# FindCrypt - Ghidra Edition

> Ghidra script that ports Ilfak Guilfanov's FindCrypt plugin for IDA, searching a program's memory or the current selection for constants of cryptographic and compression algorithms. Its serialized signature database keeps the original plugin's 79 algorithm constant sets and, by the README's count, holds 122 detectable constants for hash functions, block and stream ciphers, Curve25519 code, Keccak and zlib; when a whole constant is absent, the script also looks for its individual elements and reports partial matches above a detection threshold. Hits become Ghidra bookmarks and a results table from which matching data can be defined.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-02
- Original resource: <https://github.com/d3v1l401/FindCrypt-Ghidra>
- Primary source: <https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/README.md>
- Catalog page: <https://awesomerea.org/resources/findcrypt-ghidra/>
- Record JSON: <https://awesomerea.org/resources/findcrypt-ghidra/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/findcrypt-ghidra/index.md)

## Requirements & limits

- The README says the project is discontinued because its author cannot keep it maintained, and points to forks such as TorgoTorgo/ghidra-findcrypt. The reviewed master commit dates from 2021-03-18; the last release, 1.5 of 2020-04-17, attaches FindCrypt.java and database.d3v, and the script and database both report version 7. No supported Ghidra versions are stated; the installation example path names Ghidra 9.0.
- Installation is manual: copy FindCrypt.java into Ghidra's Features/BytePatterns/ghidra_scripts directory and the findcrypt_ghidra database folder into the user's home directory, then run the script from the Script Manager on a program already loaded in Ghidra. Headless runs print the results instead of opening the table.
- By default each run contacts raw.githubusercontent.com to compare script and database versions with this repository and downloads a newer database.d3v into the home-directory folder; the README describes the __FORCE_NO_DBUPDATE and __FORCE_NO_SCRIPTUPDATE flags in the script that turn this off.
- Detection is a byte search for known constants, so hits mark candidate locations, and code that carries no table constants is not found. New signatures are built with the FCExporter Visual Studio project in Utils, which needs Crypto++ for compression.
- GPL-3.0, with the Crypto++ license notice included for the exporter. The README credits Ilfak Guilfanov's original plugin, and the database changelog credits contributor Pawlos with its current format.

## Primary sources

1. <https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/README.md>
2. <https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/FindCrypt.java>
3. <https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/findcrypt_ghidra/last_chlog.txt>
4. <https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/Utils/FCExporter/README.txt>
5. <https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/LICENSE>
6. <https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/Licenses/Crypto++.txt>
7. <https://github.com/d3v1l401/FindCrypt-Ghidra/releases/tag/1.5>

## More in Native binaries

- [Binary Refinery](https://awesomerea.org/resources/binary-refinery/index.md) · Tool
- [AngryGhidra](https://awesomerea.org/resources/angryghidra/index.md) · Tool
- [fpicker](https://awesomerea.org/resources/fpicker/index.md) · Tool
- [RetroWrite](https://awesomerea.org/resources/retrowrite/index.md) · Tool
- [Interruptor](https://awesomerea.org/resources/interruptor/index.md) · Tool
- [dyld_cache_extract](https://awesomerea.org/resources/dyld-cache-extract/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.