[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

ZonaldNug
约 4 小时前
viagra vs viagra vs levitra joyful.cgi
http://viagrawithoutdoctorpres.net - what is the generic for viagra
  viagra and alcohol consumption joined
<a href="http://viagrawithoutdoctorpres.net">cheap generic viagra online pharmacy
</a> - buy cheap viagra online
alternative viagra viagra viagra alternatives uk
ZonaldNug
约 5 小时前
buy viagra generic
http://viagrawithoutdoctorpres.net - viagra generic name joke
  viagra online overnight you cannot edit your posts in this forum
<a href="http://viagrawithoutdoctorpres.net">generic viagra on line
</a> - viagra 20mg you cannot delete your posts in this forum
viagra cost per pill moderators
ZarlosFrows
约 22 小时前
buy discount levitra online
http://levitragtx.com - buy generic levitra cheap
  levitra buy announcements
<a href="http://levitragtx.com">generic levitra usa
</a> - levitra 20mg topics
levitra and alcohol interaction new posts
Deborahrah
2019-10-14 21:18
https://eclub.vn/forums/topic/6197/
http://starway.guru/forums/user/highstumarter/edit/?updated=true
http://www.universalenglishglobal.com/forums/topic/5734/
https://igualaccion.es/forums/topic/8067/
http://saladepalpites.com/palpites/users/diocleanwinspal/edit/?updated=true
http://dickscave.com/forums/topic/486/
https://www.w4ke.com/wakeforum/topic/4546/
https://camdr.ca/forums/user/rerichlatest/edit/?updated=true
https://www.genitoredigitale.com/forums/topic/2439/
https://www.gen-gen.ch/https:/www.gen-gen.ch/forums/users/barnapharo/edit/?updated=true
https://diysmartdesk.com/forums/users/nestmabuwi/edit/?updated=true
https://www.gallopingghostarcade.com/forums/users/lecfidicse/edit/?updated=true
http://frugaldrifter.com/forums/topic/4022/
https://caelumlore.com/forums/user/peodibesporth/edit/?updated=true
https://educationservicesworldwide.com/forums/topic/689/
https://starprental.com/forums/topic/9217/
http://seowara.ru/forums/topic/7861/
https://biafra.live/forums/topic/1107/
http://acdtraining.com/forums/topic/9945/
https://codingson.com/forums/topic/3192/
Zliffhow
2019-10-13 15:16
cialis drug online prescription soma
http://walmart-cialis.net - cialis over the counter at walmart
  cialis 20mg side effects usergroups
<a href="http://walmart-cialis.net">cialis walmart
</a> - cialis generic uk
cialis coupon previous next
Ziltiampen
2019-10-09 11:19
subaction showcomments viagra smile online
http://xlviagravfs.com - generic viagra online overnight delivery
  viagra 10mg or 20mg name
<a href="http://xlviagravfs.com">india viagra generic
</a> - viagra 20 mg coupon views
viagra generic 20 mg forum
Aarontic
2019-10-09 01:07
http://tadalafilg8.com - tadalafilg8
http://antabuse0i0.com - antabuse0i0.com
http://lisinoprila4.com - lisinoprila4
http://sildenafild6j.com - sildenafild6j
http://antabused6j.com - antabused6j
Ziltiampen
2019-10-08 12:28
viagra viagra comparison
http://xlviagravfs.com - generic viagra in us
  canadian pharmacy viagra 20mg joined
<a href="http://xlviagravfs.com">generic viagra canada online
</a> - should i take viagra before or after i eat
online pharmacy usa
OrvilzeShush
2019-10-05 09:07
viagra reviews side effects community
http://xlviagragen.com - generic viagra prescription
  comprar viagra
<a href="http://xlviagragen.com">generic viagra side effects
</a> - cardiomyopathy and viagra risk women
viagra &amp; cheap
Zerricklip
2019-10-04 04:55
free shipping viagra cheap
http://viagforsale.com - generic viagra professional
  effects of viagra soft on women
<a href="http://viagforsale.com">generic viagra online without prescription
</a> - viagra tadalafil canada comments.htm
how soon does viagra work light.cgi
Zerricklip
2019-10-03 06:40
retalis viagra
http://viagforsale.com - generic viagra at walmart
  failure of viagra to work
<a href="http://viagforsale.com">cialis generic viagra
</a> - online apotheke viagra viagra levitra
viagra 20 mg 8 table i forgot my password
Cindydhsnigo
2019-09-26 14:03
cialis online http://cialissoftp.com/#  cialis 5 mg
Cindyossnigo
2019-09-24 19:40
order cialis online http://sildenafilsr.com/#  cialis canada
Aarontic
2019-08-29 21:14
http://advair.us.com/ - generic for advair diskus
Aarontic
2019-08-29 06:41
http://viagrabillig-kaufen.com/ - canadian viagra

发表评论:

Powered by emlog