{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/polymorf/findcrypt-yara/blob/044644b9c52ae3e7b2305bac15b0c12c9e31a282/findcrypt3.py#L178-L212",
    "https://github.com/polymorf/findcrypt-yara/blob/044644b9c52ae3e7b2305bac15b0c12c9e31a282/findcrypt3.rules",
    "https://github.com/polymorf/findcrypt-yara/blob/044644b9c52ae3e7b2305bac15b0c12c9e31a282/LICENSE"
  ],
  "category": "native-analysis",
  "description_en": "IDA Pro plugin that scans the loaded database with YARA rules for cryptographic constants and similar signatures, lists the matches in a results window and names each matching address after its rule. Its bundled findcrypt3.rules has 126 rules covering constants and tables of hash, cipher and checksum algorithms such as MD5, SHA-1, SHA-256, SHA-512, RIPEMD-160, Whirlpool, DES, Blowfish, RC6, TEA and CRC32, big-number and prime constants, crypto API names and functions of libraries such as OpenSSL, Crypto++, MIRACL and FGint; users can add their own .rules files.",
  "description_zh": "IDA Pro 插件，用 YARA 规则在已加载的数据库中扫描密码学常量等特征，在结果窗口中列出匹配项，并按规则名为每个匹配地址命名。随附的 findcrypt3.rules 包含 126 条规则，涵盖 MD5、SHA-1、SHA-256、SHA-512、RIPEMD-160、Whirlpool、DES、Blowfish、RC6、TEA 和 CRC32 等哈希、加密与校验算法的常量和查找表，大数与素数常量，加密 API 名称，以及 OpenSSL、Crypto++、MIRACL 和 FGint 等库中的函数；用户还可添加自己的 .rules 文件。",
  "entry_url": "https://awesomerea.org/resources/findcrypt-yara/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/findcrypt-yara/",
  "evidence_url": "https://github.com/polymorf/findcrypt-yara/blob/044644b9c52ae3e7b2305bac15b0c12c9e31a282/README.md",
  "group": "tools",
  "id": "findcrypt-yara",
  "json_url": "https://awesomerea.org/resources/findcrypt-yara/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/findcrypt-yara/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/findcrypt-yara/index.md",
  "name": "findcrypt-yara",
  "name_zh": "findcrypt-yara IDA Pro 密码学常量识别插件",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "scope",
    "license"
  ],
  "requirements": [
    "IDA Pro with IDAPython and the yara-python package; the README warns against installing the yara pip package, which is not compatible. Custom rule files go in .idapro/plugins/findcrypt-yara/ under the home directory on Linux and macOS, or in the Hex-Rays IDA Pro plugin folder under %APPDATA% on Windows.",
    "The repository has no releases; the plugin reports version 0.2 with the default hotkey Ctrl-Alt-F, and the reviewed master commit is dated 2024-11-19.",
    "BSD-3-Clause per LICENSE."
  ],
  "requirements_zh": [
    "需要带 IDAPython 的 IDA Pro 和 yara-python 包；README 提醒不要安装与该插件不兼容的 yara pip 包。自定义规则文件在 Linux 和 macOS 上放在主目录下的 .idapro/plugins/findcrypt-yara/，在 Windows 上放在 %APPDATA% 下 Hex-Rays IDA Pro 的插件目录中。",
    "仓库没有发布版本；插件自身标注的版本为 0.2，默认快捷键为 Ctrl-Alt-F，所审阅的 master 分支提交日期为 2024-11-19。",
    "依 LICENSE 采用 BSD-3-Clause 许可。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/polymorf/findcrypt-yara",
  "verification": "source-reviewed",
  "verified_at": "2026-11-05"
}