[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

RobertBioks
2019-11-26 02:54
my site - http://withoutdoctorsprescript.us/taking-viagra-with-cialis
Hectorvig
2019-11-25 19:16
Here is my web-site ... http://cialisfordailyuse.store/ed-pills-online-from-india
ShawnDed
2019-11-25 18:38
Also visit my web blog :: https://www.buygenericviagra69.com/female-viagra-effects-on-men
Travisfah
2019-11-25 09:05
Feel free to visit my web site  https://genericviagracheaply.com/goodrx-discount-coupon
ShawnDed
2019-11-25 00:10
Also visit my blog post: https://www.buygenericviagra69.com/viagra-100mg-pill-on-ebay
HowardLat
2019-11-24 13:36
Have a look at my blog: https://viagraxcv.com/fast-viagra-delivery
BradleyVon
2019-11-24 02:11
Also visit my homepage - https://www.v1agrabuy.com/viagra-for-old-men
RobertBioks
2019-11-23 20:44
Here is my web page ... http://withoutdoctorsprescript.us/red-viagra-200mg-pills-generic
HowardLat
2019-11-23 20:02
Review my blog post; https://viagraxcv.com/female-viagra-medication
ClydeEmazy
2019-11-22 17:10
Also visit my site - https://www.jennifermed.com/
ShawnDed
2019-11-22 14:12
Take a look at my blog - https://www.buygenericviagra69.com/
RobertBioks
2019-11-22 00:13
Feel free to surf to my homepage; http://withoutdoctorsprescript.us/
ZehinFrary
2019-11-18 13:57
viagra price users browsing this forum
http://viagforsale.com - viagra generica espana
  viagra pills canada you have posted in this thread
<a href="http://viagforsale.com">lowest price for generic viagra
</a> - levitra viagra viagra
viagra 20mg coupons faq
Zesseutist
2019-11-15 03:33
viagra and viagra
http://viagrawithoutdoctorbest.com - generic viagra in us pharmacies
  generic viagra tadalafil low prices
<a href="http://viagrawithoutdoctorbest.com">generic viagra shipped from usa
</a> - viagra 10 mg 4 tablet topics
possible viagra effects sperm production
Roberturjj
2019-11-13 22:05
Best Generic Viagra viagraxcv.com - Generic Viagra Sildenafil

发表评论:

Powered by emlog