2.2 Detecting Crypto Constants Using FindCrypt2

Findcrypt2 (http://www.hexblog.com/ida_pro/files/findcrypt2.zip) is an IDA Pro plug-in that searches for cryptographic constants used by many different algorithms in memory. To use the plugin, download it, and copy the findcrypt.plw file into the IDA plugins folder. Now, when you load the binary, the plugin is automatically run, or you can manually invoke it by selecting Edit | Plugins | Find crypt v2. The results of the plugin are displayed in the output window:

The FindCrypt2 plugin can also be run when in the debugging mode. FindCrypt2 works well if you are using IDA 6.x or a lower version; ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.