version: "1.0.0" name: ags-ghidra-findcrypt description: "FindCrypt is a Ghidra extension that scans binaries for known cryptographic constants and labels matching implementations during analysis. It is written in Java and built with Gradle as a standard Ghi" metadata: type: reference source: mcp-gamehacking/skills/ags-ghidra-findcrypt

ghidra findcrypt

Author: TorgoTorgo Source: mcp-gamehacking/skills/ags-ghidra-findcrypt

Description

FindCrypt is a Ghidra extension that scans binaries for known cryptographic constants and labels matching implementations during analysis. It is written in Java and built with Gradle as a standard Ghidra analyzer plugin. A JSON signature database ships with byte patterns for common algorithms such as AES S-boxes, DES tables, MD5, SHA-1, TEA, Salsa, CRC32, and other cipher or hash constants. The analyzer matches those signatures in program memory so reverse engineers can quickly locate crypto routines. It is aimed at reverse engineering and malware or game-security analysis where identifying encryption and hashing code in disassembled binaries is a common first step.