[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

ScottGuith
2020-08-26 14:08
Perfectly spoken indeed. . canada meds http://rxpharmacymsn.com/order-minocin-online-en.html prescription cost
ScottGuith
2020-08-26 08:16
Cheers, An abundance of data!
cialis canadian pharmacy http://topcialisrxstore.com/order-levitra-online-en.html canadian prescriptions
ScottGuith
2020-08-26 06:50
Many thanks, Ample knowledge!
overseas pharmacy forum http://canadianpharmacyed.com/order-epivir-online-en.html canada online pharmacies
ScottGuith
2020-08-25 23:26
You said it perfectly.. best online pharmacies canada http://canadianpharmaciesmsn.com/order-kamagra_flavored-online-en.html list of approved canadian pharmacies
ScottGuith
2020-08-25 16:11
Amazing info, Thanks! online pharmacy busted http://canadianpharmacyed.com/order-stendra-online-en.html buy generic viagra online
RobertBap
2020-08-25 08:12
Seriously quite a lot of very good info. pharmacy drugstore online https://homeworkcourseworkhelps.com canada drugs
RobertBap
2020-08-24 23:24
Well expressed truly. ! prescription drug price comparison https://canadianpharmacyfirst.com pharmacy online no prescription
RobertBap
2020-08-23 23:17
Wow tons of terrific tips. most reliable canadian pharmacies https://topswritingservices.com cheap medications
ScottGuith
2020-08-23 23:14
Superb data. With thanks. trusted online pharmacy reviews http://topcialisrxpills.com/order-lamisil-online-en.html ed meds online without doctor prescription
ScottGuith
2020-08-23 06:06
Awesome information. Cheers. cialis pharmacy online http://canadianpharmaceuticalsrx.com/order-loxitane-online-en.html canadian prescription drugs
MelvineBaf
2020-08-22 23:30
Really plenty of great info!
http://www.samawi.com/__media__/js/netsoltrademark.php?d=canadianpharmacyfirst.com http://smsinavi.com/__media__/js/netsoltrademark.php?d=topcialisrxpills.com http://mothersarmy.org/__media__/js/netsoltrademark.php?d=canadianpharmacyed.com http://mydomainsecurity.com/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://canyonranchloscabos.com/__media__/js/netsoltrademark.php?d=cadmedbb.com http://boston-common.net/__media__/js/netsoltrademark.php?d=canadianpharmacy-us.com http://warfareboats.com/__media__/js/netsoltrademark.php?d=cadmedbb.com http://digitalcast.tv/__media__/js/netsoltrademark.php?d=msnviagrarx.com
KeitrSax
2020-08-22 22:51
Nicely put. With thanks! canadian drugs online pharmacy https://msnviagrarx.com discount prescription drug
MelvineBaf
2020-08-22 21:53
You made your point very clearly!.
http://scvh20.net/__media__/js/netsoltrademark.php?d=csvcialis.com http://airambulancerankings.com/__media__/js/netsoltrademark.php?d=canadianpharmacyfirst.com http://valoanquestions.org/__media__/js/netsoltrademark.php?d=canadianpharmaciesrxstore.com http://rhinelanderrealty.com/__media__/js/netsoltrademark.php?d=canadianpharmacyfirst.com http://kburton.com/__media__/js/netsoltrademark.php?d=canadianpharmaciesmsn.com http://adameiseman.org/__media__/js/netsoltrademark.php?d=msnviagrarx.com http://frankfurt-tips.com/__media__/js/netsoltrademark.php?d=ntviagrausa.com http://tedxtravel.com/__media__/js/netsoltrademark.php?d=canadianpharmaceuticalsrx.com http://internettutorsolution.com/__media__/js/netsoltrademark.php?d=cadmedbb.com http://oneheartmeditation.com/__media__/js/netsoltrademark.php?d=canadiantoprxstore.com http://www.hartfordclassaction.biz/__media__/js/netsoltrademark.php?d=canadianrxpillusa.com http://robosep.eu/__media__/js/netsoltrademark.php?d=topcialisrxpills.com
MelviBaf
2020-08-22 20:29
Appreciate it, Numerous content!  
http://mega-xxx.net/go.php?url=https://canadianrxpillusa.com http://school.js88.com/redirect?url=https://topcialisrxstore.com https://maps.google.cl/url?q=https://cadmedbb.com http://www.lightstone.co.za/avm/content/login/redir.aspx?u_id=5f71ce45-a620-4fac-a599-ba09abbf8f16&url=https://canadianpharmaciesrxstore.com http://www.immoflash.at/redirect.php?url=https://topviagrarxpills.com http://horses.derbfactory.net/link.php?t=0&u=f1902c80-3bfe-1659-4719-fbf4cb8993e4&link=https://topviagrarxpills.com http://apps.sgia.org/vts/hitcounter.cfm?tbl=vts.company&fld=companysiteaccessed&idfld=mbrno&idvalue=161003&goto=https://msncialis.com http://www.porn4pussy.com/d/out?p=9&id=2388450&c=3&url=https://cadmedbb.com http://momnudist.net/outlink.php?l=MzF4NHgxMDk1&url=https://canadianpharmacy-us.com https://modsking.com/download.php?id=25865&url=https://topcialisrxstore.com
MelvineBaf
2020-08-22 18:36
Really a lot of excellent facts.
http://thepurplebar.com/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://imperial-theater.org/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://dallastriallawyers.com/__media__/js/netsoltrademark.php?d=topcialisrxstore.com http://beachstand.net/__media__/js/netsoltrademark.php?d=topviagrarxpills.com http://nicholasvperricone.com/__media__/js/netsoltrademark.php?d=msncialis.com http://sacramentorvshows.com/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://harrisonsones.com/__media__/js/netsoltrademark.php?d=topcialisrxpills.com http://fortress-systems.net/__media__/js/netsoltrademark.php?d=canadianpharmaciesmsn.com

发表评论:

Powered by emlog