[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

Rannevknoca
2019-07-12 15:40
will cost is go down
回复
ValerieRap
2019-07-12 04:16
http://lbdates.com/forums/user/avenab1973
http://codigo.coffee/forums/topic/casino-slots-93385/
http://goconvo.org/groups/casino-slots-85333
http://fundates.club/forums/topic/online-casinos-97573/
https://www.twincityclub.com/groups/casino-slots-92448
http://sbt-news.com/groups/online-casinos-1633169437/
https://parentzy.com/groups/casino-games-83868
https://innovatevirtualacademy.com/groups/online-slots-86256
http://www.artsyfact.com/forums/topic/online-casino-real-money-85148/
http://accessliberia.com/forums/topic/online-casino-games-82607/
http://codigo.coffee/forums/topic/online-slots-95086/
http://www.yoncalidernegi.com/forums/user/quicydown1978
http://learnandfun.in/groups/casino-slots-98740
http://motorbiketripvietnam.com/forums/topic/casino-slots-99112/
http://dickscave.com/forums/user/samengoa1987
http://blackbusinessavenue.com/groups/online-slots-90983
https://oscariptv.com/forums/topic/casino-slots-80434/
http://triliferacing.com/forums/user/randthylpbal1978
http://leflo.co.uk/forums/user/pboxmuhan1979
http://ilearnmedical.co.za/groups/online-casino-games-86085
回复
Rannevknoca
2019-07-12 03:17
33 is order online
回复
Rannevknoca
2019-07-12 02:04
viagra generico costo
回复
Dzhaksimovaknoca
2019-07-12 01:30
cost female is india

     9721 be is no prescription
回复
Rannevknoca
2019-07-12 01:17
is and price
回复
Rannevknoca
2019-07-11 23:35
order viagra cheap online
回复
Rannevknoca
2019-07-11 23:14
at 25mg is
回复
Dzhaksimovaknoca
2019-07-11 20:24
comprar is forma segura

     9721 small is dose
回复
Rannevknoca
2019-07-11 19:38
viagra and price
回复
Aarontic
2019-07-11 17:45
http://provera.us.com/ - provera
回复
Aarontic
2019-07-11 13:53
http://buyhydrochlorothiazide.team/ - buy hydrochlorothiazide
回复
Rannevknoca
2019-07-11 10:25
online viagra france
回复
Rannevknoca
2019-07-11 10:13
usefull link viagra 100mg
回复
Rannevknoca
2019-07-11 09:10
viagra preisvergleich 12
回复

发表评论：

Powered by emlog