# findcrypt-yara

> IDA Pro plugin that scans the loaded database with YARA rules for cryptographic constants and similar signatures, lists the matches in a results window and names each matching address after its rule. Its bundled findcrypt3.rules has 126 rules covering constants and tables of hash, cipher and checksum algorithms such as MD5, SHA-1, SHA-256, SHA-512, RIPEMD-160, Whirlpool, DES, Blowfish, RC6, TEA and CRC32, big-number and prime constants, crypto API names and functions of libraries such as OpenSSL, Crypto++, MIRACL and FGint; users can add their own .rules files.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-11-05
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/polymorf/findcrypt-yara>
- Primary source: <https://github.com/polymorf/findcrypt-yara/blob/044644b9c52ae3e7b2305bac15b0c12c9e31a282/README.md>
- Catalog page: <https://awesomerea.org/resources/findcrypt-yara/>
- Record JSON: <https://awesomerea.org/resources/findcrypt-yara/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/findcrypt-yara/index.md)

## Requirements & limits

- **Prerequisites:** IDA Pro with IDAPython and the yara-python package; the README warns against installing the yara pip package, which is not compatible. Custom rule files go in .idapro/plugins/findcrypt-yara/ under the home directory on Linux and macOS, or in the Hex-Rays IDA Pro plugin folder under %APPDATA% on Windows.
- **Scope:** The repository has no releases; the plugin reports version 0.2 with the default hotkey Ctrl-Alt-F, and the reviewed master commit is dated 2024-11-19.
- **License:** BSD-3-Clause per LICENSE.

## Primary sources

1. <https://github.com/polymorf/findcrypt-yara/blob/044644b9c52ae3e7b2305bac15b0c12c9e31a282/README.md>
2. <https://github.com/polymorf/findcrypt-yara/blob/044644b9c52ae3e7b2305bac15b0c12c9e31a282/findcrypt3.py#L178-L212>
3. <https://github.com/polymorf/findcrypt-yara/blob/044644b9c52ae3e7b2305bac15b0c12c9e31a282/findcrypt3.rules>
4. <https://github.com/polymorf/findcrypt-yara/blob/044644b9c52ae3e7b2305bac15b0c12c9e31a282/LICENSE>

## More in Native binaries

- [deREferencing](https://awesomerea.org/resources/dereferencing/index.md) · Tool
- [HexRays Toolbox](https://awesomerea.org/resources/hexrays-toolbox/index.md) · Tool
- [Virtuailor](https://awesomerea.org/resources/virtuailor/index.md) · Tool
- [xAnalyzer](https://awesomerea.org/resources/xanalyzer/index.md) · Tool
- [Voltron](https://awesomerea.org/resources/voltron/index.md) · Tool
- [Remill](https://awesomerea.org/resources/remill/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.