[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

Izabellaknoca
2020-08-05 18:10
638431 cialis 5mg vs 20



http://cialishhqoeur.com/
回复
Lizaknoca
2020-08-05 16:55
411631 le viagra estil rembours



http://viagraeuw.com/ we choice viagra costs



https://viagrahere20.com/
回复
Daphnieknoca
2020-08-05 16:39
6e4731 vardenafil viagra price



http://viagraeuw.com/ femaleviagra online



https://viagrahere20.com/
回复
Khoiknoca
2020-08-05 16:09
972931 in sales viagra



https://viagratodaybest.com/
回复
Rolphknoca
2020-08-05 11:57
922231 best time to take viagra 100mg



https://viagraonline20up.com/ viagra wirkung von



https://viagraonlinegfsd.com/
回复
Galyaknoca
2020-08-05 11:12
1fd031 generic levitra cialis



http://cialisuqpor.com/
回复
Filyanknoca
2020-08-05 09:06
is kaufen in kanada

f10a is theme song

f10a
回复
Bordasknoca
2020-08-05 08:51
843e31 cialis precio espaa



http://cialisuqwc.com/
回复
Denisknoca
2020-08-05 07:23
compra is erezione

9d11 is 40 pills 5mg bay

9d11 is berichte

9d11 genuine is

9d11
回复
Denisknoca
2020-08-05 07:17
097831 buy cialis amsterdam  buy now



https://cialishowmuch.com/ cialis 20mg canada to canada



http://cialisooie.com/ cialis order



https://cialistodo2020.com/ cialis 20mg 32 st



http://cialisuqpor.com/
回复
Lizaknoca
2020-08-05 06:44
acca31 service proposal



https://edpillsnews20.com/
回复
Okonskiknoca
2020-08-05 06:36
5mg is

f8d3 costo del is in america

f8d3 generika is levitr

f8d3 is curativo

f8d3
回复
Newbyknoca
2020-08-05 05:44
0bcc31 achat de taureau de cialis



https://ssupercialisever.com/ viagra or cialis prices



http://viagener2020.com/ viagra prescriptions australia



http://viagraaqwe.com/ can i buy viagra in mexico



http://viagraeuw.com/
回复
Timofeevaknoca
2020-08-05 05:30
3cfd31 personal loan bad credit no money down



http://loansoloie.com/ viagra o similares



https://sildenonline.com/ cheap cialis 10mg



https://ssupercialisever.com/ we choice u 3312 viagra cialis



http://viagener2020.com/
回复
Leroyknoca
2020-08-05 00:44
a75621 effective viagra generic

https://viagratodaybest.com/ - viagra generic

wirkung von viagra wikipedia

https://viagratodo20.com/ - generic viagra without a doctor prescription

viagra 100 mg split

http://viagrauyr.com/ - viagra cheap
回复

发表评论：

Powered by emlog