[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

Vyncentknoca
2020-11-12 00:35
a75631 personal loan calculator online



http://loansoloie.com/ only here viagra 100 mg



https://sildenonline.com/ is 200mg of cialis too strong



https://ssupercialisever.com/
回复
Lyubavaknoca
2020-11-12 00:06
440931 cialis versand in der schweiz



https://itcialis20.com/
回复
Adreyaknoca
2020-11-11 20:43
is levitra sildenafi

1e83 farmacias mexicanas is

1e83 be is online in malaysia

1e83
回复
Stanislavaknoca
2020-11-11 12:17
1fd031 prix du viagra france



http://viagraaqwe.com/
回复
Odincovaknoca
2020-11-11 04:19
acca31 beipackzettel viagra generika



https://sildenonline.com/ enter site buy cialis where



https://ssupercialisever.com/ owl purdue online writing lab



https://tabserectilecheap.com/
回复
Katyushaknoca
2020-11-09 16:04
659e21 best time have viagra

https://frviagrafrance.com/ - viagra achat
回复
Natashaknoca
2020-11-09 15:21
383121 comprar cialis internet

http://cialishhqoeur.com/ - buy generic cialis

cialis generika levitra forum

https://cialishowmuch.com/ - cheap cialis online

what is normal dose of cialis

http://cialisooie.com/ - generic cialis

cialis 40mg generico

http://cialisuqpor.com/ - cialis
回复
Cridlandknoca
2020-11-09 14:50
923421 viagra generika forum

https://viagratodo20.com/ - can you buy viagra over the counter

try it india viagra

http://viagrauyr.com/ - viagra cheap

yahoo answers viagra online

http://viagrayqdd.com/ - viagra cheap
回复
Goseknoca
2020-11-09 13:35
097821 we choice viagra legal

http://viagrayqdd.com/ - viagra online

cost of viagra 100mg in india

https://viatrustedonline.com/ - online viagra

viagra street value

http://vigraweuy.com/ - generic viagra

viagra prescription cost

https://cheapandbestonline20.com/ - viagra
回复
Elenaknoca
2020-11-08 14:42
acca31 real viagra vs generic



https://frviagrafrance.com/ canadian cost of cialis pills



https://genericedpills20.com/
回复
Baranovknoca
2020-11-08 12:27
6f5631 we like it cialis en mexico



http://ciaviagogogo.com/
回复
Elaknoca
2020-11-08 00:01
is before surgery

6468 online is nz

6468 donde comprar is en chile

6468
回复
do my php homework
2020-11-06 18:44
do my python homework project from able and dedicated authorities for learners fighting with their study in one programming communication. do my php homework on the lowest price all over the world. please try us. we will not disappoint you.
回复
Diponioknoca
2020-11-05 08:52
5f7521 in nyc viagra

https://cheapandbestonline20.com/ - viagra

cialis cipla best buy

https://cia20online.com/ - generic cialis online
回复
Noltknoca
2020-11-05 08:09
d20831 cialis 14 compresse prezzo



https://cialisactivesupers.com/ active reviews cialis



https://cialisdoitnow.com/ i recommend cialis no doctor



http://cialishhqoeur.com/ acheter cialis en ligne paypal



https://cialishowmuch.com/
回复

发表评论：

Powered by emlog