Tool
findcrypt-yara
IDA Pro plugin that scans the loaded database with YARA rules for cryptographic constants and similar signatures, lists the matches in a results window and names each matching address after its rule. Its bundled findcrypt3.rules has 126 rules covering constants and tables of hash, cipher and checksum algorithms such as MD5, SHA-1, SHA-256, SHA-512, RIPEMD-160, Whirlpool, DES, Blowfish, RC6, TEA and CRC32, big-number and prime constants, crypto API names and functions of libraries such as OpenSSL, Crypto++, MIRACL and FGint; users can add their own .rules files.
- Targets
- Binary
- Category
- Native analysis tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: IDA Pro with IDAPython and the yara-python package; the README warns against installing the yara pip package, which is not compatible. Custom rule files go in .idapro/plugins/findcrypt-yara/ under the home directory on Linux and macOS, or in the Hex-Rays IDA Pro plugin folder under %APPDATA% on Windows.
- Scope: The repository has no releases; the plugin reports version 0.2 with the default hotkey Ctrl-Alt-F, and the reviewed master commit is dated 2024-11-19.
- License: BSD-3-Clause per LICENSE.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · polymorf/findcrypt-yara · Revision 044644b
- findcrypt3.py#L178-L212 GitHub · polymorf/findcrypt-yara · Revision 044644b
- findcrypt3.rules GitHub · polymorf/findcrypt-yara · Revision 044644b
- LICENSE GitHub · polymorf/findcrypt-yara · Revision 044644b
More in Native binaries
- deREferencing · Tool
- HexRays Toolbox · Tool
- Virtuailor · Tool
- xAnalyzer · Tool
- Voltron · Tool
- Remill · Tool