[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎（http://tcasoft.com/）提供了64位系统支持，上传样本时可以选择64位环境了：

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大，只是变量具体偏移、具体长度方面的变化，所以对于API等上层行为的监控来讲比较容易实现，反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大，还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试，没有安装Office等常用软件。展示一个测试样本的分析报告：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本，CVE-2017-0199：

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出，该样本从 rottastics36w.net/template.doc 下载了恶意代码：

64up.png


不过这个链接目前已经无法访问了。


« WannaCry勒索软件分析 | 分析平台再次升级»

评论：

Donaldcon
2018-04-13 23:44
I have found quite a lot of useful information on your website particularly this page. Many thanks for sharing.
http://www.flandria-axel.nl/custom-report-writing-service-ivory-investigation/
回复
Jameskar
2018-04-13 23:15
Wow! This might be by far the most useful thing on the topic I've ever come across. Many thanks for your work.
http://www.cpbasalti.it/why-im-done-asking-my-husband-to-help-me-out/
回复
Jerrymit
2018-04-13 23:09
I like to get my inspiration from really meaningful phrases said by truly great people like “What is rational is actual and what is actual is rational”, do you know where I can find thematic compiltaions of those?

http://www.kommunemusikken.no/2018/01/what-s-a-thesis/
回复
Gbctwems
2018-02-16 14:01
https://writinghelp.us.com/
research paper assignments
https://writinghelp.us.com/ - essay helper
OK’
回复
FvesAbravy
2018-01-27 13:24
5 mg cialis http://ciallisonline.com/ ok’
回复
Kmrcexibra
2017-10-27 20:59
Your knowledge is amazingly helpful.
回复
Ksffhexibra
2017-10-26 22:02
Great looking web site. Assume you did a bunch of your very own html coding.
回复
Nxgbbsoype
2017-10-20 14:49
Simply wanted to stress Now i'm relieved that i happened on the website!
回复
Nxbbsoype
2017-10-17 02:18
Thanks very helpful. Will certainly share site with my good friends.
回复
Njiksoype
2017-10-03 16:27
Thanks, this site is extremely valuable.
回复
Nzbxsoype
2017-09-21 21:01
say thanks to a lot for your internet site it assists a lot.
回复
Necxexibra
2017-09-21 20:17
Your posts is very helpful.
回复

发表评论：

Powered by emlog