一个IDA脚本，可以检测出哈希算法（无论是否魔改常数）并生成frida hook 代码。

Related tags

Miscellaneous findhash
Overview

findhash

在哈希算法上，比Findcrypt更好的检测工具，同时生成Frida hook代码。 image

使用方法

  • 把findhash.xml和findhash.py扔到ida plugins目录下
  • ida -edit-plugin-findhash

试图解决的问题

  • 哈希函数的初始化魔数被修改
  • 想快速验证所分析的函数中是否使用了MD5，SHA1、SHA2这些哈希算法。
  • Findcrypt/Signsrch没找出来

可以应对如下各种findcrypt找不到或者哈希函数被魔改的情况 image

image

image

image

原理

通过正则表达式匹配伪C代码中的初始化魔数代码以及哈希运算函数，很粗鲁暴力，所以运行时间会比较长，因为要反编译所有函数，但对哈希算法的检测上效果非常nice。

TODO

  • 适配arm64
  • 增加对特征常量立即数的搜索
  • 增加对一个函数汇编中的位运算比例的计算，以及循环的识别。根据相关理论，高占比的位运算指令以及循环，是加解密算法难以抹去的结构特征。
You might also like...
Binance leverage futures Hook

Simple binance futures Attention Just use leverage. The fee difference between futures and spot is not considered. For example, funding rate, etc. Onl

Adriance 26 Aug 27, 2022
A Python r2pipe script to automatically create a Frida hook to intercept TLS traffic for Flutter based apps
A Python r2pipe script to automatically create a Frida hook to intercept TLS traffic for Flutter based apps

boring-flutter A Python r2pipe script to automatically create a Frida hook to intercept TLS traffic for Flutter based apps. Currently only supporting

Hamza 64 Oct 18, 2022
Redis-backed message queue implementation that can hook into a discord bot written with hikari-lightbulb.

Redis-backed FIFO message queue implementation that can hook into a discord bot written with hikari-lightbulb. This is eventually intended to be the backend communication between a bot and a web dashboard.

thomm.o 7 Dec 5, 2022
FridaHookAppTool - Frida Hook App Tool With Python
FridaHookAppTool - Frida Hook App Tool With Python

FridaHookAppTool（以下是Hook mpaas框架的例子） mpaas移动开发框架ios端抓包hook脚本 使用方法：链接数据线，开启burp设置

null 13 Nov 30, 2022
Comments
  • IDA7.0报错

    IDA7.0报错

    请问下这个使用对于IDA有什么版本要求吗？ C:\self-program\IDA_Pro_v7.0_Portable\plugins\findhash.py: invalid syntax (C:/self-program/IDA_Pro_v7.0_Portable/plugins/findhash.py, line 109) Traceback (most recent call last): File "C:\self-program\IDA_Pro_v7.0_Portable\python\ida_idaapi.py", line 553, in IDAPython_ExecScript execfile(script, g) File "C:/self-program/IDA_Pro_v7.0_Portable/plugins/findhash.py", line 109 value["describe"] = f"函数{value['funcName']}疑似哈希函数主体，包含初始化常数以及运算部分。" ^ SyntaxError: invalid syntax

    opened by fwb7014 0
Owner
白龙O(∩_∩)O
null
GitHub
Hook and simulate global keyboard events on Windows and Linux.

keyboard Take full control of your keyboard with this small Python library. Hook global events, register hotkeys, simulate key presses and much more.

BoppreH 3.2k Jan 1, 2023
The purpose of this script is to bypass disablefund, provide some useful information, and dig the hook function of PHP extension.

The purpose of this script is to bypass disablefund, provide some useful information, and dig the hook function of PHP extension.

Firebasky 14 Aug 2, 2021
Hook and simulate global keyboard events on Windows and Linux.

keyboard Take full control of your keyboard with this small Python library. Hook global events, register hotkeys, simulate key presses and much more.

BoppreH 3.2k Dec 30, 2022
Hook and simulate global mouse events in pure Python

mouse Take full control of your mouse with this small Python library. Hook global events, register hotkeys, simulate mouse movement and clicks, and mu

BoppreH 722 Dec 31, 2022
A tool (and pre-commit hook) to automatically upgrade syntax for newer versions of the language.

pyupgrade A tool (and pre-commit hook) to automatically upgrade syntax for newer versions of the language. Installation pip install pyupgrade As a pre

Anthony Sottile 2.4k Jan 8, 2023
A tool (and pre-commit hook) to automatically add trailing commas to calls and literals.

add-trailing-comma A tool (and pre-commit hook) to automatically add trailing commas to calls and literals. Installation pip install add-trailing-comm

Anthony Sottile 264 Dec 20, 2022
Pre-commit hook for upgrading type hints

This is a pre-commit hook configured to automatically upgrade your type hints to the new native types implemented in PEP 585.

snok 54 Nov 14, 2022
Hook and simulate global keyboard events on Windows and Linux.

keyboard Take full control of your keyboard with this small Python library. Hook global events, register hotkeys, simulate key presses and much more.

BoppreH 3.2k Jan 1, 2023
The purpose of this script is to bypass disablefund, provide some useful information, and dig the hook function of PHP extension.

The purpose of this script is to bypass disablefund, provide some useful information, and dig the hook function of PHP extension.

Firebasky 14 Aug 2, 2021
Hook Slinger acts as a simple service that lets you send, retry, and manage event-triggered POST requests, aka webhooks

Hook Slinger acts as a simple service that lets you send, retry, and manage event-triggered POST requests, aka webhooks. It provides a fully self-contained docker image that is easy to orchestrate, manage, and scale.

Redowan Delowar 96 Jan 2, 2023