torgotorgo / ghidra-findcrypt Goto Github PK

Surely Github actions can push assets to the release page, this should be done to save me downloading and re-uploading from the CI.

Some ideas...

• YARA? Probably too complex
• libmagic db format?
• yaml with hex strings?

We can continue to pack into d3v's format, but we should unpack the db into a human modifiable format.

Hi there, thanks for your work on this project. Do you plan to update it for 10.0.0.3? The latest version of this extension does not seem compatible with the recent Ghidra update. Thank you.

Hello and good day, I am in the process of forking this repo and came along database.d3v. By any chance could you provide further information with regards to this file format? and possibly how else I can read this and know how it works in greater detail. For I cant quite find out much about it other than some vague video formats which I highly doubt this is the case for a typical database.

Just wanted to give you a heads up that there is a change coming in Ghidra 10.2 that will break this extension. It is an easy fix and will only require a 2 line change. The DataTypeConflictException class has been removed.

#3 refers to an unknown value in the database format. We should figure out what this is and then update the import script.

When try install iextension it fails:

Installation Error: Extension version for [ghidra_10.0-BETA_PUBLIC_20210628_FindCrypt.zip] is incompatible with Ghidra.

Hi, I encounter the error below when I try to install this plugin for Ghidra 10.0.4 as README suggests

Selected file: [ghidra_10.0.4_FindCrypt.zip] is not a valid Ghidra Extension
---------------------------------------------------
Build Date: 2021-Sep-28 1538 EDT
Ghidra Version: 10.0.4
Java Home: C:\Program Files\Eclipse Adoptium\jdk-11.0.13.8-hotspot
JVM Version: Eclipse Adoptium 11.0.13
OS: Windows 10 10.0 amd64

P.S. my OS version is

OS 名称:          Microsoft Windows 11 家庭中文版 Insider Preview
OS 版本:          10.0.22504 暂缺 Build 22504

any suggestion for this? thanks in advance.

Hi @TorgoTorgo,

Thanks for this project.

Can you please create a pre-built version for the latest Ghidra version, 10.1.1 (https://github.com/NationalSecurityAgency/ghidra/releases)?

Thank you.

Likely just a little issue during packaging, the https://github.com/TorgoTorgo/ghidra-findcrypt/releases/tag/v2.1.4 release has the Ghidra 10.1.3 and 10.1.4 ZIP, but both have extensions built for 10.1.4 Ghidra in them.

The source is available is linked on The ICE Home Page.