2

I reverse an .exe file with IDA.

I see a function that appears to be encrypting something by generating some random numbers.

It there any tool to identify if it is a known encryption algorithm?

  • Not entirely related but you might find this question useful – NirIzr Jul 3 '18 at 15:25
  • I tool that can do this is peid. It searches for common magic values used in algorithms. – Michael Pittino Jul 3 '18 at 17:15
1

Signsrch is a somewhat old tool that searches for signatures and magic values for different encryption and hash algorithms. I had a collection of other similar tools in the past, so I believe you can find other related tools by googling for a while.

There's a IDA plugin re-implementation of the same plugin here, you may wanna use it instead.

  • Thank you, I not understand how to install the ida plugin? Copy the plug-in and signsrch.xml file to your IDA Pro "plugins" directory. witch file do I need to copt? I saw there source file. – Keystone Jul 8 '18 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.