[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

levitra generic
2018-06-08 20:36
Yes you are correct, YouTube is most excellent video distribution site, since YouTube is a lightly no much streaming time rather than other sites.
levitra coupon
2018-06-08 19:59
This article on the topic of how to embed a YouTube video code is truly helpful designed for fresh internet access users. Fastidious work, keep it up.
levitra online
2018-06-08 18:22
What a lovely story! The story in this YouTube video that is posted here is genuinely a pleasant one with having nice picture feature.
levitra coupon
2018-06-08 17:46
Hi there I am from Australia, this time I am viewing this cooking related video at this site, I am really glad and learning more from it. Thanks for sharing.
MichaelBibra
2018-06-06 06:44
I've discovered loads of useful info on your website this page in particular. Thank you for sharing.
https://eternalenergy.co.in/2017/12/12/entry-essay-or-dissertation-companies-quality-work/
amoxicilina 500
2018-06-06 05:18
Hi there everybody, I am sure you will be enjoying here by watching such comic movies.
amox clav 875 mg
2018-06-05 20:58
Nice answer back in return of this question with solid arguments and telling all on the topic of that.
amoxicillin medscape
2018-06-05 20:55
What a material of un-ambiguity and preserveness of precious know-how concerning unpredicted emotions.
Kennethder
2018-06-05 20:52
Thank you for the site, it truly is loaded with so much handy info. Reading this .
http://www.laworldgame.com/nieuws/singular-unique-plagiarism-zero-cost-articles/
amox clav 875 mg
2018-06-05 19:16
Very nice article, just what I needed.
Michelegak
2018-06-05 17:17
Revolutional update of SEO/SMM software "XRumer 16.0 + XEvil":
captchas breaking of Google (ReCaptcha-2 and ReCaptcha-3), Facebook, BitFinex, Bing, Hotmail, SolveMedia, Yandex,
and more than 8400 another types of captchas,
with highest precision (80..100%) and highest speed (100 img per second).
You can use XEvil 4.0 with any most popular SEO/SMM software: iMacros, XRumer, GSA SER, ZennoPoster, Srapebox, Senuke, and more than 100 of other software.

Interested? There are a lot of introducing videos about XEvil in YouTube.

FREE DEMO AVAILABLE!

See you later ;)




http://XEvil.net/
amoxclav
2018-06-05 16:26
What's up to all, as I am truly eager of reading this weblog’s post to be updated on a regular basis. It consists of nice material.
amox-clav 500 mg
2018-06-05 11:40
You have to waste less time to look for your required matter on world-wide-web, because today the searching methods of search engines are good. That’s why I fount this paragraph here.
amoxicilina 500
2018-06-05 11:29
When someone writes an paragraph he/she keeps the thought of a user in his/her mind that how a user can be aware of it. Therefore that’s why this piece of writing is perfect. Thanks!
amox clav 875 mg
2018-06-05 08:55
I'd like to find out more? I'd care to find out more details.

发表评论:

Powered by emlog