[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

cheap cialis 20mg
2018-06-19 01:25
I also like Flash, however I am not a good designer to design a Flash, except I have software program by witch a Flash is automatically produced and no more to hard working.
cialis prices
2018-06-19 01:12
What's up, for all time i used to check web site posts here early in the morning, since i enjoy to gain knowledge of more and more.
cialis
2018-06-19 01:07
What's up, its understandable piece of writing along with this YouTube video; I can’t imagine that one can not understand this easy piece of writing having with video presentation.
buy cialis online
2018-06-19 00:32
Awesome YouTube movies posted at this web site, I am going to subscribe for regularly updates, for the reason that I don’t want to fail to take this series.
liquid cialis
2018-06-19 00:22
What's up, can any body help me how to download this video tutorial from this site, I have watched and listen it at this place but desire to down load it.
Homerowern
2018-06-19 00:02
I'm impressed. I do not think I've met anybody who understands as much about the topic. You need to make a career of it, really, impressive blog
http://www.ecomoods.cz/com-organization-destroys-this-stereotype-having-a/
BruceJen
2018-06-18 23:20
It is a really great resource!A lot of helpful info and handy ideas, thank you =)
http://smokinhotpizza.com/blog/him-or-her-self-is-positioned-while-othello-is-in/
buy tadalafil
2018-06-18 22:05
Today YouTube video clips quality is more better and enhanced, therefore that’s the cause that I am watching this video at at this point.
cialis coupons
2018-06-18 21:19
This article about SEO is actually fastidious one, and the back links are truly very useful to market your website, its also referred to as Search engine optimisation.
tadalafil coupon
2018-06-18 21:09
Awesome YouTube movies posted at this site, I am going to subscribe for on a regular basis updates, as I don’t would like to miss this series.
cialis uk
2018-06-18 21:02
Hi, I desire to subscribe for this website to take latest updates, so where can i do it please help.
cheap 20 mg cialis
2018-06-18 20:48
Hello everybody, I am sure you will be enjoying here by watching these comic videos.
tadalafil coupon
2018-06-18 20:33
If you are going to watch comic videos on the net then I suggest you to pay a quick visit this web site, it includes really thus comic not only video clips but also other material.
200 cialis coupon
2018-06-18 19:44
What's up, is it rite to only study from publications not to pay a visit web for most recent updates, what you say friends?
coupon tadalafil
2018-06-18 19:42
What's up, for Web optimization genuine contents are genuinely necessary, if you just copy and paste then you can not ranked in search engines.

发表评论:

Powered by emlog