2

I reverse an .exe file with IDA.

I see a function that appears to be encrypting something by generating some random numbers.

It there any tool to identify if it is a known encryption algorithm?

Improve this question
2
  • Not entirely related but you might find this question useful
    – NirIzr
    Commented Jul 3, 2018 at 15:25
  • I tool that can do this is peid. It searches for common magic values used in algorithms.
    – Michael Pittino
    Commented Jul 3, 2018 at 17:15

1 Answer 1

Reset to default
2

Signsrch is a somewhat old tool that searches for signatures and magic values for different encryption and hash algorithms. I had a collection of other similar tools in the past, so I believe you can find other related tools by googling for a while.

There's a IDA plugin re-implementation of the same plugin here, you may wanna use it instead.

Improve this answer
1
  • Thank you, I not understand how to install the ida plugin? Copy the plug-in and signsrch.xml file to your IDA Pro "plugins" directory. witch file do I need to copt? I saw there source file.
    – Keystone
    Commented Jul 8, 2018 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.