[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

Alvenexoro
2021-02-11 10:00
Nicely put, Cheers.
回复
Nllpinini
2021-01-11 19:12
usa pharmacy http://pharmacy-onlineasxs.com/ 24 hour pharmacy
回复
Nllpinini
2021-01-10 14:12
best canadian online pharmacy http://pharmacy-onlineasxs.com/ 24 hours pharmacy
回复
Emaive
2021-01-07 01:42
slot games <a href="https://onlinecasinofplay.com/#">doubledown casino bonus collector
回复
Karenknoca
2020-11-24 00:56
922221 viagra canada ontario

https://viagratodaybest.com/ - viagra online

i use it viagra 50mg

https://viagraviagra20.com/ - buying viagra on line

enter site buy viagra china

http://viagrayqdd.com/ - buy viagra
回复
Nitaiknoca
2020-11-23 22:53
244821 cialis online buy  uk

http://cialisuyew.com/ - cheap cialis
回复
Caylieknoca
2020-11-23 19:48
cc0021 levitra cialis professionnel

http://cialishhqoeur.com/ - cheap cialis

cialis 20g 4 tablet price

http://cialisooie.com/ - cialis cheap

best price on generic cialis

http://cialisuqpor.com/ - buy cialis online
回复
Zyierknoca
2020-11-23 19:33
751821 click now brand name cialis

https://itcialis20.com/ - acquisto cialis in italia

are online payday loans illegal in virginia

http://loansoloie.com/ - faxless payday advance

places to do community service

https://tabserectilecheap.com/ - erectile dysfunction pills

how to use female cialis

https://tadaladilss.com/ - buy generic cialis
回复
Kemauriknoca
2020-11-23 10:27
is acheter en ligne france

53e7 is tsa

53e7 precio del is en mnm

53e7
回复
Bordasknoca
2020-11-20 11:57
e5a331 i recommend cialis testimonial



http://ciaviagogogo.com/
回复
Pashaknoca
2020-11-20 10:57
238931 san antonio loan companies



http://loansoloie.com/ help writing a story



https://tabserectilecheap.com/
回复
Aracelyknoca
2020-11-20 10:27
3ff231 pay to write literature review



https://tabserectilecheap.com/ is cialis generic available



https://tadaladilss.com/ viagra da 50



https://via1buynow.com/ viagra deutschland schweiz



http://viagener2020.com/
回复
Tarenknoca
2020-11-20 10:12
900c31 like viagra for women



http://viagrayqdd.com/ coupeurs de pilule de cialis



https://viaseptoday.com/
回复
Nidaknoca
2020-11-20 09:27
5f7531 recommended site viagra mexico



http://viagraeuw.com/ viagra leverans stockholm



https://viagratodaybest.com/ viagra pills for sale usa



https://viagraviagra20.com/ cheapest viagra net



http://viagrayqdd.com/
回复
Germanknoca
2020-11-20 08:42
f4d731 holland cialis



http://ciaviagogogo.com/ viagra store in san diego



https://frviagrafrance.com/
回复

发表评论：

Powered by emlog