https://github.com/AllsafeCyberSecurity/py-findcrypt-ghidra

FindCrypt for Ghidra written in Python
https://github.com/AllsafeCyberSecurity/py-findcrypt-ghidra

ghidra ghidra-scripts

Last synced: about 2 months ago
JSON representation

FindCrypt for Ghidra written in Python

• Host: GitHub
• URL: https://github.com/AllsafeCyberSecurity/py-findcrypt-ghidra
• Owner: AllsafeCyberSecurity
• License: apache-2.0
• Created: 2020-05-12T17:32:06.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2020-05-20T08:26:23.000Z (over 4 years ago)
• Last Synced: 2024-04-08T20:13:44.729Z (5 months ago)
• Topics: ghidra, ghidra-scripts
• Language: Python
• Size: 119 KB
• Stars: 22
• Watchers: 7
• Forks: 2
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-ghidra - py-findcrypt-ghidra - FindCrypt for Ghidra written in Python. All constants are referenced from [findcrypt](https://github.com/you0708/ida/tree/master/idapython_tools/findcrypt). (Ghidra Scripts/Plugins/Extension)

README

        
# py-findcrypt-ghidra

FindCrypt for Ghidra written in Python.

All constants are referenced from [findcrypt](https://github.com/you0708/ida/tree/master/idapython_tools/findcrypt).

## Installation

clone this repository and add the cloned path to `Script Directories` in `Script Manager` of Ghidra.

## Usage

Run `findcrypt.py` after installation. once successfully done, this script will show the found algorithm name and address, like following.

```bash

findcrypt.py> Running...

[*] processing non-sparse consts

 [+] found CRC32_m_tab_le for CRC32 at 4b2992d0

 [+] found SHA256_K for SHA256 at 4b28d9e0

[*] processing sparse consts

 [+] found SHA256_H for SHA256 at 4b2edb20

 [+] found MD5_initstate for MD5 at 4b37a610

[*] processing operand consts

findcrypt.py> Finished!

```

## Known issues

 - can't find consts in 64bit binary

 - maybe doesn't work for sparse consts in non-function