[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Lowellmiz
2022-08-15 05:14
Amazing many of awesome facts. reputable canadian pharmacy https://canadianpharmacies-24h.com cost prescriptions
Billyscado
2022-08-14 22:56
You actually revealed that terrifically.  https://canadapharmacies-24h.com/
Billyscado
2022-08-13 13:39
Thank you, A good amount of forum posts.
  https://canadapharmacies-24h.com/
Lowellmiz
2022-08-12 19:56
Fantastic info. Thank you. online ed drugs no prescription https://canadianpharmaceuticalsonlineus.com pharmacy discount
Lowellmiz
2022-08-12 11:44
Terrific write ups, Appreciate it! drug canada https://canadianpharmacies-24h.com pharmacie canadienne
Lowellmiz
2022-08-12 03:25
Nicely put, Thanks a lot! online medicine to buy https://canadianpharmaceuticalsonlineus.com canadian pharmacy antiobotics without prescription
Lowellmiz
2022-08-09 10:15
You said this really well! mexican pharmacy https://canadianpharmaceuticalsonlineus.com best 10 online pharmacies
DarrinFup
2022-08-08 15:04
Really lots of awesome info. https://northwestpharmacylabs.com no prior prescription required pharmacy http://onlinepharmacycanadahelp.com canadian pharmaceuticals online
WarrenEsown
2022-08-08 06:28
Fine material. With thanks. https://canadianpharmacyed.com online pharmacy india
WarrenEsown
2022-08-07 19:56
You actually mentioned this exceptionally well. https://canadianrxpillusa.com online pharmacy canada
Randallbib
2022-08-07 08:37
With thanks. An abundance of postings!
https://health21cialis.com prescription prices comparison http://canadianmsnpharmacy.com canadian online pharmacies prescription drugs
WarrenEsown
2022-08-06 04:31
You explained this fantastically! https://canadianpharmaceuticalsrx.com canadian drugs without prescription
Danielatowl
2022-04-22 07:46
<a href=https://perevoz-ngz.ru>перевозка магазинов
</a>
Rosalie1975
2022-04-19 12:45
http://www.chejizhijia.com/space-uid-82111.html
Jestine2018
2022-04-14 08:59
http://btb.club/space-uid-31221.html

发表评论:

Powered by emlog