diff --git a/README.md b/README.md index db52465..fe7e171 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,10 @@ -# findcrypt-yara +# [findcrypt3](https://github.com/polymorf/findcrypt-yara/tree/master). +## Updated fork, findcrypt3 for [yara-python](https://yara.readthedocs.io/en/latest/yarapython.html#yara.StringMatchInstance) > 4.2.3 + IDA pro plugin to find crypto constants (and more) +### Before using findcrypt3, do not forget to throw findcrypt3.rules into the local folder with IDA plugins (IDA\plugins). + ![bot](https://github.com/polymorf/findcrypt-yara/raw/master/screen.png) ## Installation Notes diff --git a/findcrypt3.py b/findcrypt3.py index fbae388..d35e637 100644 --- a/findcrypt3.py +++ b/findcrypt3.py @@ -185,26 +185,28 @@ def yarasearch(self, memory, offsets, rules): print(">>> start yara search") values = list() matches = rules.match(data=memory) - for match in matches: - for string in match.strings: - name = match.rule - if name.endswith("_API"): - try: - name = name + "_" + idc.GetString(self.toVirtualAddress(string[0], offsets)) - except: - pass - value = [ - self.toVirtualAddress(string[0], offsets), - match.namespace, - name + "_" + hex(self.toVirtualAddress(string[0], offsets)).lstrip("0x").rstrip("L").upper(), - string[1], - repr(string[2]), - ] - idaapi.set_name(value[0], name - + "_" - + hex(self.toVirtualAddress(string[0], offsets)).lstrip("0x").rstrip("L").upper() - , 0) - values.append(value) + for matchobj in matches: + for strn_matchobj in matchobj.strings: + name = matchobj.rule + for strn_matchobj_inst in strn_matchobj.instances: + if name.endswith("_API"): + try: + name = name + "_" + idc.GetString(self.toVirtualAddress(strn_matchobj_inst.offset, offsets)) + except: + pass + value = [ + self.toVirtualAddress(strn_matchobj_inst.offset, offsets), + matchobj.namespace, + name + "_" + hex(self.toVirtualAddress(strn_matchobj_inst.offset, offsets)).lstrip("0x").rstrip("L").upper(), + strn_matchobj.identifier, + repr(strn_matchobj_inst.matched_data) + ] + + idaapi.set_name(value[0], name + + "_" + + hex(self.toVirtualAddress(strn_matchobj_inst.offset, offsets)).lstrip("0x").rstrip("L").upper() + , 0) + values.append(value) print("<<< end yara search") return values