FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256.
How can I detect md5 in assembly?
How can I detect sha256 in assembly?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
You can usually spot MD5 quite easily by looking for a huge function. It tends to be the biggest function in the whole binary. That's the
MD5_Process() (if I recall the name correctly) function which compilers like to unroll completely, thus making it huge.
Generally, typical hash functions have 3 distinct functions:
Both MD5 and SHA256 use magic constants in their init function. You should try to find a C source for either, look for the init functions and the constants (usually hidden in some macro) and then search for those constants in your disassembly.
This is general advice for cryptographic stuff. Find sourcecode, look for distinct constants/patterns and then see if you can find them in disassembly.