[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Rannevknoca
2019-07-14 18:31
is effetti durata
ValerieRap
2019-07-14 17:52
http://www.silvanusinternational.org/groups/online-casino-games-92874
http://myboscorp.com/groups/online-slots-97163
http://www.lifeedu.com.hk/groups/online-casino-real-money-86886
http://www.fhle.org/forums/user/fulpostkid1983
https://www.biomimetics-connect.com/forums/topic/online-casinos-97524/
https://themoney.academy/forums/user/porhide1988
http://tfit.ir/forums/topic/casino-slots-94558/
http://acencanal.org/forums/topic/casino-online-93377/
http://alternathistory.com/groups/online-casino-96877
http://bristolguitar.com/groups/casino-games-84128
http://www.marhabayoga.com/forums/topic/online-casino-games-93062/
http://jorgerazo.com/groups/online-slots-94007
http://itend.com/groups/online-casino-86409
http://mesibba.com/forums/topic/casino-slots-85504/
http://expharm.co.za/forums/topic/casino-games-88695/
https://dating.nigeriansinsouthafrica.co.za/groups/online-casino-97383
http://unitycafe.world/groups/casino-slots-82203
http://www.lou-sifflaire.com/forums/user/beaufruson1973
http://www.ccmining.org/groups/online-casino-real-money-83297
http://bettersightonline.com/groups/online-casinos-95151
Rannevknoca
2019-07-14 17:36
reputable online viagra
Rannevknoca
2019-07-14 17:02
billige viagra online apotheke
Rannevknoca
2019-07-14 15:38
viagra buy uk 50mg
Rannevknoca
2019-07-14 14:38
men health is
Rannevknoca
2019-07-14 12:10
viagra varighed
Rannevknoca
2019-07-14 01:17
waar kan ik viagra bestellen
Rannevknoca
2019-07-13 21:17
viagra from indian company
Rannevknoca
2019-07-13 19:43
only for you viagra in canada
Rannevknoca
2019-07-13 15:40
is is einnahme
Rannevknoca
2019-07-13 04:19
achat viagra
ValerieRap
2019-07-13 02:52
http://propertyin28days.net/groups/casino-games-96600
http://okkigo.com/groups/online-casinos-82156
https://www.eloaelo.com/forums/user/ponbobbclad1982
http://p7r.co.uk/forums/user/duitotan1970
https://www.chronicsouls.com/forums/topic/online-casino-86501/
http://tamiyabruiser.com/forums/topic/casino-slots-81145/
http://victor-wp-test.com/groups/casino-games-91469
http://talentprofolio.com/groups/casino-games-86239
https://www.gradstoteaching.org/forums/topic/casino-online-88782/
http://userforum.azurewebsites.net/groups/online-casinos-86414
https://www.biomimetics-connect.com/forums/topic/online-casino-real-money-95321/
http://www.beulahpulse.com/groups/casino-slots-83325
http://abwabnet.org/groups/online-casino-97612
http://youlifechallenge.com/groups/online-casinos-83166
http://razamasjid.org/groups/online-casino-games-90225
http://afrimart.org.au/groups/online-casino-87276
http://www.activemuslima.org/groups/online-casino-games-87011
http://charitygrowthlab.com/forums/user/viodilis1972
http://www.activemuslima.org/groups/online-casino-games-99366
http://www.professionfirst.com/groups/online-casino-98867
Aarontic
2019-07-12 19:56
http://buydiflucan.us.org/ - buy diflucan without a prescription
Rannevknoca
2019-07-12 17:39
apotik yang jual is

发表评论:

Powered by emlog