I use FindCrypt2 Ida plugin but it detect md4 and not md5 , and not detect sha256.
How can I detect md5 in assembly?
How can I detect sha256 in assembly?
thanks
-
Your intention is a little unclear to me. Do you mean to say it generally doesn't detect MD5s (i.e. it says so in it's documentation), that you know it failed detecting an implementation of MD5, or that it didn't find an implementation of MD5 in a given program?– NirIzrCommented Jan 29, 2019 at 11:03
-
1the simplest way might be to look for the constants like 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476.– peter ferrieCommented Feb 1, 2019 at 19:04
Add a comment
|
1 Answer
You can usually spot MD5 quite easily by looking for a huge function. It tends to be the biggest function in the whole binary. That's the MD5_Process() (if I recall the name correctly) function which compilers like to unroll completely, thus making it huge.
Generally, typical hash functions have 3 distinct functions:
- An init function setting up the hash context
- An update function processing data and updating the hash context
- A finish function generating the final hash from the hash context
Both MD5 and SHA256 use magic constants in their init function. You should try to find a C source for either, look for the init functions and the constants (usually hidden in some macro) and then search for those constants in your disassembly.
This is general advice for cryptographic stuff. Find sourcecode, look for distinct constants/patterns and then see if you can find them in disassembly.
