[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

MelviBaf
2020-08-30 06:05
Many thanks! A lot of forum posts!  
http://sat.kuz.ru/engine/redirect.php?url=https://canadianonlinepharmacyhere.com http://www.skitalets.ru/links/jump.php?url=https://ntviagrausa.com https://matome-ch.com/jump.php?u=https://canadianonlinepharmacyhere.com http://www.nozokix.com/ltp_out?id=01589&go=https://cadmedbb.com https://www.frontrush.com/FR_Web_App/Message/MessageTracking.aspx?code=Mjg4MjUwOTsxMjYwODU2O0M7MTc1ODQ7TA==-Vve8qeRh36c=&redir=https://canadianpharmaceuticalsrx.com http://www.jstott.com/links/jump.php?id=41&url=https://csvcialis.com http://nanacast.com/vp/113596/499565/free-ebook/?redirecturl=https://topcialisrxpills.com http://www.woningmakelaar-groningen.nl/redirect.php?id=2502&url=https://ntviagrausa.com
RobertBap
2020-08-30 05:31
Incredible a good deal of valuable advice. pharmacy prices compare https://cialisrxmsn.com trust pharmacy canada
ScottGuith
2020-08-30 03:56
Seriously a lot of superb facts. canada online pharmacies http://topviagrarxstore.com/order-levlen-online-en.html buying drugs canada
MelviBaf
2020-08-30 02:47
Amazing postings, With thanks.
http://konga.postaffiliatepro.com/scripts/click.php?k_id=9janinja&desturl=https://cadmedbb.com http://www.seniortgp.com/cgi-bin/crtr/out.cgi?u=https://topviagrarxstore.com http://www.freehqpornmovies.com/cgi-bin/atc/out.cgi?c=1&s=80&l=index&u=https://ntviagrausa.com http://www.kyivfashion.kiev.ua/?goto=https://cadmedbb.com http://bethplanet.ru/go?https://canadianpharmaciesmsn.com http://www.amateurlesbiansex.com/cgi-bin/atx/out.cgi?s=65&u=https://csvcialis.com https://www.mls2u.com/Frame--Flat-Fee-MLS.php?src=https://canadianpharmaceuticalsrx.com http://www.seelensturm.net/wcf/acp/dereferrer.php?url=https://canadianpharmaceuticalsrx.com http://www.belclimb.net/click_counter.asp?countType=link&ID=1590&target=https://rxpharmacymsn.com http://www.phpxs.com/fenxiang/manual?go=https://topviagrarxpills.com http://www.parmalat.ru/bitrix/rk.php?id=7&event1=banner&event2=click&event3=1+%2F+%5B7%5D+%5BMAIN%5D+%CC%EE%EB%EE%F7%ED%FB%E5+%EF%F0%EE%E4%F3%EA%F2%FB+%C1%E5%EB%FB%E9+%C3%EE%F0%EE%E4&goto=https://canadianonlinepharmacyhere.com http://polit.nnov.ru/go.php?url=https://canadianrxpillusa.com http://redirect.fairfax.com.au/redir.cgi?from_site=fu2&from_section=electronics_index.html&to=https://canadianpharmaciesmsn.com
ScottGuith
2020-08-30 02:28
Kudos! I like this! canadian drugs pharmacies online http://canadiantoprxstore.com/order-precose-online-en.html overseas pharmacy forum
cialis generic
2020-08-29 23:04
cialis reviews http://sjcialis.com/ purchase cialis
MelviBaf
2020-08-29 10:37
Regards, Great stuff!
http://italianculture.net/redir.php?url=https://canadianmsnpharmacy.com/ http://rodeo.to/media/link/redirect.php?url=https://canadianmsnpharmacy.com/ http://www.dzmhw.cn/go.php?url=https://topviagrarxstore.com https://images.google.fr/url?q=https://canadianpharmacyed.com http://p4trc.emv2.com/DTS?url=https://canadianpharmaciesrxstore.com/&emv_key=F9X7CqqshZGf8SA9MKJi8NUY54O102IMNfcStGb5lw8W0bBhOG5mpqVsje_HhdA0lliq https://www.sojh.ch/redirect-forward.php?ste=8093&url=https://canadianpharmaciesrxstore.com http://www.epronto.ru/redirect.php?url=https://canadianonlinepharmacyhere.com http://lifevinet.ru/?goto=https://canadianpharmaciesmsn.com http://www.51ddb.cn/home/link.php?url=https://ntviagrausa.com https://www.pardubice.cz/?bnr=122&goto=https://rxpharmacymsn.com http://c.fc2.com/r.php?https://canadianpharmaciesrxstore.com/ http://www.transmgp.com/cgi-bin/a2/out.cgi?id=71&l=toplist&u=https://msncialis.com http://www.motordebusca.pt/busca/redir.asp?idSite=9769&url=https://canadianpharmacy-us.com http://binfos.ru/bitrix/redirect.php?event1=&event2=&event3=&goto=https://cadmedbb.com
KeitrSax
2020-08-29 05:54
Thank you! Quite a lot of facts.
canadian pharmacy online viagra https://topcialisrxpills.com canada prescription plus pharmacy
ScottGuith
2020-08-29 04:32
Regards! Ample information!
pharmacy cheap no prescription http://topcialisrxstore.com/order-synthroid-online-en.html canada pharmacies without script
MelvineBaf
2020-08-29 04:12
With thanks. I appreciate this.
http://whineland.com/__media__/js/netsoltrademark.php?d=canadianpharmaceuticalsrx.com http://aftertaxes.com/__media__/js/netsoltrademark.php?d=canadiantoprxstore.com http://jenniferbellizzi.com/__media__/js/netsoltrademark.php?d=topcialisrxpills.com http://securepaywebstore.com/__media__/js/netsoltrademark.php?d=csvcialis.com http://mouseescells.com/__media__/js/netsoltrademark.php?d=canadianpharmaciesmsn.com http://marleylucasordonez.com/__media__/js/netsoltrademark.php?d=msncialis.com http://cheyennemeetings.com/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://www.fnbhuntsvilletx.net/__media__/js/netsoltrademark.php?d=msnviagrarx.com http://gasnine.com/__media__/js/netsoltrademark.php?d=canadianpharmacy-us.com http://americangolfimages.com/__media__/js/netsoltrademark.php?d=canadianpharmaciesmsn.com http://smartemployeebenefits.mobi/__media__/js/netsoltrademark.php?d=topviagrarxpills.com http://taxsiant.com/__media__/js/netsoltrademark.php?d=topviagrarxpills.com http://hatchetii.com/__media__/js/netsoltrademark.php?d=msnviagrarx.com
RobertBap
2020-08-29 02:28
You actually revealed it terrifically. online pharmacy reviews https://canadianmsnpharmacy.com canadian pharmacy viagra brand
MelviBaf
2020-08-29 01:52
Cheers, Wonderful information.
http://www.zearrings.com/click.php?url=https://canadianpharmacyed.com http://www.amateurpin.com/ap_network.php?l=de&u=https://msncialis.com https://anon.to/?https://canadianpharmacyed.com/ https://tinygu.de/?url=https://cialisrxmsn.com http://ka2.fundacionctic.org/gipo/redirect?url=https://csvcialis.com http://forum.vestaclub.ru/go.php?https://canadianpharmacy-us.com https://www.focalpointbackoffice.com/ClickThru.aspx?MsgID=8047166&goto=https://canadianpharmaceuticalsrx.com
RobertBap
2020-08-29 00:54
Perfectly spoken certainly. ! approved canadian pharmacies online https://rxpharmacymsn.com canadian pharmaceuticals online
100mg viagra
2020-08-28 23:17
buy viagra professional http://ajviagra.com/ name brand viagra
MelvineBaf
2020-08-28 22:59
This is nicely expressed! !
http://www.eheartbeats.com/__media__/js/netsoltrademark.php?d=ntviagrausa.com http://noisymind.com/__media__/js/netsoltrademark.php?d=canadianmsnpharmacy.com http://weatherpluskids.com/__media__/js/netsoltrademark.php?d=cadmedbb.com http://affinitysolutionsinc.com/__media__/js/netsoltrademark.php?d=topviagrarxstore.com http://nkey.net/__media__/js/netsoltrademark.php?d=canadianmsnpharmacy.com http://www.tdpropertygroup.com/__media__/js/netsoltrademark.php?d=topcialisrxstore.com http://overheidsmanagement.org/__media__/js/netsoltrademark.php?d=rxpharmacymsn.com http://www.mwnsurgery.com/__media__/js/netsoltrademark.php?d=canadianpharmacyed.com http://bloomslandscape.com/__media__/js/netsoltrademark.php?d=topviagrarxstore.com http://soldcode.com/__media__/js/netsoltrademark.php?d=canadianpharmacyfirst.com

发表评论:

Powered by emlog