Flag: Tornado! Hurricane!

IDA Plugins: FindCrypt2

File Information
Category Open Source # Downloads Version
IDA Plugins Yes 6,834 2.0

Download from OpenRCE
MD5 Sum: 0883274E6715D44AF21D5F9C79686F79

Last updated on Feb 7, 2006 with the following description: FindCrypt now works with both little and big endian programs. It knows to reuse old slots in the bookmarks if run repeatedly. It is fully automatic and scans each new created database. Manual scan is still available.

Author Information
Username Name E-Mail URL
  ilfak Ilfak Guilfanov ighexblogcom http://

Description
While analyzing a program quite often we want to know if it uses any crypto algorithm. Knowing the algorithm name would be useful too. Here is the plugin which can help us answer these questions.

The idea behind it pretty simple: since almost all crypto algorithms use magic constants, we will just look for these constants in the program body.

The plugin supports virtually all crypto algorithms and hash functions. I also added the zlib library constants to the list just for the user convenience. Here is the full list:

* Blowfish
* Camellia
* CAST
* CAST256
* CRC32
* DES
* GOST
* HAVAL
* MARS
* MD2
* MD4
* MD5
* PKCS_MD2 (byte sequence used in PKCS envelope)
* PKCS_MD5 (byte sequence used in PKCS envelope)
* PKCS_RIPEMD160 (byte sequence used in PKCS envelope)
* PKCS_SHA256 (byte sequence used in PKCS envelope)
* PKCS_SHA384 (byte sequence used in PKCS envelope)
* PKCS_SHA512 (byte sequence used in PKCS envelope)
* PKCS_Tiger (byte sequence used in PKCS envelope)
* RawDES
* RC2
* RC5
* RC6
* Rijndael
* SAFER
* SHA-1
* SHA-256
* SHA-512
* SHARK
* SKIPJACK
* Square
* Tiger
* Twofish
* WAKE
* Whirlpool
* zlib

Please note that the list does not contain the IDEA algorithm because it usually builds its tables on the fly. Other algorithms can be added if needed.

Screenshot

There are 28,228 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit