[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

buy tadalafil
26 分钟前
Hello to all, how is the whole thing, I think every one is getting more from this web site, and your views are nice in support of new visitors.
回复
buy 20 mg cialis
约 1 小时前
Hmmm, yup no uncertainty Google is most excellent in support of blogging but now word press is also good as a blogging since its Search engine optimization is pleasant defined already.
回复
buy tadalafil
约 1 小时前
Wow, that’s what I was exploring for, what a material! existing here at this blog, thanks admin of this website.
回复
cialis daily
约 1 小时前
I all the time used to study paragraph in news papers but now as I am a user of internet so from now I am using net for articles, thanks to web.
回复
cheap 20 mg cialis
约 1 小时前
Every weekend i used to go to see this site, because i want enjoyment, since this this web page conations really good funny data too.
回复
buy cialis 20mg
约 2 小时前
|When I want to place gallery or LightBox or yet a slider on my web page I always try to use jQuery script in favor of that.
回复
buy tadalafil
约 2 小时前
This post regarding SEO provides clear idea designed for new SEO users that how to do SEO, so keep it up. Nice work
回复
buy tadalafil
约 2 小时前
I think a visualized presentation can be superior then simply a effortless text, if things are defined in pictures one can without difficulty be familiar with these.
回复
buy 20mg cialis
约 3 小时前
If you apply these kinds of methods for increasing traffic on your own weblog, I am sure you will see the change in few days.
回复
Walterkam
约 3 小时前
I have seen something very similar in a different thread. You might find some parts of that post helpful, not everything obviously, but I believe it is worth checking out.
http://www.pokertexas-holdem.it/extremely-versatile-special-discounts-and-the/
回复
cialis for daily use
约 3 小时前
Can you tell us more about this? I'd like to find out some additional information.
回复
cheap cialis
约 3 小时前
For newest news you have to go to see world-wide-web and on world-wide-web I found this web site as a finest site for latest updates.
回复
coupon cialis
约 4 小时前
I am truly grateful to the holder of this web site who has shared this impressive piece of writing at at this place.
回复
canadian cialis
约 5 小时前
Wonderful, what a webpage it is! This web site provides valuable facts to us, keep it up.
回复
cialis online
约 5 小时前
Wow, this piece of writing is pleasant, my sister is analyzing such things, therefore I am going to inform her.
回复

发表评论：

Powered by emlog