[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

liquid tadalafil
2020-08-28 18:40
cialis 5mg http://jocialisrl.com/ cialis for sale
RobertBap
2020-08-27 00:20
Terrific data, With thanks! online pharmacy school https://canadianpharmaciesrxstore.com top rated online canadian pharmacies
ScottGuith
2020-08-27 00:17
With thanks, Quite a lot of advice.
canada drugs pharmacy online http://canadianpharmacyed.com/order-cleocin-online-en.html canada pharmacies online prescriptions
ScottGuith
2020-08-26 21:22
You suggested this effectively! mexican online pharmacies http://topviagrarxpills.com/order-minomycin-online-en.html cheap viagra online canadian pharmacy
ScottGuith
2020-08-26 19:57
Amazing many of superb info. canadian drug http://rxpharmacymsn.com/order-daklinza-online-en.html canadian mail order pharmacies
ScottGuith
2020-08-26 14:08
Perfectly spoken indeed. . canada meds http://rxpharmacymsn.com/order-minocin-online-en.html prescription cost
ScottGuith
2020-08-26 08:16
Cheers, An abundance of data!
cialis canadian pharmacy http://topcialisrxstore.com/order-levitra-online-en.html canadian prescriptions
ScottGuith
2020-08-26 06:50
Many thanks, Ample knowledge!
overseas pharmacy forum http://canadianpharmacyed.com/order-epivir-online-en.html canada online pharmacies
ScottGuith
2020-08-25 23:26
You said it perfectly.. best online pharmacies canada http://canadianpharmaciesmsn.com/order-kamagra_flavored-online-en.html list of approved canadian pharmacies
ScottGuith
2020-08-25 16:11
Amazing info, Thanks! online pharmacy busted http://canadianpharmacyed.com/order-stendra-online-en.html buy generic viagra online
RobertBap
2020-08-25 08:12
Seriously quite a lot of very good info. pharmacy drugstore online https://homeworkcourseworkhelps.com canada drugs
RobertBap
2020-08-24 23:24
Well expressed truly. ! prescription drug price comparison https://canadianpharmacyfirst.com pharmacy online no prescription
RobertBap
2020-08-23 23:17
Wow tons of terrific tips. most reliable canadian pharmacies https://topswritingservices.com cheap medications
ScottGuith
2020-08-23 23:14
Superb data. With thanks. trusted online pharmacy reviews http://topcialisrxpills.com/order-lamisil-online-en.html ed meds online without doctor prescription
ScottGuith
2020-08-23 06:06
Awesome information. Cheers. cialis pharmacy online http://canadianpharmaceuticalsrx.com/order-loxitane-online-en.html canadian prescription drugs

发表评论:

Powered by emlog