[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

cheap levitra 20mg
2018-06-10 21:05
It’s in fact very difficult in this active life to listen news on TV, thus I only use world wide web for that purpose, and take the hottest news.
levitra generic
2018-06-10 20:42
My family members all the time say that I am wasting my time here at net, except I know I am getting knowledge all the time by reading such pleasant articles or reviews.
buy levitra 20 mg
2018-06-10 20:07
If you are ready to watch funny videos on the net then I suggest you to pay a quick visit this web site, it includes actually thus funny not only video clips but also other data.
buy levitra
2018-06-10 15:15
Okay, and further more if you desire update alerts from this site then you have to subscribe for it, it will be a suitable for you Jackson. Have a nice day!
vardenafil 20mg
2018-06-10 14:43
For most recent information you have to visit internet and on internet I found this site as a most excellent web page for hottest updates.
levitra generic
2018-06-10 11:10
Why people still make use of to read news papers when in this technological globe all is accessible on net?
buy levitra
2018-06-10 09:09
My family always say that I am killing my time here at net, except I know I am getting experience all the time by reading thes good articles or reviews.
vardenafil 20mg
2018-06-10 08:32
In fact programming is nothing except it’s a logic, if you obtain control on it then you are the master else nothing.
levitra 20mg
2018-06-10 08:09
I every time used to read article in news papers but now as I am a user of net so from now I am using net for content, thanks to web.
levitra 10 mg prezzo
2018-06-10 06:59
YouTube includes not just humorous and humorous video clips but also it contains learning related video tutorials.
vardenafil 20mg
2018-06-10 06:54
When I saw this web site having awesome featured YouTube movies, I decided to watch out these all video lessons.
levitra generic
2018-06-10 01:06
|When I want to place gallery or LightBox or even a slider on my site I every time attempt to use jQuery script in favor of that.
levitra 20 mg
2018-06-09 18:27
I am genuinely keen of viewing humorous video clips at youtube, and this videos is in fact so comic, hehehhe.
levitra prices
2018-06-09 16:26
This article provides clear idea designed for the new users of blogging, that truly how to do blogging.
buy levitra
2018-06-09 16:20
I am John, how are you everybody? This paragraph posted at this web site is really nice.

发表评论:

Powered by emlog