[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Mankoskiknoca
2020-11-19 18:30
238921 viagra tablets for mens

http://viagraaqwe.com/ - viagra
Bojenaknoca
2020-11-19 17:25
3ff231 just try buy cialis pill



https://tadaladilss.com/
knoca
2020-11-18 21:25
cheap super is uk

     b0d1 i use it is uk shop
Babalby
2020-11-16 05:03
Почему корабль побеждает волны, хотя их много, а он — один? Потому, что у корабля есть цель, а у волн — нет. http://batmanapollo.ru
KmrfBype
2020-11-15 19:38
como se vende el viagra en chile https://purevigra.com/ expiration date of viagra
Logginknoca
2020-11-15 16:08
244831 viagra questions and answers



https://via1buynow.com/ viagra natural alternatives



http://viagener2020.com/ achat viagra internet



http://viagraaqwe.com/ pharmacy prices walmart viagra



http://viagraeuw.com/
Asafknoca
2020-11-15 13:53
d20831 illegal possess viagra



http://viagrayqdd.com/
Garinknoca
2020-11-14 21:26
238921 online assignments for students

https://tabserectilecheap.com/ - buy generic cialis
Banaagknoca
2020-11-14 17:09
6f5621 buy a report for school

https://edpillsnews20.com/ - viagra

sale uk viagra

https://frviagrafrance.com/ - viagra sur internet

uk  soft tab cialis online

https://genericedpills20.com/ - generic cialis online
Ilijknoca
2020-11-14 11:32
is sales 3 days

f371 il is da assuefazion

f371 at is user reviews

f371 i use it real is

f371
Aimarknoca
2020-11-14 05:25
a6ac31 cialis und viagra zusammen



https://frviagrafrance.com/
Monnaknoca
2020-11-12 22:11
fb7421 we recommend search viagra

http://viagraeuw.com/ - viagra
Robleknoca
2020-11-12 21:25
440921 muestra libre s de viagra

https://itsviagranew.com/ - online viagra

low price viagra generic 25mg

https://kaufenvia20.com/ - viagra kaufen rezeptfrei

personal loan agents in cochin

http://loansoloie.com/ - payday loans online
Didkoknoca
2020-11-12 15:30
238921 kann man cialis kaufen

http://cialisuyew.com/ - cialis online
Iyoknoca
2020-11-12 14:59
6f5621 cialis trial pack levitra

https://cia20online.com/ - buy cialis online

just try fast cialis

https://cialisactivesupers.com/ - cheap cialis online

发表评论:

Powered by emlog