[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

Aarontic
2019-08-21 01:19
http://bupropion.wtf/ - bupropion
回复
Aarontic
2019-08-20 10:40
http://buyviagrasoft.us.org/ - buy viagra soft
回复
Aarontic
2019-08-15 10:41
http://markcrozermusic.com/ - Wellbutrin Order Online
回复
Germanknoca
2019-08-15 02:45
is en espana sin receta

     4a57 is tablet in switzerland
回复
Germanknoca
2019-08-14 20:51
cheap is online canada

     4a57 craigslist is for sale
回复
Aarontic
2019-08-12 22:34
http://viagra.us.org/ - via gra
回复
Aarontic
2019-08-12 07:27
http://allopurinol.recipes/ - allopurinol zyloprim
回复
HeatherDRofe
2019-08-11 04:10
http://brandon-enovation.co.za/groups/online-slots-real-money-89070
http://namibiaictforum.com/groups/real-money-online-casino-86121
http://bizcom.link/groups/best-online-casino-real-money-93487
http://pttmnatural.com/groups/online-casinos-real-money-87914
http://www.myeducationalshop.com/groups/a-little-computer-understanding-that-you-can-understand/forum/topic/casino-real-money-games-92666/#post-2653
http://afrimart.org.au/groups/casino-real-money-games-92524
https://adorebikes.com/forums/topic/online-games-real-money-99222/
http://invisiblefighter.com/groups/online-casinos-real-money-91829
https://bakingintelligence.com/forums/user/probasco1970
https://extreme-gaming.pro/forums/topic/casino-real-money-80689/
http://www.cultivatestclair.com/forums/user/eraduc1979
http://kimovskiypni.ru/forums/topic/online-casinos-real-money-92116/
http://hanaylie.id/forums/topic/online-casinos-real-money-87281/
https://bakingintelligence.com/forums/topic/real-money-casino-92223/
https://ednak.org/forums/user/ephcomma1986
https://www.thewellnashville.com/groups/online-casino-real-money-usa-84455
https://polistuds.com/groups/online-casinos-real-money-84078
http://lettrines-enluminure.fr/forums/topic/real-money-online-casino-90238/
http://worldizen.org/forums/user/zieconfi1981
http://meetmyfetish.com/forums/topic/casino-real-money-80266/
回复
trantyRurdyspusty
2019-08-10 17:25
tadalafil 20 mg online pharmacy http://cialsonlinebei.com online cialis, nhs side effects of sildenafil
回复
Rannevknoca
2019-08-09 11:59
try it is price online
回复
Rannevknoca
2019-08-08 18:45
barato is suave
回复
Rannevknoca
2019-08-07 23:12
viagra e cialis onlin
回复
Rannevknoca
2019-08-07 21:27
generisches online is
回复
Galyaknoca
2019-08-07 14:57
4dca is 20 mg blister

http://ph-09b15-2-1.com/ - at is
    

next day ise
回复
Aarontic
2019-08-07 08:20
http://wellbutrin.run/ - wellbutrin
回复

发表评论：

Powered by emlog