Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/allsafecybersecurity/py-findcrypt-ghidra
FindCrypt for Ghidra written in Python
https://github.com/allsafecybersecurity/py-findcrypt-ghidra
ghidra ghidra-scripts
Last synced: about 2 months ago
JSON representation
FindCrypt for Ghidra written in Python
- Host: GitHub
- URL: https://github.com/allsafecybersecurity/py-findcrypt-ghidra
- Owner: AllsafeCyberSecurity
- License: apache-2.0
- Created: 2020-05-12T17:32:06.000Z (over 4 years ago)
- Default Branch: master
- Last Pushed: 2020-05-20T08:26:23.000Z (over 4 years ago)
- Last Synced: 2024-08-05T01:09:38.543Z (5 months ago)
- Topics: ghidra, ghidra-scripts
- Language: Python
- Size: 119 KB
- Stars: 23
- Watchers: 7
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# py-findcrypt-ghidra
FindCrypt for Ghidra written in Python.
All constants are referenced from [findcrypt](https://github.com/you0708/ida/tree/master/idapython_tools/findcrypt).## Installation
clone this repository and add the cloned path to `Script Directories` in `Script Manager` of Ghidra.
## Usage
Run `findcrypt.py` after installation. once successfully done, this script will show the found algorithm name and address, like following.
```bash
findcrypt.py> Running...
[*] processing non-sparse consts
[+] found CRC32_m_tab_le for CRC32 at 4b2992d0
[+] found SHA256_K for SHA256 at 4b28d9e0
[*] processing sparse consts
[+] found SHA256_H for SHA256 at 4b2edb20
[+] found MD5_initstate for MD5 at 4b37a610
[*] processing operand consts
findcrypt.py> Finished!
```## Known issues
- can't find consts in 64bit binary
- maybe doesn't work for sparse consts in non-function