[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Dorofeevknoca
约 14 小时前
1fd031 100 mg viagra etkileri



https://sildenonline.com/ buy cialis professional online



https://ssupercialisever.com/
Ksyuknoca
约 15 小时前
1fd021 progressive cash loan number

http://loansoloie.com/ - faxless payday advance
Nyjahknoca
约 15 小时前
238931 generic cialis aus europa



http://cialisyytr.com/
Heberknoca
约 16 小时前
843e31 cialis schnelle lieferung



https://ssupercialisever.com/
Ridleeknoca
约 16 小时前
930a21 cialis 5 mg sin receta

http://ciaviagogogo.com/ - generic cialis online

cialis et prostatectomie

http://cilapharm.com/ - buy generic cialis

do my chemistry assignment

https://edpillsnews20.com/ - viagra buy

ready cash advance slidell

http://loansoloie.com/ - payday loans
Dewsknoca
约 17 小时前
097831 cialis 5mg auf rechnung kaufen



http://cialishhqoeur.com/ click now cialis for daily use



https://cialishowmuch.com/
Feofilknoca
约 19 小时前
ab5821 what does viagra cost at

https://viagrahere20.com/ - buy viagra online
Oliverknoca
约 22 小时前
383121 best way to use cialis

http://cialisyytr.com/ - cialis

us overnight shipping cialis

http://ciaviagogogo.com/ - buy cialis

cialis 5 mg generika

http://cilapharm.com/ - cheap cialis online
Ulisesknoca
约 22 小时前
c82821 cialis temps

http://cialisyytr.com/ - cheap cialis

acheter du cialis a marseill

http://ciaviagogogo.com/ - buy cialis online

we choice cialis pfizer india

http://cilapharm.com/ - cialis online

business plan buyout

https://edpillsnews20.com/ - buy viagra online
Zykovknoca
约 23 小时前
6e4721 fast cheapest viagra anywhere

https://viagrahere20.com/ - buy viagra online

seguro viagra en lnea

http://viagraoier.com/ - buy viagra online

viagra al supermercato

https://viagraonline20up.com/ - generic viagra
Zeffknoca
2020-08-06 17:59
3bdb31 viagra blister 4



http://viagener2020.com/ rezeptfrei viagra internet



http://viagraaqwe.com/
Liyaknoca
2020-08-06 17:40
411621 online pharmacy pfizer viagra

http://vigraweuy.com/ - viagra cheap

cialis bruxelle

https://cialisdoitnow.com/ - generic cialis online
Sofiyaknoca
2020-08-06 17:16
3fa831 10mg cialis better than 5mg



http://cialishhqoeur.com/ buy cialis cheap from canada



https://cialishowmuch.com/ kaiser permanente cialis cost



http://cialisooie.com/ cialis generico meilleur prix



https://cialistodo2020.com/
Sofiyaknoca
2020-08-06 17:05
f4d721 viagra online canada generic

https://viagrashippingtoday.com/ - viagra cheap

levitra viagra cialis test

https://viagratodaybest.com/ - buy viagra

viagra prescription spain

https://viagratodo20.com/ - how to get viagra without a doctor
Ioasafknoca
2020-08-06 16:53
pfizer is bestellen

d937 is selling is online legal

d937 gaddafi is

d937 is jelly sachet uk

d937

发表评论:

Powered by emlog