[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

VFOrval
2018-06-05 02:55
I have found quite a lot of helpful information on your website particularly this page. Thanks for sharing.
http://finoarte.ru/college-plus-do-the-job-set-a-written-report-from/
amoxi
2018-06-05 02:00
I am really eager of watching funny video lessons at youtube, and this videos is truly so humorous, hehehhe.
amoxicillin online
2018-06-04 23:19
It’s actually very complex in this busy life to listen news on Television, thus I just use world wide web for that purpose, and obtain the latest information.
amoxil
2018-06-04 17:43
Wow! this cartoon type YouTube video I have viewed when I was in primary level and at this time I am in university and seeing that once more at this time.
amoxicillin
2018-06-04 16:37
What's up, just wanted to mention, I loved this post. It was inspiring. Keep on posting!
cheap 500mg amoxil
2018-06-03 23:30
Wow! Finally I got a web site from where I know how to really obtain valuable data regarding my study and knowledge.
amoxil 500mg
2018-06-03 15:59
Why YouTube video clips are shared everywhere? I think one reason is that these are easy to get embed script and paste that script somewhere you would like.
amoxil 500mg
2018-06-03 15:45
Hi it's me Fiona, I am also visiting this web page daily, this website is in fact good and the visitors are actually sharing pleasant thoughts.
cheap amoxil 500 mg
2018-06-03 14:47
What a video it is! Actually amazing and fastidious quality, please upload more videos having such nice quality. Thanks.
amoxil coupon
2018-06-03 14:18
It’s enormous that you are getting ideas from this post as well as from our discussion made here.
amoxil 500mg prezzo
2018-06-03 11:22
Very quickly this web site will be famous amid all blogging and site-building visitors, due to it's fastidious articles
prezzo amoxil 500 mg
2018-06-03 09:38
Amazing YouTube movies posted at this web site, I am going to subscribe for daily updates, for the reason that I don’t desire to miss this series.
500mg amoxil
2018-06-03 07:14
This video post is in fact enormous, the echo feature and the picture quality of this film post is genuinely awesome.
cheap amoxil online
2018-06-03 04:30
Hello, this weekend is good for me, since this moment i am reading this wonderful educational post here at my house.
cheap 500mg amoxil
2018-06-03 03:47
Why YouTube video clips are shared everywhere? I think one motive is that these are simple to take embed code and paste that code somewhere you would like.

发表评论:

Powered by emlog