[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

ikiykinini
2020-08-31 17:37
best online essay writer http://customessaywritershb.com/ custom college essays
MelviBaf
2020-08-31 15:12
Truly all kinds of beneficial advice.
http://www.quanmama.com/t/goto.aspx?url=https://canadianonlinepharmacyhere.com https://portal.goosevpn.com/aff.php?aff=18&redirect=https://topcialisrxstore.com https://www.google.com.ai/url?q=https://canadianpharmaceuticalsrx.com http://www.seishinka-file.info/rank.php?mode=link&id=3469&url=https://canadianpharmaceuticalsrx.com http://www.oktotech.com/wp-content/themes/Grimag/go.php?https://cadmedbb.com https://xcx.yingyonghao8.com/index.php?r=oauth2/forumAuthOrize&referer=https://topcialisrxstore.com http://www.myhelphub.com/start/trackstart.aspx?int=OT&cn=best-anonymous-OT&ck=proxy+server+software&rd=https://topviagrarxpills.com
MelviBaf
2020-08-31 10:33
You have made the point.
http://www.systemconcept.ru/bitrix/redirect.php?event1=&event2=&event3=&goto=https://topcialisrxpills.com http://nude-virgins.info/cgi-bin/out.cgi?ses=1ZDUgL3GPd&id=1510&url=https://canadianpharmacyed.com http://www.waimao.cn/url.asp?url=https://canadiantoprxstore.com http://www.markprom.ru/go.php?url=https://csvcialis.com http://www.graduateguide.com/weblink.cfm?college_id=3014&urlVal=https://topcialisrxpills.com http://hamas.opoint.com/?url=https://rxpharmacymsn.com http://www.ludonautes.fr/index.php?thememode=full;redirect=https://canadianpharmaciesmsn.com http://dvt-info.cz/WEB_root/DVT_main/Default.aspx?url=https://msncialis.com https://maps.google.com.au/url?q=https://csvcialis.com https://dex.hu/x.php?id=velvet_blogok_cikklink&url=https://canadianpharmacy-us.com http://essobmr.ru/redirect?url=https://csvcialis.com http://miniblacks.fi/guestbook/go.php?url=https://topviagrarxpills.com http://trace.zhiziyun.com/sac.do?zzid=1337190324484706304&siteid=1337190324484706305&turl=https://ntviagrausa.com
MelviBaf
2020-08-31 09:52
Nicely put, Thanks a lot!
http://4vn.eu/forum/vcheckvirus.php?url=https://cadmedbb.com/ https://www.rochester.k12.mi.us/jump?URL=https://topcialisrxpills.com https://weberu.ru/redirect/?url=https://canadianonlinepharmacyhere.com http://www.allnantucket.com/cgi-bin/go.pl?URL=https://topviagrarxstore.com http://www.sex3dtoons.com/crtr/cgi/out.cgi?id=38&l=top_top&u=https://canadianonlinepharmacyhere.com http://www.exploora.com.br/redirect.php?url=https://ntviagrausa.com http://fujishima-bunka.jp/index.php?a=free_page/goto_mobile&referer=https://topviagrarxpills.com
MelviBaf
2020-08-31 09:17
Thank you! I like it!
http://www.expliciteart.net/cgi-bin/at3/out.cgi?id=924&tag=toplist&trade=https://canadianpharmacyed.com http://www.joycemeyer.ru/bitrix/rk.php?id=16&event1=banner&event2=click&event3=1+/+<>6]+<RIGHT>BANNER_2]+Програми+Джойс+Майєр&goto=https://msnviagrarx.com https://www.google.co.ma/url?q=https://ntviagrausa.com http://www.portalramn.ru/bitrix/redirect.php?event1=&event2=&event3=&goto=https://topcialisrxstore.com https://kultameren.fi/pennut/gotourl.php?url=https://cialisrxmsn.com http://www.praxis-siebnen.ch/dnn/LinkClick.aspx?link=https://cialisrxmsn.com https://www.imperialhomesolutions.co.uk/Redirect?type=link&adid=321&slid=219&plid=0&caid=320&roid=3&url=https://canadianpharmacyed.com http://www.spiritualforums.com/vb/redir.php?link=https://topviagrarxpills.com/ http://www.smutcastle.com/tp/out.php?link=NEW&url=https://topcialisrxstore.com http://www.svenskaracefans.com/ex.aspx?t=https://canadianpharmaceuticalsrx.com http://www.ses.4u.kz/go.php?go=https://canadianpharmaciesmsn.com http://images.google.ms/url?q=https://canadianonlinepharmacyhere.com
MelviBaf
2020-08-31 07:18
You reported this fantastically.
http://totallyteenie.com/crtr/cgi/out.cgi?s=52&c=1&l=teenass&u=https://canadianpharmaciesmsn.com/ https://www.google.am/url?q=https://cadmedbb.com http://www.weichertnews.com/t.aspx?s=1&id=389&nl=1271&n=393&si=220953&url=https://topviagrarxpills.com http://www.crocopost.com/movies/go.php?id=1225793_1&url=https://canadianpharmacyfirst.com http://ricordu.fr/index.php?url=https://rxpharmacymsn.com https://images.google.gg/url?q=https://topcialisrxstore.com http://www.minimunchers.com/Redirect/Default?url=https://topviagrarxstore.com http://www.hqglamour.com/crtr/cgi/out.cgi?id=30&l=top_top&u=https://csvcialis.com http://dproxy.library.dc-uoit.ca/login?url=https://canadianpharmacyfirst.com
MelviBaf
2020-08-31 06:01
Superb postings, Cheers.
http://images.google.ro/url?q=https://topcialisrxpills.com http://www.feetbastinadoboys.com/Home.aspx?returnurl=https://canadianpharmacyed.com http://www.diversephds.com/apply.php?jid=135262&url=https://canadianpharmaciesrxstore.com http://qa.www.liveme.com/share/index.php?url=https://msnviagrarx.com http://images.google.com.bh/url?q=https://canadianpharmacyed.com http://www.boombos.nl/GBook16/go.php?url=https://canadianrxpillusa.com https://images.google.cg/url?q=https://canadianpharmaceuticalsrx.com http://geotimes.ge/links.php?go=https://canadianpharmaciesrxstore.com http://www7.buyerpricer.com/Go.aspx?rurl=https://cialisrxmsn.com http://beautynet.co.za/www/RotBannerStatic/redirect.asp?url=https://canadianpharmaceuticalsrx.com
MelviBaf
2020-08-31 05:20
Incredible lots of valuable material!
http://avto-for.ru/forum/go.php?https://canadiantoprxstore.com http://www.150teengalleries.com/cgi-bin/a2/out.cgi?id=40&u=https://canadianonlinepharmacyhere.com https://kherson.afisha-ua.com/out/?url=https://topviagrarxpills.com http://www.ersro.ru/bitrix/rk.php?id=21&event1=banner&event2=click&event3=8+/+<>1]+<header>1280_110]+banner_header_ing-mt&goto=https://canadianpharmaciesrxstore.com http://www.find-best-pantyhose.com/movies/go.php?id=799263_1&url=https://canadianpharmacyed.com http://fpn55.1upprelaunch.com/redirect.asp?linkurl=https://msncialis.com http://rxsystems.co.uk/redirect.php?u=https://cialisrxmsn.com https://www.google.cd/url?q=https://canadianpharmacyfirst.com http://www.bdsm--sex.com/cgi-bin/atx/out.cgi?id=70&trade=https://canadianpharmacyed.com http://www.gunclub-nowa-sport.de/redirect.php?url=https://canadianmsnpharmacy.com http://severe.worldweather.wmo.int/cgi-bin/goto?where=https://msncialis.com http://scanmail.trustwave.com/?c=6677&d=3eHL2zmR-mSEueRJSdX4UpJhLotL1yEZhefsffMCDw&u=https://topcialisrxstore.com http://old.civillaw.com.cn/explorer/hitting.asp?id=620&url=https://cadmedbb.com
MelviBaf
2020-08-31 04:07
Amazing advice. Appreciate it!
http://celinaumc.org/System/Login.asp?id=45779&Referer=https://canadianpharmacyfirst.com http://ns.barahla.net/redirect.php?url=https://canadianpharmacy-us.com http://www.krovatka.ru/f/rr.cgi?https://topviagrarxpills.com https://images.google.gm/url?q=https://canadianmsnpharmacy.com http://www.bad.org.uk/for-the-public/patient-information-leaflets/androgenetic-alopecia/?showmore=1&returnlink=https://msncialis.com http://anorexiaporn.com/cgi-bin/atc/out.cgi?s=90&l=gallery&u=https://canadianpharmacyfirst.com http://iimorireienkumiai.shijonawate.osaka.jp/mobile.cgi?id=5&mode=redirect&no=20&ref_eid=256&url=https://msncialis.com http://oceanaresidences.com/keybiscayne/wp-content/themes/oceana/floorplans/large/4-12thfloor/01S.php?url=https://canadianmsnpharmacy.com http://www.acuracatalog.com/redirect.php?link=https://canadianpharmacyfirst.com http://yoyaku-top10.jp/redirect?url=https://msncialis.com http://school364.spb.ru/bitrix/rk.php?id=12&event1=banner&event2=click&event3=1+/+<>2]+<>98x98_index]+&goto=https://canadianmsnpharmacy.com http://www.distribucion.itsitiomail.com/click2.aspx?boton=MTgyNDAzNA==&config=MTQ0NTE3&envionro=OTQ3NzQ=&codEmail=OTQ3NzQ=&email=dG9tYXNzZXR0aUB5YWhvby5jb20=&viral=MA==&nombreProv=WWFob28=&link=https://canadianonlinepharmacyhere.com https://www.avtoprozvon.ru/bitrix/redirect.php?event1=click&event2=button-rec&event3=&goto=https://msncialis.com http://charlineberg.com/searchpoint/redir.asp?reg_id=ptypes&sname=/searchpoint/search.asp&lid=1&sponsor=res&url=https://canadianonlinepharmacyhere.com
KeitrSax
2020-08-31 03:07
This is nicely expressed! ! online medicine shopping https://topviagrarxstore.com canadian drugs pharmacies online
MelviBaf
2020-08-30 22:25
Incredible a lot of excellent facts!
http://www.prestigepropre.com/searchpoint/redir.asp?reg_id=ptypes&sname=/searchpoint/search.asp&lid=2&sponsor=lea&url=https://topcialisrxpills.com http://www.it892.com/bbs/url.php?target=https://canadianrxpillusa.com http://szxljy.net/go.php?u=https://topviagrarxstore.com http://investiv.co/clicks/?a=INVESTIV-HOME-RR&p=INV&goto=https://canadianonlinepharmacyhere.com https://images.google.bj/url?q=https://canadianpharmacy-us.com http://watermarket.ru/redirect.php?url=https://canadianrxpillusa.com http://www.blogwasabi.com/jump.php?url=https://topcialisrxpills.com
ScottGuith
2020-08-30 21:28
Position well used!. canada meds http://canadianpharmacyed.com/order-isoptin-online-en.html canada online pharmacy
MelviBaf
2020-08-30 21:07
Terrific content. Kudos.
http://testforsites.ru/redirect.php?url=https://canadianpharmaciesmsn.com http://www.machinesproduction.fr/cgi-bin/clickcount.pl?url=https://canadianpharmaciesmsn.com http://youngertube.com/cgi-bin/atx/out.cgi?id=487&tag=twitter&trade=https://canadianpharmacyed.com http://www.mlhd.org/go.php?url=https://canadianrxpillusa.com https://images.google.se/url?q=https://topcialisrxpills.com http://www.mobiledevice.ru/red.aspx?u=https://canadianonlinepharmacyhere.com/ https://cse.google.mw/url?q=https://csvcialis.com http://www.secretlair.com/index.php?URL=https://canadianpharmacyfirst.com http://www.encyclo.co.uk/go.php?url=https://rxpharmacymsn.com http://wittols.com/out.php?url=https://topcialisrxpills.com http://www.toku-jp.com/Rouge/minibbs.cgi?https://csvcialis.com http://www.texeltv.nl/_a2/vp6.php?vid=musea/ecomare.wmv&link=https://canadianpharmacy-us.com
RobertBap
2020-08-30 20:29
Very well expressed without a doubt! . canadian pharmacy 365 https://ntviagrausa.com viagra online canadian pharmacy
ScottGuith
2020-08-30 18:37
This is nicely put! . discount canadian drugs http://topviagrarxstore.com/order-super_ed_trial_pack-online-en.html pharmacy price compare

发表评论:

Powered by emlog