[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

buy tadalafil
26 分钟前
Hello to all, how is the whole thing, I think every one is getting more from this web site, and your views are nice in support of new visitors.
buy 20 mg cialis
约 1 小时前
Hmmm, yup no uncertainty Google is most excellent in support of blogging but now word press is also good as a blogging since its Search engine optimization is pleasant defined already.
buy tadalafil
约 1 小时前
Wow, that’s what I was exploring for, what a material! existing here at this blog, thanks admin of this website.
cialis daily
约 1 小时前
I all the time used to study paragraph in news papers but now as I am a user of internet so from now I am using net for articles, thanks to web.
cheap 20 mg cialis
约 1 小时前
Every weekend i used to go to see this site, because i want enjoyment, since this this web page conations really good funny data too.
buy cialis 20mg
约 2 小时前
|When I want to place gallery or LightBox or yet a slider on my web page I always try to use jQuery script in favor of that.
buy tadalafil
约 2 小时前
This post regarding SEO provides clear idea designed for new SEO users that how to do SEO, so keep it up. Nice work
buy tadalafil
约 2 小时前
I think a visualized presentation can be superior then simply a effortless text, if things are defined in pictures one can without difficulty be familiar with these.
buy 20mg cialis
约 3 小时前
If you apply these kinds of methods for increasing traffic on your own weblog, I am sure you will see the change in few days.
Walterkam
约 3 小时前
I have seen something very similar in a different thread. You might find some parts of that post helpful, not everything obviously, but I believe it is worth checking out.
http://www.pokertexas-holdem.it/extremely-versatile-special-discounts-and-the/
cialis for daily use
约 3 小时前
Can you tell us more about this? I'd like to find out some additional information.
cheap cialis
约 3 小时前
For newest news you have to go to see world-wide-web and on world-wide-web I found this web site as a finest site for latest updates.
coupon cialis
约 4 小时前
I am truly grateful to the holder of this web site who has shared this impressive piece of writing at at this place.
canadian cialis
约 5 小时前
Wonderful, what a webpage it is! This web site provides valuable facts to us, keep it up.
cialis online
约 5 小时前
Wow, this piece of writing is pleasant, my sister is analyzing such things, therefore I am going to inform her.

发表评论:

Powered by emlog