[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

viagra 100mg
2018-06-25 05:22
This paragraph regarding how to embed a YouTube video code is in fact useful in support of new internet visitors. Nice work, keep it up.
cheap viagra online
2018-06-25 04:55
Hi there, I desire to subscribe for this blog to obtain most up-to-date updates, thus where can i do it please help out.
natural viagra
2018-06-25 04:28
I all the time used to read piece of writing in news papers but now as I am a user of internet thus from now I am using net for content, thanks to web.
tesco viagra
2018-06-25 02:56
Oh! Wow its in fact a funny and jockey YouTube video posted at this point. thanks for sharing it.
womens viagra
2018-06-25 02:31
This info is priceless. How can I find out more?
where to buy viagra
2018-06-25 01:26
I visit daily some websites and information sites to read posts, except this web site gives feature based articles.
viagra online
2018-06-25 01:11
What's up dear, me plus my mother are also watch comic video clips but after I finished my homework
viagra on line
2018-06-25 01:08
Hello colleagues, nice paragraph and fastidious urging commented at this place, I am really enjoying by these.
buy 50mg viagra
2018-06-25 01:01
This information is invaluable. When can I find out more?
female viagra
2018-06-25 00:57
Thankfulness to my father who told me concerning this website, this blog is really remarkable.
buy viagra generic
2018-06-24 23:18
When someone writes an article he/she retains the thought of a user in his/her brain that how a user can understand it. So that’s why this piece of writing is amazing. Thanks!
cheap generic viagra
2018-06-24 22:31
What a lovely story! The story in this YouTube video that is posted at this time is actually a fastidious one with having fastidious picture quality.
canadian viagra
2018-06-24 22:22
In fact programming is nothing however it’s a logic, if you obtain grip on it afterward you are the professional else nil.
viagra buy
2018-06-24 21:59
I know this website presents quality based articles and other information, is there any other web page which presents such data in quality?
women viagra
2018-06-24 21:36
Oh! Wow its actually a comical and jockey YouTube video posted at this place. thanks for sharing it.

发表评论:

Powered by emlog