Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

FindCrypt - Ghidra Edition

Ghidra script that ports Ilfak Guilfanov's FindCrypt plugin for IDA, searching a program's memory or the current selection for constants of cryptographic and compression algorithms. Its serialized signature database keeps the original plugin's 79 algorithm constant sets and, by the README's count, holds 122 detectable constants for hash functions, block and stream ciphers, Curve25519 code, Keccak and zlib; when a whole constant is absent, the script also looks for its individual elements and reports partial matches above a detection threshold. Hits become Ghidra bookmarks and a results table from which matching data can be defined.

Targets
Binary
Category
Native analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • The README says the project is discontinued because its author cannot keep it maintained, and points to forks such as TorgoTorgo/ghidra-findcrypt. The reviewed master commit dates from 2021-03-18; the last release, 1.5 of 2020-04-17, attaches FindCrypt.java and database.d3v, and the script and database both report version 7. No supported Ghidra versions are stated; the installation example path names Ghidra 9.0.
  • Installation is manual: copy FindCrypt.java into Ghidra's Features/BytePatterns/ghidra_scripts directory and the findcrypt_ghidra database folder into the user's home directory, then run the script from the Script Manager on a program already loaded in Ghidra. Headless runs print the results instead of opening the table.
  • By default each run contacts raw.githubusercontent.com to compare script and database versions with this repository and downloads a newer database.d3v into the home-directory folder; the README describes the __FORCE_NO_DBUPDATE and __FORCE_NO_SCRIPTUPDATE flags in the script that turn this off.
  • Detection is a byte search for known constants, so hits mark candidate locations, and code that carries no table constants is not found. New signatures are built with the FCExporter Visual Studio project in Utils, which needs Crypto++ for compression.
  • GPL-3.0, with the Crypto++ license notice included for the exporter. The README credits Ilfak Guilfanov's original plugin, and the database changelog credits contributor Pawlos with its current format.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  2. FindCrypt.java GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  3. findcrypt_ghidra/last_chlog.txt GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  4. Utils/FCExporter/README.txt GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  5. LICENSE GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  6. Licenses/Crypto++.txt GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  7. https://github.com/d3v1l401/FindCrypt-Ghidra/releases/tag/1.5

More in Native binaries

All 269 entries in Native binaries

↑↓ move↵ open⌘↵ new tab