随便打开了一个可执行文件,翻了翻最下面的Output windows,直接支持python3,欣喜若狂
1.下载脚本插件
https://github.com/polymorf/findcrypt-yara
2.将findcrypt3.py和findcrypt3.rules放到IDA7.5/plugins
3.python3安装yara-python
pip3 install yara-python
插件安装完毕
再次打开Edit>Plugins>Findcrypt,插件可以使用
P.S.
为findcrypt3添加国密SM4算法的识别规则
打开findcrypt3.rules,在最后添加
rule SM4_FK {
meta:
author = "Basstorm"
description = "Look for SM4_FKbox constants"
date = "2020-08"
strings:
$c0 = { C6 BA B1 A3 50 33 AA 56 97 91 7D 67 DC 22 70 B2 }
condition:
$c0
}
rule SM4_CK {
meta:
author = "Basstorm"
description = "Look for SM4_CKbox constants"
date = "2020-08"
strings:
$c0 = { 15 0E 07 00 31 2A 23 1C 4D 46 3F 38 69 62 5B 54 85 7E 77 70 A1 9A 93 8C }
condition:
$c0
}
保存退出
以2020纵横杯friendlyRE为例,Ctrl+Alt+F直接可以识别出sm4