[分析引擎开发笔记]64位系统支持

2017-4-14 Nie.Meining Life

这两天为分析引擎http://tcasoft.com/提供了64位系统支持,上传样本时可以选择64位环境了:

64up.png


其实Windows系统64位和32位的内核数据结构差异并不大,只是变量具体偏移、具体长度方面的变化,所以对于API等上层行为的监控来讲比较容易实现,反而是Shellcode检测、漏洞攻击检测等指令分析方面的差异很大,还需要不断优化。

目前64位分析环节只准备了一个简单的镜像用于测试,没有安装Office等常用软件。展示一个测试样本的分析报告:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=65

20170414200619.png


基本上具备了和32位系统一样的分析能力。

----------------------------------------------------------------------------------


另外再分享一个最近比较火的样本,CVE-2017-0199:

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?id=73

从网络数据包解析一栏可以看出,该样本从 rottastics36w.net/template.doc 下载了恶意代码:

64up.png


不过这个链接目前已经无法访问了。


评论:

ValerieRap
2019-07-08 13:55
http://philadelphiannetwork.com/groups/online-slots-90334
http://tnluni.com/groups/online-casino-87620
http://rlcmo.org/groups/online-casinos-81445
http://www.akuntansi.club/forums/topic/online-casino-real-money-95999/
http://expresslanguagesonline.com/groups/online-slots-86137
http://www.salaser.org/groups/casino-slots-94430
http://thehighschoolonline.net/groups/online-casino-98223
http://ghanasdgs.info/forums/topic/online-casinos-94226/
http://www.samsonracioppi.com/groups/online-casinos-92705
http://www.amazon-blacklist.com/groups/online-casino-games-91205
http://www.activemuslima.org/groups/casino-games-95541
http://letsmakemoneyonlinefast.com/forums/user/brokveka1977
http://www.ccmining.org/groups/casino-games-83758
http://www.activemuslima.org/groups/online-casinos-80183
https://malawiusfriends.com/groups/online-slots-88697
http://dealshappenhere.com/groups/online-slots-93594
http://www.margaretmeade.com/groups/online-casino-real-money-90732
http://rlcmo.org/groups/casino-games-96748
http://www.hope4us.net/forums/user/culjoitril1979
http://www.scooterstore.ph/forums/user/lesmgorchi1981
Rannevknoca
2019-07-08 04:53
kanada preiswerter viagra
trantyRurdyspusty
2019-07-08 01:19
is it safe to take cialis and sildenafil at the same time http://cialisbhg.com cialis cheap, 1st-pharmacy.net/cialis
Rannevknoca
2019-07-08 01:12
link for you female is uk
trantyRurdyspusty
2019-07-07 22:56
proscar and viagra interaction http://buyscialisrx.com generic cialis online, works of viagra
Rannevknoca
2019-07-07 20:01
how com viagra cost so much
Rannevknoca
2019-07-07 19:38
viagra scadut
Aarontic
2019-07-07 14:50
http://tofranil.team/ - tofranil for bedwetting
Aarontic
2019-07-07 13:55
http://effexor.us.com/ - effexor
Rannevknoca
2019-07-07 09:55
acheter viagra le moins cher
Beverlywag
2019-07-07 07:54
http://sportsnetwork.eu/forums/user/bayprembe1983
http://www.jurei.com.ar/forums/user/menclesshyd1971
http://metroproweb.com/?option=com_k2&view=itemlist&task=user&id=3867
http://www.lifeedu.com.hk/groups/online-casino-real-money-94485
http://mamyschool.com/forums/user/oondlinan1988
http://www.fhle.org/groups/online-slots-92172
http://www.boazandruthpalace.org/forums/topic/online-casino-real-money-81172/
http://kampai.org/groups/online-casino-real-money-82998
http://tfit.ir/forums/topic/online-casino-real-money-83419/
http://www.habeshacentral.com/groups/casino-games-91335
https://dating.nigeriansinsouthafrica.co.za/groups/casino-online-91289
http://deltaibiza.com/groups/casino-games-87500
http://www.fhle.org/groups/online-casino-real-money-82595
http://cc-fullz68.com/forums/topic/online-casino-real-money-94116/
http://hotbhabhiji.com/groups/casino-online-89082
http://kampai.org/groups/online-casino-real-money-94163
https://malawiusfriends.com/groups/online-casino-games-85133
http://blackbusinessavenue.com/groups/online-casino-real-money-98983
https://www.shareapin.com/groups/online-casino-real-money-90038
http://dignifiedbeauty.org/groups/casino-games-86972
Megaknoca
2019-07-07 05:41
77f5 is price 50mg

  
    

try it is one a day
Rannevknoca
2019-07-07 00:33
is is simili
Aarontic
2019-07-06 08:46
http://tadalafil.cc/ - tadalafil
Megaknoca
2019-07-06 02:11
being is canada online

     0fe2 dosage of is daily

发表评论:

Powered by emlog