[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

Lowellmiz
2022-08-15 05:14
Amazing many of awesome facts. reputable canadian pharmacy https://canadianpharmacies-24h.com cost prescriptions
回复
Billyscado
2022-08-14 22:56
You actually revealed that terrifically.  https://canadapharmacies-24h.com/
回复
Billyscado
2022-08-13 13:39
Thank you, A good amount of forum posts.
  https://canadapharmacies-24h.com/
回复
Lowellmiz
2022-08-12 19:56
Fantastic info. Thank you. online ed drugs no prescription https://canadianpharmaceuticalsonlineus.com pharmacy discount
回复
Lowellmiz
2022-08-12 11:44
Terrific write ups, Appreciate it! drug canada https://canadianpharmacies-24h.com pharmacie canadienne
回复
Lowellmiz
2022-08-12 03:25
Nicely put, Thanks a lot! online medicine to buy https://canadianpharmaceuticalsonlineus.com canadian pharmacy antiobotics without prescription
回复
Lowellmiz
2022-08-09 10:15
You said this really well! mexican pharmacy https://canadianpharmaceuticalsonlineus.com best 10 online pharmacies
回复
DarrinFup
2022-08-08 15:04
Really lots of awesome info. https://northwestpharmacylabs.com no prior prescription required pharmacy http://onlinepharmacycanadahelp.com canadian pharmaceuticals online
回复
WarrenEsown
2022-08-08 06:28
Fine material. With thanks. https://canadianpharmacyed.com online pharmacy india
回复
WarrenEsown
2022-08-07 19:56
You actually mentioned this exceptionally well. https://canadianrxpillusa.com online pharmacy canada
回复
Randallbib
2022-08-07 08:37
With thanks. An abundance of postings!
https://health21cialis.com prescription prices comparison http://canadianmsnpharmacy.com canadian online pharmacies prescription drugs
回复
WarrenEsown
2022-08-06 04:31
You explained this fantastically! https://canadianpharmaceuticalsrx.com canadian drugs without prescription
回复
Danielatowl
2022-04-22 07:46
<a href=https://perevoz-ngz.ru>перевозка магазинов
</a>
回复
Rosalie1975
2022-04-19 12:45
http://www.chejizhijia.com/space-uid-82111.html
回复
Jestine2018
2022-04-14 08:59
http://btb.club/space-uid-31221.html
回复

发表评论：

Powered by emlog