A useful tool to search for the cryptographic signatures in a file or process is Signsrch, which can be downloaded from http://aluigi.altervista.org/mytoolz.htm. This tool relies on cryptographic signatures to detect encryption algorithms. The cryptographic signatures are located in a text file, signsrch.sig. In the following output, when signsrch is run with the -e option, it displays the relative virtual addresses where the DES signatures were detected in the binary:
C:\signsrch>signsrch.exe -e kav.exeSignsrch 0.2.4by Luigi Auriemmae-mail: aluigi@autistici.orgweb: aluigi.org optimized search function by Andrew http://www.team5150.com/~andrew/ disassembler engine by Oleh Yuschuk- open file ...
