Skip to content

Commit 64f1042

Browse files
author
d3vil401
committedApr 1, 2019
First release
·
1.50.1
0 parents  commit 64f1042

13 files changed

+10883
-0
lines changed
 

‎CONTRIBUTORS

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Luca Massimiliano Francioni <d3vil401@protonmail.com>

‎FindCrypt.java

+860
Large diffs are not rendered by default.

‎LICENSE

+674
Large diffs are not rendered by default.

‎README.md

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# FindCrypt - Ghidra Edition
2+
3+
While for years we used IDA Pro and its incredible plugins developed by its huge community, Ghidra came out recently (at the time of writing) showing a lot of potential and an incredible modular design for customization both in Python or Java.
4+
5+
As most of you know, FindCrypt, a plugin made by nonetheless than Ilfak himself for IDA, is essential for quickly find references to Cryptography functions in the target and extremely useful in the field of Reverse Engineering.
6+
7+
I'm trying to move to Ghidra and the very first thing I noticed is how important is the plugin to me, so I took the responsibility to migrate it, in Java, without sacrificing any signature.
8+
9+
![Demo](https://puu.sh/D8HVe/f75ea40074.gif)
10+
11+
**This software is being developed and tested, if you encounter any problem please proceed into the Issues section**
12+
13+
## Installation
14+
15+
1. Find your Ghidra installation directory (e.g. "E:\Reversing Softwares\ghidra_9.0")
16+
2. Move "FindCrypt.java" into "Ghidra\Features\BytePatterns\ghidra_scripts"
17+
3. Move "findcrypt_ghidra" (database directory) into "C:\Users\\<your user>\\"
18+
4. Be sure "database.d3v" is inside the "findcrypt_ghidra" directory and is accessible by Ghidra (should be by default).
19+
20+
## Usage
21+
22+
Once you started your project and opened the disassembler, use the Script Manager window and search for "FindCrypt.java",
23+
by double clicking or pressing "Run" will execute the script and a result screen is shown if something is found.
24+
25+
![Example result](https://puu.sh/D8HKE/ccd8a3c479.png)
26+
27+
### Database
28+
29+
The database is a binary file I serialized myself, it's very easy to understand and very basic but functional for its goal.
30+
The database contains all of the **79** algorithms constants implemented by Ilfak, no sacrifices have been made while migrating them.
31+
32+
These are the supported algorithms, currently stored in the database being used.
33+
| Category | Names |
34+
|----------|-------|
35+
| **Block ciphers** | Blowfish, Camellia, DES, TripleDES, RC2, SHARK, Cast, Square, WAKE, Skipjack |
36+
| **Hash funcions** | Whirlpool, MD2, MD4, MD5, SHA-1, SHA-256, SHA-384, SHA512, Tiger, RIPEMD160, HAVAL |
37+
| **AES Family** | AES, RC5/RC6, MARS, Twofish, CAST-256, GOST, SAFER |
38+
| **Compression** | ZLib |
39+
40+
To include more constants of your choice, simply refer to the "FCExporter" project and perhaps also share your new entries :)
41+
42+
# Credits
43+
d3vil401 - d3vil401@protonmail.com / d3vil401@d3vsite.org / https://d3vsite.org/
44+
Ilfak Guilfanov - @ilfak
45+
NSA (Ghidra) - https://ghidra-sre.org/
46+
47+
![Ghidra Logo](https://media.defense.gov/2019/Mar/05/2002096238/400/400/0/190503-D-IM742-3002.PNG)
48+
49+
### License
50+
51+
GNU GPLv3

‎Utils/FCExporter/.gitignore

+344
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,344 @@
1+
## Ignore Visual Studio temporary files, build results, and
2+
## files generated by popular Visual Studio add-ons.
3+
##
4+
## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
5+
6+
# User-specific files
7+
*.rsuser
8+
*.suo
9+
*.user
10+
*.userosscache
11+
*.sln.docstates
12+
13+
# User-specific files (MonoDevelop/Xamarin Studio)
14+
*.userprefs
15+
16+
# Mono auto generated files
17+
mono_crash.*
18+
19+
# Build results
20+
[Dd]ebug/
21+
[Dd]ebugPublic/
22+
[Rr]elease/
23+
[Rr]eleases/
24+
x64/
25+
x86/
26+
[Aa][Rr][Mm]/
27+
[Aa][Rr][Mm]64/
28+
bld/
29+
[Bb]in/
30+
[Oo]bj/
31+
[Ll]og/
32+
33+
# Visual Studio 2015/2017 cache/options directory
34+
.vs/
35+
# Uncomment if you have tasks that create the project's static files in wwwroot
36+
#wwwroot/
37+
38+
# Visual Studio 2017 auto generated files
39+
Generated\ Files/
40+
41+
# MSTest test Results
42+
[Tt]est[Rr]esult*/
43+
[Bb]uild[Ll]og.*
44+
45+
# NUNIT
46+
*.VisualState.xml
47+
TestResult.xml
48+
49+
# Build Results of an ATL Project
50+
[Dd]ebugPS/
51+
[Rr]eleasePS/
52+
dlldata.c
53+
54+
# Benchmark Results
55+
BenchmarkDotNet.Artifacts/
56+
57+
# .NET Core
58+
project.lock.json
59+
project.fragment.lock.json
60+
artifacts/
61+
62+
# StyleCop
63+
StyleCopReport.xml
64+
65+
# Files built by Visual Studio
66+
*_i.c
67+
*_p.c
68+
*_h.h
69+
*.ilk
70+
*.meta
71+
*.obj
72+
*.iobj
73+
*.pch
74+
*.pdb
75+
*.ipdb
76+
*.pgc
77+
*.pgd
78+
*.rsp
79+
*.sbr
80+
*.tlb
81+
*.tli
82+
*.tlh
83+
*.tmp
84+
*.tmp_proj
85+
*_wpftmp.csproj
86+
*.log
87+
*.vspscc
88+
*.vssscc
89+
.builds
90+
*.pidb
91+
*.svclog
92+
*.scc
93+
94+
# Chutzpah Test files
95+
_Chutzpah*
96+
97+
# Visual C++ cache files
98+
ipch/
99+
*.aps
100+
*.ncb
101+
*.opendb
102+
*.opensdf
103+
*.sdf
104+
*.cachefile
105+
*.VC.db
106+
*.VC.VC.opendb
107+
108+
# Visual Studio profiler
109+
*.psess
110+
*.vsp
111+
*.vspx
112+
*.sap
113+
114+
# Visual Studio Trace Files
115+
*.e2e
116+
117+
# TFS 2012 Local Workspace
118+
$tf/
119+
120+
# Guidance Automation Toolkit
121+
*.gpState
122+
123+
# ReSharper is a .NET coding add-in
124+
_ReSharper*/
125+
*.[Rr]e[Ss]harper
126+
*.DotSettings.user
127+
128+
# JustCode is a .NET coding add-in
129+
.JustCode
130+
131+
# TeamCity is a build add-in
132+
_TeamCity*
133+
134+
# DotCover is a Code Coverage Tool
135+
*.dotCover
136+
137+
# AxoCover is a Code Coverage Tool
138+
.axoCover/*
139+
!.axoCover/settings.json
140+
141+
# Visual Studio code coverage results
142+
*.coverage
143+
*.coveragexml
144+
145+
# NCrunch
146+
_NCrunch_*
147+
.*crunch*.local.xml
148+
nCrunchTemp_*
149+
150+
# MightyMoose
151+
*.mm.*
152+
AutoTest.Net/
153+
154+
# Web workbench (sass)
155+
.sass-cache/
156+
157+
# Installshield output folder
158+
[Ee]xpress/
159+
160+
# DocProject is a documentation generator add-in
161+
DocProject/buildhelp/
162+
DocProject/Help/*.HxT
163+
DocProject/Help/*.HxC
164+
DocProject/Help/*.hhc
165+
DocProject/Help/*.hhk
166+
DocProject/Help/*.hhp
167+
DocProject/Help/Html2
168+
DocProject/Help/html
169+
170+
# Click-Once directory
171+
publish/
172+
173+
# Publish Web Output
174+
*.[Pp]ublish.xml
175+
*.azurePubxml
176+
# Note: Comment the next line if you want to checkin your web deploy settings,
177+
# but database connection strings (with potential passwords) will be unencrypted
178+
*.pubxml
179+
*.publishproj
180+
181+
# Microsoft Azure Web App publish settings. Comment the next line if you want to
182+
# checkin your Azure Web App publish settings, but sensitive information contained
183+
# in these scripts will be unencrypted
184+
PublishScripts/
185+
186+
# NuGet Packages
187+
*.nupkg
188+
# The packages folder can be ignored because of Package Restore
189+
**/[Pp]ackages/*
190+
# except build/, which is used as an MSBuild target.
191+
!**/[Pp]ackages/build/
192+
# Uncomment if necessary however generally it will be regenerated when needed
193+
#!**/[Pp]ackages/repositories.config
194+
# NuGet v3's project.json files produces more ignorable files
195+
*.nuget.props
196+
*.nuget.targets
197+
198+
# Microsoft Azure Build Output
199+
csx/
200+
*.build.csdef
201+
202+
# Microsoft Azure Emulator
203+
ecf/
204+
rcf/
205+
206+
# Windows Store app package directories and files
207+
AppPackages/
208+
BundleArtifacts/
209+
Package.StoreAssociation.xml
210+
_pkginfo.txt
211+
*.appx
212+
*.appxbundle
213+
*.appxupload
214+
215+
# Visual Studio cache files
216+
# files ending in .cache can be ignored
217+
*.[Cc]ache
218+
# but keep track of directories ending in .cache
219+
!?*.[Cc]ache/
220+
221+
# Others
222+
ClientBin/
223+
~$*
224+
*~
225+
*.dbmdl
226+
*.dbproj.schemaview
227+
*.jfm
228+
*.pfx
229+
*.publishsettings
230+
orleans.codegen.cs
231+
232+
# Including strong name files can present a security risk
233+
# (https://github.com/github/gitignore/pull/2483#issue-259490424)
234+
#*.snk
235+
236+
# Since there are multiple workflows, uncomment next line to ignore bower_components
237+
# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
238+
#bower_components/
239+
240+
# RIA/Silverlight projects
241+
Generated_Code/
242+
243+
# Backup & report files from converting an old project file
244+
# to a newer Visual Studio version. Backup files are not needed,
245+
# because we have git ;-)
246+
_UpgradeReport_Files/
247+
Backup*/
248+
UpgradeLog*.XML
249+
UpgradeLog*.htm
250+
ServiceFabricBackup/
251+
*.rptproj.bak
252+
253+
# SQL Server files
254+
*.mdf
255+
*.ldf
256+
*.ndf
257+
258+
# Business Intelligence projects
259+
*.rdl.data
260+
*.bim.layout
261+
*.bim_*.settings
262+
*.rptproj.rsuser
263+
*- Backup*.rdl
264+
265+
# Microsoft Fakes
266+
FakesAssemblies/
267+
268+
# GhostDoc plugin setting file
269+
*.GhostDoc.xml
270+
271+
# Node.js Tools for Visual Studio
272+
.ntvs_analysis.dat
273+
node_modules/
274+
275+
# Visual Studio 6 build log
276+
*.plg
277+
278+
# Visual Studio 6 workspace options file
279+
*.opt
280+
281+
# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
282+
*.vbw
283+
284+
# Visual Studio LightSwitch build output
285+
**/*.HTMLClient/GeneratedArtifacts
286+
**/*.DesktopClient/GeneratedArtifacts
287+
**/*.DesktopClient/ModelManifest.xml
288+
**/*.Server/GeneratedArtifacts
289+
**/*.Server/ModelManifest.xml
290+
_Pvt_Extensions
291+
292+
# Paket dependency manager
293+
.paket/paket.exe
294+
paket-files/
295+
296+
# FAKE - F# Make
297+
.fake/
298+
299+
# CodeRush personal settings
300+
.cr/personal
301+
302+
# Python Tools for Visual Studio (PTVS)
303+
__pycache__/
304+
*.pyc
305+
306+
# Cake - Uncomment if you are using it
307+
# tools/**
308+
# !tools/packages.config
309+
310+
# Tabs Studio
311+
*.tss
312+
313+
# Telerik's JustMock configuration file
314+
*.jmconfig
315+
316+
# BizTalk build output
317+
*.btp.cs
318+
*.btm.cs
319+
*.odx.cs
320+
*.xsd.cs
321+
322+
# OpenCover UI analysis results
323+
OpenCover/
324+
325+
# Azure Stream Analytics local run output
326+
ASALocalRun/
327+
328+
# MSBuild Binary and Structured Log
329+
*.binlog
330+
331+
# NVidia Nsight GPU debugger configuration file
332+
*.nvuser
333+
334+
# MFractors (Xamarin productivity tool) working folder
335+
.mfractor/
336+
337+
# Local History for Visual Studio
338+
.localhistory/
339+
340+
# BeatPulse healthcheck temp database
341+
healthchecksdb
342+
343+
# Backup folder for Package Reference Convert tool in Visual Studio 2017
344+
MigrationBackup/

‎Utils/FCExporter/FCExporter.sln

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio 15
4+
VisualStudioVersion = 15.0.28307.438
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "FCExporter", "FCExporter\FCExporter.vcxproj", "{834EF9D7-9BF4-4501-A51D-0080DB835643}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{834EF9D7-9BF4-4501-A51D-0080DB835643}.Debug|x64.ActiveCfg = Debug|x64
17+
{834EF9D7-9BF4-4501-A51D-0080DB835643}.Debug|x64.Build.0 = Debug|x64
18+
{834EF9D7-9BF4-4501-A51D-0080DB835643}.Debug|x86.ActiveCfg = Debug|Win32
19+
{834EF9D7-9BF4-4501-A51D-0080DB835643}.Debug|x86.Build.0 = Debug|Win32
20+
{834EF9D7-9BF4-4501-A51D-0080DB835643}.Release|x64.ActiveCfg = Release|x64
21+
{834EF9D7-9BF4-4501-A51D-0080DB835643}.Release|x64.Build.0 = Release|x64
22+
{834EF9D7-9BF4-4501-A51D-0080DB835643}.Release|x86.ActiveCfg = Release|Win32
23+
{834EF9D7-9BF4-4501-A51D-0080DB835643}.Release|x86.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {D06E1DB7-1246-4F11-98DE-68E465E7A280}
30+
EndGlobalSection
31+
EndGlobal

‎Utils/FCExporter/FCExporter/FCExporter.vcxproj

+131
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>15.0</VCProjectVersion>
23+
<ProjectGuid>{834EF9D7-9BF4-4501-A51D-0080DB835643}</ProjectGuid>
24+
<RootNamespace>FCExporter</RootNamespace>
25+
<WindowsTargetPlatformVersion>10.0.17763.0</WindowsTargetPlatformVersion>
26+
</PropertyGroup>
27+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
28+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
29+
<ConfigurationType>Application</ConfigurationType>
30+
<UseDebugLibraries>true</UseDebugLibraries>
31+
<PlatformToolset>v141</PlatformToolset>
32+
<CharacterSet>MultiByte</CharacterSet>
33+
</PropertyGroup>
34+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
35+
<ConfigurationType>Application</ConfigurationType>
36+
<UseDebugLibraries>false</UseDebugLibraries>
37+
<PlatformToolset>v141</PlatformToolset>
38+
<WholeProgramOptimization>true</WholeProgramOptimization>
39+
<CharacterSet>MultiByte</CharacterSet>
40+
</PropertyGroup>
41+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
42+
<ConfigurationType>Application</ConfigurationType>
43+
<UseDebugLibraries>true</UseDebugLibraries>
44+
<PlatformToolset>v141</PlatformToolset>
45+
<CharacterSet>MultiByte</CharacterSet>
46+
</PropertyGroup>
47+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
48+
<ConfigurationType>Application</ConfigurationType>
49+
<UseDebugLibraries>false</UseDebugLibraries>
50+
<PlatformToolset>v141</PlatformToolset>
51+
<WholeProgramOptimization>true</WholeProgramOptimization>
52+
<CharacterSet>MultiByte</CharacterSet>
53+
</PropertyGroup>
54+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
55+
<ImportGroup Label="ExtensionSettings">
56+
</ImportGroup>
57+
<ImportGroup Label="Shared">
58+
</ImportGroup>
59+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
60+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
61+
</ImportGroup>
62+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
63+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
64+
</ImportGroup>
65+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
66+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
67+
</ImportGroup>
68+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
69+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
70+
</ImportGroup>
71+
<PropertyGroup Label="UserMacros" />
72+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
73+
<IncludePath>E:\Libraries\Boost-166;$(IncludePath)</IncludePath>
74+
<LibraryPath>E:\Libraries\Boost-166\build\x86\boost\bin.v2\libs\iostreams\build\msvc-14.0\debug\link-static\threadapi-win32\threading-multi;$(LibraryPath)</LibraryPath>
75+
</PropertyGroup>
76+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
77+
<ClCompile>
78+
<WarningLevel>Level3</WarningLevel>
79+
<Optimization>Disabled</Optimization>
80+
<SDLCheck>true</SDLCheck>
81+
<ConformanceMode>true</ConformanceMode>
82+
<PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;_SILENCE_FPOS_SEEKPOS_DEPRECATION_WARNING;BOOST_CONFIG_SUPPRESS_OUTDATED_MESSAGE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
83+
</ClCompile>
84+
</ItemDefinitionGroup>
85+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
86+
<ClCompile>
87+
<WarningLevel>Level3</WarningLevel>
88+
<Optimization>Disabled</Optimization>
89+
<SDLCheck>true</SDLCheck>
90+
<ConformanceMode>true</ConformanceMode>
91+
</ClCompile>
92+
</ItemDefinitionGroup>
93+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
94+
<ClCompile>
95+
<WarningLevel>Level3</WarningLevel>
96+
<Optimization>MaxSpeed</Optimization>
97+
<FunctionLevelLinking>true</FunctionLevelLinking>
98+
<IntrinsicFunctions>true</IntrinsicFunctions>
99+
<SDLCheck>true</SDLCheck>
100+
<ConformanceMode>true</ConformanceMode>
101+
</ClCompile>
102+
<Link>
103+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
104+
<OptimizeReferences>true</OptimizeReferences>
105+
</Link>
106+
</ItemDefinitionGroup>
107+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
108+
<ClCompile>
109+
<WarningLevel>Level3</WarningLevel>
110+
<Optimization>MaxSpeed</Optimization>
111+
<FunctionLevelLinking>true</FunctionLevelLinking>
112+
<IntrinsicFunctions>true</IntrinsicFunctions>
113+
<SDLCheck>true</SDLCheck>
114+
<ConformanceMode>true</ConformanceMode>
115+
</ClCompile>
116+
<Link>
117+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
118+
<OptimizeReferences>true</OptimizeReferences>
119+
</Link>
120+
</ItemDefinitionGroup>
121+
<ItemGroup>
122+
<ClInclude Include="consts.h" />
123+
</ItemGroup>
124+
<ItemGroup>
125+
<ClCompile Include="consts.cpp" />
126+
<ClCompile Include="Main.cpp" />
127+
</ItemGroup>
128+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
129+
<ImportGroup Label="ExtensionTargets">
130+
</ImportGroup>
131+
</Project>

‎Utils/FCExporter/FCExporter/FCExporter.vcxproj.filters

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup>
4+
<Filter Include="Source Files">
5+
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
6+
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
7+
</Filter>
8+
<Filter Include="Header Files">
9+
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
10+
<Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
11+
</Filter>
12+
<Filter Include="Resource Files">
13+
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
14+
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
15+
</Filter>
16+
</ItemGroup>
17+
<ItemGroup>
18+
<ClInclude Include="consts.h">
19+
<Filter>Header Files</Filter>
20+
</ClInclude>
21+
</ItemGroup>
22+
<ItemGroup>
23+
<ClCompile Include="consts.cpp">
24+
<Filter>Header Files</Filter>
25+
</ClCompile>
26+
<ClCompile Include="Main.cpp">
27+
<Filter>Source Files</Filter>
28+
</ClCompile>
29+
</ItemGroup>
30+
</Project>

‎Utils/FCExporter/FCExporter/Main.cpp

+157
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
#include "consts.h"
2+
#include <fstream>
3+
#include <algorithm>
4+
#include <iostream>
5+
#include <string>
6+
using namespace std;
7+
8+
#define TEST_BEFORE_ADD
9+
#define MAGIC 0xD3010401
10+
11+
class DbManager {
12+
private:
13+
#define WRITE(b, s) { this->_stream.write(reinterpret_cast<char*>(&b), s); }
14+
#define SWAP(x) { this->Swap(&x); }
15+
fstream _stream;
16+
bool _isOpen = false;
17+
uint16_t _writtenItems = 0;
18+
19+
// https://stackoverflow.com/users/95286/dingo
20+
template <typename T>
21+
inline void Swap(T* val) {
22+
unsigned char *memp = reinterpret_cast<unsigned char*>(val);
23+
std::reverse(memp, memp + sizeof(T));
24+
}
25+
26+
public:
27+
28+
bool isOpen() {
29+
return this->_isOpen;
30+
}
31+
32+
DbManager(std::string _fPath):
33+
_stream(_fPath, ios::out | ios::binary) {
34+
35+
if (_stream.is_open()) {
36+
this->_isOpen = true;
37+
38+
auto _magicBoi = MAGIC;
39+
40+
SWAP(_magicBoi);
41+
WRITE(_magicBoi, sizeof(int));
42+
43+
SWAP(this->_writtenItems);
44+
WRITE(this->_writtenItems, sizeof(uint16_t));
45+
}
46+
}
47+
48+
~DbManager() {
49+
if (this->isOpen()) {
50+
this->_stream.flush();
51+
52+
// Updates content counter.
53+
this->_stream.seekg(sizeof(int) + 0, ios::beg);
54+
SWAP(this->_writtenItems);
55+
WRITE(this->_writtenItems, sizeof(uint16_t));
56+
this->_stream.close();
57+
}
58+
}
59+
60+
bool AddEntry(unsigned char* _buff, size_t _size, std::string _name, uint8_t toCompress = 0) {
61+
if (_buff != nullptr && _size > 0) {
62+
//auto _b64d = base64_encode(_buff, _size);
63+
64+
std::string _b64d;
65+
_b64d.resize(_size);
66+
memcpy(&_b64d[0], _buff, _size);
67+
68+
#undef TEST_BEFORE_ADD
69+
#ifdef TEST_BEFORE_ADD
70+
auto _rebuffed = base64_decode(_b64d);
71+
if (memcmp(_buff, _rebuffed.c_str(), _size) != 0)
72+
return false;
73+
74+
_rebuffed.clear();
75+
#endif
76+
77+
auto _nameLength = _name.length();
78+
SWAP(_nameLength);
79+
WRITE(_nameLength, sizeof(int));
80+
WRITE(_name[0], _name.length());
81+
82+
WRITE(toCompress, sizeof(uint8_t));
83+
84+
if (toCompress) {
85+
/*
86+
auto _compressed = Gzip::compress(_b64d);
87+
_b64d.clear();
88+
89+
auto _buffLength = _compressed.length();
90+
this->_stream.write(reinterpret_cast<char*>(&_buffLength), sizeof(int));
91+
this->_stream.write(reinterpret_cast<char*>(&_compressed[0]), _compressed.length());
92+
_compressed.clear();
93+
*/
94+
goto BYPASS;
95+
} else {
96+
97+
BYPASS:
98+
auto _buffLength = _b64d.length();
99+
SWAP(_buffLength);
100+
WRITE(_buffLength, sizeof(int));
101+
WRITE(_b64d[0], _b64d.length());
102+
_b64d.clear();
103+
}
104+
this->_writtenItems++;
105+
106+
return true;
107+
}
108+
109+
return false;
110+
}
111+
112+
uint16_t itemCount() {
113+
return this->_writtenItems;
114+
}
115+
116+
void Flush() {
117+
this->_stream.flush();
118+
}
119+
#undef WRITE
120+
#undef SWAP
121+
};
122+
123+
int main(int argc, char* argv[]) {
124+
125+
DbManager* db = new DbManager("FConsts.d3v");
126+
if (db->isOpen()) {
127+
cout << "[+] ARCHIVE CREATED - MAGIC (0xD3010401)" << std::endl;
128+
////////////////////////////
129+
// SPARSE SERIALIZE //
130+
////////////////////////////
131+
cout << " |---- SPARSE CONSTANTS\n |" << std::endl;
132+
for (auto i = 0; i < 5; i++)
133+
if (!db->AddEntry((unsigned char*)sparse_consts[i].array, sparse_consts[i].size, sparse_consts[i].name))
134+
cout << " |--[" << i << "] \"" << sparse_consts[i].name << "\" failed to add due to corrupted cast." << std::endl;
135+
else
136+
cout << " |--[" << i << "] Added \"" << sparse_consts[i].name << "\" (" << sparse_consts[i].size << ")" << std::endl;
137+
138+
139+
////////////////////////////
140+
// NON SPARSE SERIALIZE //
141+
////////////////////////////
142+
cout << " |---- NON-SPARSE CONSTANTS\n |" << std::endl;
143+
for (auto i = 0; i < 74; i++) {
144+
if (!db->AddEntry((unsigned char*)non_sparse_consts[i].array, non_sparse_consts[i].size, non_sparse_consts[i].name))
145+
cout << " |--[" << i << "] \"" << non_sparse_consts[i].name << "\" failed to add due to corrupted cast." << std::endl;
146+
else
147+
cout << " |--[" << i << "] Added \"" << non_sparse_consts[i].name << "\" (" << non_sparse_consts[i].size << ")" << std::endl;
148+
}
149+
cout << "[-] DONE [" << db->itemCount() << "] ITEMS ADDED.\n";
150+
151+
db->~DbManager();
152+
db = nullptr;
153+
}
154+
155+
getchar();
156+
return 0;
157+
}

‎Utils/FCExporter/FCExporter/consts.cpp

+8,570
Large diffs are not rendered by default.

‎Utils/FCExporter/FCExporter/consts.h

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#pragma once
2+
#define IS_LITTLE_ENDIAN
3+
4+
#if defined(__GNUC__) || defined(__MWERKS__)
5+
#define WORD64_AVAILABLE
6+
typedef unsigned long long word64;
7+
typedef unsigned long word32;
8+
typedef unsigned char byte;
9+
#define W64LIT(x) x##LL
10+
#elif defined(_MSC_VER) || defined(__BCPLUSPLUS__)
11+
#define WORD64_AVAILABLE
12+
typedef unsigned __int64 word64;
13+
typedef unsigned __int32 word32;
14+
typedef unsigned __int8 byte;
15+
#define W64LIT(x) x##ui64
16+
#endif
17+
18+
struct array_info_t
19+
{
20+
const void *array;
21+
size_t size;
22+
const char *name;
23+
const char *algorithm;
24+
};
25+
26+
extern const array_info_t non_sparse_consts[];
27+
extern const array_info_t sparse_consts[];
28+
29+
#define ARR(x) x, sizeof(x), #x
30+

‎findcrypt_ghidra/README.txt

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
Do not delete the "database.d3v" file or you'll lose all of the known algorithms signatures.
2+
If you lost it, go back to my GitHub project and download the database again, putting it here.
3+
4+
- d3vil401 (https://d3vsite.org)

‎findcrypt_ghidra/database.d3v

98.4 KB
Binary file not shown.

0 commit comments

Comments
 (0)
Please sign in to comment.