[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

cheap viagra 100mg
10 分钟前
This post is invaluable. When can I find out more?
回复
buy generic viagra
12 分钟前
Hahahahahahaha, this politics related YouTube video is actually so humorous, I loved it. Thanks for sharing this.
回复
viagra for sale
47 分钟前
Please add other videos related to cooking if you have, as I would like to learn more and more concerning all recipes of cooking.
回复
viagra cost
54 分钟前
Hurrah! Its also fastidious post about JavaScript, I am truly keen of learning JavaScript. thanks admin
回复
viagra coupon
约 1 小时前
It’s in fact very difficult in this active life to listen news on Television, thus I just use the web for that purpose, and get the newest news.
回复
sildenafil 100mg
约 1 小时前
Hi there to every body, it’s my first pay a quick visit of this web site; this webpage contains remarkable and really good data designed for readers.
回复
viagra pills
约 1 小时前
Hi mates, I am for a second time here, and reading this post related to SEO, its also a good post, so keep it up.
回复
viagra for sale
约 1 小时前
Yup, you are accurate Google is the most excellent in support of blogging, Google’s web site as well appear quickly in search engines too.
回复
cheap 100mg viagra
约 1 小时前
This video post is actually great, the noise quality and the picture feature of this film post is genuinely awesome.
回复
100 mg viagra
约 1 小时前
Fastidious answer back in return of this question with real arguments and explaining everything on the topic of that.
回复
buy 100 mg viagra
约 2 小时前
If you apply these kinds of strategies for increasing traffic on your own weblog, I am certainly you will see the change in few days.
回复
cheap viagra 50 mg
约 2 小时前
This paragraph about how to embed a YouTube video code is genuinely useful designed for fresh web visitors. Fastidious occupation, keep it up.
回复
female viagra pills
约 3 小时前
What a fastidious YouTube video it is! Amazing, I liked it, and I am sharing this YouTube film with all my friends.
回复
women viagra
约 3 小时前
You have to waste less time to explore your necessary matter on internet, as nowadays the searching techniques of search engines are fastidious. That’s why I fount this paragraph here.
回复
viagra online
约 3 小时前
This piece of writing will help the internet people for setting up new webpage or even a weblog from start to end.
回复

发表评论：

Powered by emlog