{"id":13422879,"url":"https://github.com/TorgoTorgo/ghidra-findcrypt","last_synced_at":"2025-03-15T12:30:59.925Z","repository":{"id":38374379,"uuid":"286090244","full_name":"TorgoTorgo/ghidra-findcrypt","owner":"TorgoTorgo","description":"Ghidra analysis plugin to locate cryptographic constants","archived":false,"fork":false,"pushed_at":"2023-06-13T14:34:07.000Z","size":225,"stargazers_count":244,"open_issues_count":4,"forks_count":23,"subscribers_count":4,"default_branch":"main","last_synced_at":"2024-10-28T00:02:01.859Z","etag":null,"topics":["analysis","crypt","cryptography","findcrypt","ghidra","ghidra-extension","ghidra-findcrypt","ghidra-plugin"],"latest_commit_sha":null,"homepage":"https://gitlab.com/Torgo/ghidra_findcrypt","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/TorgoTorgo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-08-08T17:38:48.000Z","updated_at":"2024-10-26T01:47:22.000Z","dependencies_parsed_at":"2022-08-25T02:11:28.605Z","dependency_job_id":null,"html_url":"https://github.com/TorgoTorgo/ghidra-findcrypt","commit_stats":null,"previous_names":[],"tags_count":15,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TorgoTorgo%2Fghidra-findcrypt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TorgoTorgo%2Fghidra-findcrypt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TorgoTorgo%2Fghidra-findcrypt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/TorgoTorgo%2Fghidra-findcrypt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/TorgoTorgo","download_url":"https://codeload.github.com/TorgoTorgo/ghidra-findcrypt/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243731074,"owners_count":20338766,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["analysis","crypt","cryptography","findcrypt","ghidra","ghidra-extension","ghidra-findcrypt","ghidra-plugin"],"created_at":"2024-07-30T23:00:59.340Z","updated_at":"2025-03-15T12:30:54.915Z","avatar_url":"https://github.com/TorgoTorgo.png","language":"Java","funding_links":[],"categories":["Ghidra Plugins","Java"],"sub_categories":[],"readme":"# Ghidra FindCrypt\n![Bug eyed Ghidra looks at complex algorithms](docs/findcrypt_logo.png)\n\n[![Github status](https://github.com/TorgoTorgo/ghidra-findcrypt/actions/workflows/main.yml/badge.svg)](https://github.com/TorgoTorgo/ghidra-findcrypt/actions/workflows/main.yml)\n[![Gitlab status](https://gitlab.com/Torgo/ghidra_findcrypt/badges/master/pipeline.svg)](https://gitlab.com/Torgo/ghidra_findcrypt/pipelines/master/latest)\n\nThis is a re-write of another [Ghidra FindCrypt](https://github.com/d3v1l401/FindCrypt-Ghidra/) script\nas an auto analysis module. It also takes better advantage of the Ghidra\nAPI to label found constants.\n\n## Building\n\nFindCrypt builds like a standard Ghidra module:\n\n```bash\ncd FindCrypt\nGHIDRA_INSTALL_DIR=/path/to/Ghidra_PUBLIC... gradle\n```\n\nThis will output a zip in the `FindCrypt/dist/` directory.\n\nNote: Ghidra FindCrypt no longer supports Ghidra versions prior to 9.2 as they\nlack the Gson JSON library.\n\n## Installing\n\nYou can either build it yourself (see above) or download\na zip from the [Github releases](https://github.com/TorgoTorgo/ghidra-findcrypt/releases) or [GitLab releases](https://gitlab.com/Torgo/ghidra_findcrypt/-/releases)\n\nThe extension can be installed into Ghidra like so:\n- Extract the zip if downloaded from the release page\n- From the Project window hit `File` -\u003e `Install extensions...`\n- Click the green plus icon on the top right\n- In the file browser that opens, select the zip. In case of the released zip the final zip is inside  `FindCrypt/dist.\n- Click OK and restart Ghidra\n\n## Using\n\nOnce the script is installed, a new Analysis is added to the Auto Analyze window\ncalled \"Find Crypt\", it's enabled by default and it's safe to re-run. If you have\nan existing file, open the \"Analysis\" menu in the CodeBrowser tool and click\n\"Auto Analyze\". Select the \"Find Crypt\" analysis from the list and click Analyze.\n\nOnce the analysis is complete, any found crypt constants will be labeled with\nthe algorithm they're associated with. You can find these labels in the \"Labels\"\nfolder in the Symbol Tree window. The labels are prefixed with `CRYPT_` to group\nthem together.\n\nThe analysis will also try to set the datatype for the found constants, but if\na datatype has been applied by another analysis module that other module will\ntake precedence.\n\nA comment is always placed when a crypt constant is found to tell you the type\nand the size of the constant, just in case the datatype wasn't applied.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FTorgoTorgo%2Fghidra-findcrypt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FTorgoTorgo%2Fghidra-findcrypt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FTorgoTorgo%2Fghidra-findcrypt/lists"}