Learning Malware Analysis

2.2 Detecting Crypto Constants Using FindCrypt2

Findcrypt2 (http://www.hexblog.com/ida_pro/files/findcrypt2.zip) is an IDA Pro plug-in that searches for cryptographic constants used by many different algorithms in memory. To use the plugin, download it, and copy the findcrypt.plw file into the IDA plugins folder. Now, when you load the binary, the plugin is automatically run, or you can manually invoke it by selecting Edit | Plugins | Find crypt v2. The results of the plugin are displayed in the output window:

The FindCrypt2 plugin can also be run when in the debugging mode. FindCrypt2 works well if you are using IDA 6.x or a lower version; ...