[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

Iyoknoca
2020-11-12 14:59
6f5621 cialis trial pack levitra

https://cia20online.com/ - buy cialis online

just try fast cialis

https://cialisactivesupers.com/ - cheap cialis online
回复
Adesknoca
2020-11-12 14:29
5f7521 generisches viagra tadalafil

http://viagraaqwe.com/ - buy viagra

get viagra online at discount

http://viagraeuw.com/ - viagra online

compra viagra de viagra

https://viagrafornow.com/ - how to get viagra without a doctor

viagras cialis

https://viagrahere20.com/ - viagra
回复
Maraknoca
2020-11-12 13:55
d2c621 viagra naturale milano

https://viagratodaybest.com/ - viagra online

viagra airplane

https://viagratodo20.com/ - viagra without a doctor prescription canada

wow viagra order

http://viagrauyr.com/ - canadian viagra
回复
Ingridknoca
2020-11-12 13:01
a6ac21 viagra tescos stores

https://kaufenvia20.com/ - viagra rezeptfrei
回复
Milaknoca
2020-11-12 12:31
238921 organic chemistry homework assignment help

https://tabserectilecheap.com/ - cialis

buy cialis discount

https://tadaladilss.com/ - generic cialis online

10 mg viagra online

https://via1buynow.com/ - buy viagra
回复
Prehnknoca
2020-11-12 11:45
1fd021 viagra name

https://cheapandbestonline20.com/ - viagra sale
回复
Dasyaknoca
2020-11-12 11:40
c82821 viagra online blue pill

http://viagrauyr.com/ - online viagra

mix viagra alcohol and can

http://viagrayqdd.com/ - viagra online

benefits of viagra

https://viatrustedonline.com/ - buy viagra

viagra aus australien

http://vigraweuy.com/ - buy viagra
回复
Teodorknoca
2020-11-12 10:45
fb7421 the purdue university online writing lab

https://edpillsnews20.com/ - ed pills
回复
Kaenaknoca
2020-11-12 10:39
6e4721 buy generic cialis online com

http://cilapharm.com/ - buy cialis online

technical writing certification online

https://edpillsnews20.com/ - ed pills

viagra en madrid

https://frviagrafrance.com/ - viagra prix

ed pills cialis  order

https://genericedpills20.com/ - cialis online
回复
Boerknoca
2020-11-12 10:30
0d0d21 cialis et impuissance

https://cialisverygoodn.com/ - cheap cialis online

cialis chemie

https://cialisyrpo.com/ - buy generic cialis

cialis interdit belgiqu

http://cialisyytr.com/ - cheap cialis online
回复
Makarknoca
2020-11-12 07:34
cheap is for sale uk

bedf
回复
Panovaknoca
2020-11-12 06:21
659e31 cut viagra in can half pills



https://cheapandbestonline20.com/ best prices cialis soft tabs



https://cia20online.com/ cialis 5mg kaufen ohne rezept



https://cialisactivesupers.com/
回复
Valyaknoca
2020-11-12 05:51
238931 cialis pas cher en pharmaci



http://cialisooie.com/
回复
Edgarknoca
2020-11-12 05:20
6e4731 cheap viagra from usa



https://cheapandbestonline20.com/ we choice cialis to order



https://cia20online.com/ cialis australia prices



https://cialisactivesupers.com/ cialis p jenter



https://cialisdoitnow.com/
回复
Ogbornknoca
2020-11-12 04:50
3ff231 online pharmacy cheap viagra



https://viagratodo20.com/ comprare il viagra online



http://viagrauyr.com/ male female viagra uk



http://viagrayqdd.com/
回复

发表评论：

Powered by emlog