{
  "added_at": "2026-11-02",
  "additional_evidence_urls": [
    "https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/FindCrypt.java",
    "https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/findcrypt_ghidra/last_chlog.txt",
    "https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/Utils/FCExporter/README.txt",
    "https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/LICENSE",
    "https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/Licenses/Crypto++.txt",
    "https://github.com/d3v1l401/FindCrypt-Ghidra/releases/tag/1.5"
  ],
  "category": "native-analysis",
  "description_en": "Ghidra script that ports Ilfak Guilfanov's FindCrypt plugin for IDA, searching a program's memory or the current selection for constants of cryptographic and compression algorithms. Its serialized signature database keeps the original plugin's 79 algorithm constant sets and, by the README's count, holds 122 detectable constants for hash functions, block and stream ciphers, Curve25519 code, Keccak and zlib; when a whole constant is absent, the script also looks for its individual elements and reports partial matches above a detection threshold. Hits become Ghidra bookmarks and a results table from which matching data can be defined.",
  "description_zh": "移植自 Ilfak Guilfanov 为 IDA 编写的 FindCrypt 插件的 Ghidra 脚本，在程序内存或当前选区中查找密码算法与压缩算法的常量。其序列化签名库保留了原插件的 79 组算法常量，按 README 的统计共含 122 个可检测常量，涵盖哈希函数、分组密码与流密码、Curve25519 代码、Keccak 和 zlib；若找不到完整常量，脚本还会查找其中的单个元素，并报告超过检测阈值的部分匹配。命中结果会生成 Ghidra 书签和结果表，可从表中将匹配位置定义为数据。",
  "entry_url": "https://awesomerea.org/resources/findcrypt-ghidra/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/findcrypt-ghidra/",
  "evidence_url": "https://github.com/d3v1l401/FindCrypt-Ghidra/blob/71660fddbe7300acb39e013ad6ad96cd001c0d99/README.md",
  "group": "tools",
  "id": "findcrypt-ghidra",
  "json_url": "https://awesomerea.org/resources/findcrypt-ghidra/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/findcrypt-ghidra/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/findcrypt-ghidra/index.md",
  "name": "FindCrypt - Ghidra Edition",
  "name_zh": "FindCrypt Ghidra 版密码常量识别脚本",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The README says the project is discontinued because its author cannot keep it maintained, and points to forks such as TorgoTorgo/ghidra-findcrypt. The reviewed master commit dates from 2021-03-18; the last release, 1.5 of 2020-04-17, attaches FindCrypt.java and database.d3v, and the script and database both report version 7. No supported Ghidra versions are stated; the installation example path names Ghidra 9.0.",
    "Installation is manual: copy FindCrypt.java into Ghidra's Features/BytePatterns/ghidra_scripts directory and the findcrypt_ghidra database folder into the user's home directory, then run the script from the Script Manager on a program already loaded in Ghidra. Headless runs print the results instead of opening the table.",
    "By default each run contacts raw.githubusercontent.com to compare script and database versions with this repository and downloads a newer database.d3v into the home-directory folder; the README describes the __FORCE_NO_DBUPDATE and __FORCE_NO_SCRIPTUPDATE flags in the script that turn this off.",
    "Detection is a byte search for known constants, so hits mark candidate locations, and code that carries no table constants is not found. New signatures are built with the FCExporter Visual Studio project in Utils, which needs Crypto++ for compression.",
    "GPL-3.0, with the Crypto++ license notice included for the exporter. The README credits Ilfak Guilfanov's original plugin, and the database changelog credits contributor Pawlos with its current format."
  ],
  "requirements_zh": [
    "README 称作者已无法维护，项目已停止开发，并推荐 TorgoTorgo/ghidra-findcrypt 等分支。所审阅的 master 提交日期为 2021-03-18；最后一个版本 1.5 发布于 2020-04-17，附带 FindCrypt.java 和 database.d3v，脚本与签名库的版本号均为 7。未注明支持哪些 Ghidra 版本，安装示例路径中写的是 Ghidra 9.0。",
    "需要手动安装：将 FindCrypt.java 复制到 Ghidra 的 Features/BytePatterns/ghidra_scripts 目录，将 findcrypt_ghidra 签名库文件夹复制到用户主目录，然后对已在 Ghidra 中载入的程序，从脚本管理器运行该脚本。无界面运行时会直接打印结果，而不打开结果表。",
    "默认情况下，每次运行都会连接 raw.githubusercontent.com，将脚本和签名库版本与本仓库比较，并把更新的 database.d3v 下载到主目录下的文件夹中；README 说明可通过脚本中的 __FORCE_NO_DBUPDATE 和 __FORCE_NO_SCRIPTUPDATE 标志关闭此功能。",
    "检测方式是按字节搜索已知常量，因此命中结果只标出候选位置；不含常量表的代码无法被发现。新增签名需使用 Utils 中的 FCExporter Visual Studio 项目构建，该项目依赖 Crypto++ 进行压缩。",
    "采用 GPL-3.0 许可，并为导出工具附带 Crypto++ 许可声明。README 致谢 Ilfak Guilfanov 的原始插件，签名库更新说明则注明当前格式由贡献者 Pawlos 开发。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/d3v1l401/FindCrypt-Ghidra",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}