AwesomeREA.org

Tool

FindCrypt - Ghidra Edition

Ghidra script that ports Ilfak Guilfanov's FindCrypt plugin for IDA, searching a program's memory or the current selection for constants of cryptographic and compression algorithms. Its serialized signature database keeps the original plugin's 79 algorithm constant sets and, by the README's count, holds 122 detectable constants for hash functions, block and stream ciphers, Curve25519 code, Keccak and zlib; when a whole constant is absent, the script also looks for its individual elements and reports partial matches above a detection threshold. Hits become Ghidra bookmarks and a results table from which matching data can be defined.

Requirements & limits

  • The README says the project is discontinued because its author cannot keep it maintained, and points to forks such as TorgoTorgo/ghidra-findcrypt. The reviewed master commit dates from 2021-03-18; the last release, 1.5 of 2020-04-17, attaches FindCrypt.java and database.d3v, and the script and database both report version 7. No supported Ghidra versions are stated; the installation example path names Ghidra 9.0.
  • Installation is manual: copy FindCrypt.java into Ghidra's Features/BytePatterns/ghidra_scripts directory and the findcrypt_ghidra database folder into the user's home directory, then run the script from the Script Manager on a program already loaded in Ghidra. Headless runs print the results instead of opening the table.
  • By default each run contacts raw.githubusercontent.com to compare script and database versions with this repository and downloads a newer database.d3v into the home-directory folder; the README describes the __FORCE_NO_DBUPDATE and __FORCE_NO_SCRIPTUPDATE flags in the script that turn this off.
  • Detection is a byte search for known constants, so hits mark candidate locations rather than confirming that an algorithm is used, and code that carries no table constants is not found. New signatures are built with the FCExporter Visual Studio project in Utils, which needs Crypto++ for compression.
  • GPL-3.0, with the Crypto++ license notice included for the exporter. The README credits Ilfak Guilfanov's original plugin, and the database changelog credits contributor Pawlos with its current format. The reviewed sources state no REA use, and this collection ran nothing.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  2. FindCrypt.java GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  3. findcrypt_ghidra/last_chlog.txt GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  4. Utils/FCExporter/README.txt GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  5. LICENSE GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  6. Licenses/Crypto++.txt GitHub · d3v1l401/FindCrypt-Ghidra · Revision 71660fd
  7. https://github.com/d3v1l401/FindCrypt-Ghidra/releases/tag/1.5

More in Native binaries

All 113 entries in Native binaries