[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

Ivanovknoca
2020-11-05 07:37
3fa831 just try cialis philippines



http://cialisuyew.com/ cialis dopag



https://cialisverygoodn.com/
Weronikaknoca
2020-11-05 07:22
e5a331 india price for cialis 20mg



http://cialisooie.com/ cialis daily use coupon



http://cialisuqpor.com/ cialis for sale in us  order



http://cialisuqwc.com/ cheap generic cialis 10mg



http://cialisuyew.com/
Pestovknoca
2020-11-05 05:53
fb7431 business writing services sydney



https://tabserectilecheap.com/ order 5mg cialis cheap online



https://tadaladilss.com/ wow look it candian viagra



https://via1buynow.com/ viagra thailand prescription



http://viagener2020.com/
writing paper
2020-11-04 03:49
You actually mentioned that exceptionally well. importance of a college education essay https://topessayssites.com essay writing service
Karenknoca
2020-11-03 12:31
is un escompte de prix

f8f0
Salusknoca
2020-11-03 11:46
is does not work

1612 where can i get cheap is

1612
Lyudaknoca
2020-11-03 11:35
how to use spray is

1a96
Gordeevaknoca
2020-10-25 21:49
custom coursework writing service

519d is 20 mg daily

519d only for you is overnight

519d
Zoyaknoca
2020-10-25 18:41
average price of is uk

8b99
online homework help
2020-10-24 16:32
Available Quality online assignment websites with original Ph.D. & Masters level authorities in Australia. Most genuine Price, Promised Better Grades, 100% Plagiarism Free Work, before the deadline. visite our website for online homework help we always ready at your service because we know better about your study so don't wait to join with us for your quick help.
AletlyPlew
2020-10-16 17:30
cialis kicks in http://cialistodo.com/ best site for cialis online
essay writer
2020-10-14 09:09
Nicely put, Thanks a lot. fast essay writing service https://essayssolution.com academic essay writing service
RodneyDwelt
2020-10-10 23:39
medicines for ed https://viaworldph.com/ - how to get viagra without a doctor
RodneyDwelt
2020-10-10 20:49
mens ed https://viaworldph.com/ - generic viagra online
dissertation
2020-10-10 08:21
Thank you. An abundance of knowledge!
  https://discountedessays.com/

发表评论:

Powered by emlog