[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Williamphync
2018-04-17 00:36
Many thanks for helping people get the info they need. Good stuff as usual. Keep up the great work!!!
http://umweltundplanung.de/finish-your-dissertation-dissertation-coaching-137/
Edwardcep
2018-04-17 00:25
Awesome! This can be by far the most helpful thing on the subject I have ever read. Many thanks for your work.
http://www.putraintelek.edu.my/college-application-essay-service-get-the-very-4/
Edwardcep
2018-04-16 23:54
Thank you for a really fantastic blog. It was actually very useful. I'm so happy I discovered this.
http://ttec.vn/help-me-do-my-paper-now/personal-statement-enable-statement-of-goal
Marvinvoina
2018-04-16 23:46
Sorry for off-topic, I am thinking about making an instructive web site as a student. Will probably start with publishing interesting facts like"It is impossible to lick your elbow."Please let me know if  you know where I can find some related info such as here

http://themorrisfamilyfoundation.com/specialized-internet-composition-posting-service/
http://www.ukukhanya.co.za/write-a-article-and-also-document-pertaining-to-me/
MilesAsync
2018-04-16 23:29
Thank you for the blog, it truly is loaded with a lot of handy information. Reading this .
http://www.seha.ie/term-paper-writing-service-for-student-requires/
Samuelswale
2018-04-16 22:44
Wonderful site, how do u get all this info?I've read through a couple of articles on your website and I love your style. Thanks a million, keep up the good work.
http://spirithealthsynergies.com/grade-my-paper-edit-my-essay-online-39/
ThomasAcist
2018-04-16 21:57
Thanks for helping people get the info they need. Good stuff as always. Keep up the great work!!!
http://www.imogena.pl/create-my-paper-finest-academic-investigation-and/
Edwardcep
2018-04-16 21:29
It is my very first time visiting your website and I am very fascinated. Thanks for sharing and keep up ;)
http://fbsaver.com/blog/custom-essay-writing-get-specialist-essay-aid-at-2/
ScottIdeak
2018-04-16 21:13
Many thanks for your great blog. It was actually very helpful. I am so happy I discovered this.
http://www.apple-tree-nursery.co.uk/studying-is-a-variety-of-activity-that-demands-us-11/
Russellpaf
2018-04-16 21:01
I like to get my inspiration from really meaningful phrases said by truly great people like “God is dead! He remains dead! And we have killed him.”, do you know where I can find thematic compiltaions of those?

http://semoet.mhs.narotama.ac.id/2017/11/28/leading-ten-custom-essay-writing-solutions-ranked/
JohnnyOpita
2018-04-16 20:59
Many thanks for sharing, I always find out interesting things from your posts.
http://day-for-women.ru/timely-college-essay-writing-assistance-quality-on-2/
ThomasDog
2018-04-16 20:24
I like to get my inspiration from really meaningful phrases said by truly great people like “Philosophy is a battle against the bewitchment of our intelligence by means of language”, do you know where I can find thematic compiltaions of those?

http://bandonline.com.br/2018/01/30/your-college-application-apply-the-princeton/
ThomasDog
2018-04-16 19:55
I like to get my inspiration from really meaningful phrases said by truly great people like “All that is necessary for the triumph of evil is that good men do nothing”, do you know where I can find thematic compiltaions of those?

http://www.tokyo-hanami.com/balancing-on-line-college-research-perform-and-34-2.html
Donaldcon
2018-04-16 19:26
Great post\Nice post, I enjoyed it very much.I was really lucky to find your site. It has a lot of helpful info!
http://tasteofthailand.com.au/essay-writer-service-academic-writing-assist/
Jameskar
2018-04-16 19:17
it's my first time visiting your site and I am very fascinated. Thanks for sharing and keep up ;)
http://estudioa0.com/blog/2017/12/14/admission-essay-custom-admission-essay-writing-12/

发表评论:

Powered by emlog