT and Inline hook detection)

显示调试寄存器的值,即使这些寄存器正被人控制(Shows the actual values of the debug registers, even if reading these registers is controlled by someone)

可以通过地址找出模块中的系统模块地址(Allows you to find the system module by the address within this module)

可以显示内核内存的内容并可以将其保存至磁盘(Allows you to display contents of kernel memory and save it to disk)

可以dump内核驱动和所有进程的主要模块(Allows you to dump kernel drivers and main modules of all processes)

可以终止任何进程(Allows you to terminate any process)

下载：

http://www.tuluka.org/Download.html

kxmp

好工具啊

1e3e

不错，收藏了

寂寞无眠

好像没中文的  期待汉化

dl123100

会hook page fault handler 比较危险