Package IDAscope :: Package idascope :: Package core :: Module CryptoIdentifier :: Class CryptoIdentifier
[hide private]
[frames] | no frames]

Class CryptoIdentifier

source code


This class contains the logic to perform Crypto identification.
Two techniques are currently supported:
1. A heuristic approach that identifies functions and basic blocks
based on the ratio of arithmetic/logic instructions to all instructions
2. A signature-based approach, using the signatures defined in PatternManager

Instance Methods [hide private]
 
__init__(self) source code
 
scan(self)
Scan the whole IDB with all available techniques.
source code
 
scan_aritlog(self)
scan with the arithmetic/logic heuristic
source code
 
update_thresholds(self, min_rating, max_rating, min_instr, max_instr, min_call, max_call)
update all six threshold bounds
source code
 
get_aritlog_blocks(self, min_rating, max_rating, min_instr, max_instr, min_api, max_api, is_nonzero)
get all blocks that are within the limits specified by the heuristic parameters.
source code
 
get_unfiltered_block_count(self)
returns the number of basic blocks that have been analyzed.
source code
 
get_segment_data(self)
returns the raw bytes of the segments as stored by IDA
source code
 
scan_crypto_patterns(self, pattern_size=32)
perform a scan ofr signatures.
source code
 
get_signature_length(self, signature_name)
returns the length for a signature, identified by its name
source code
 
get_xrefs_to_address(self, address)
get all references to a certain address.
source code
 
get_signature_hits(self)
Get all signature hits that have a length of at least match_filter_factor percent of the signature they triggered.
source code
Method Details [hide private]

scan_aritlog(self)

source code 

scan with the arithmetic/logic heuristic

Returns:
a list of AritLogBasicBlock data objects that fulfill the parameters as specified

update_thresholds(self, min_rating, max_rating, min_instr, max_instr, min_call, max_call)

source code 

update all six threshold bounds

Parameters:
  • min_rating (float) - the minimum arit/log ratio a basic block must have
  • max_rating (float) - the maximum arit/log ratio a basic block can have
  • min_instr (int) - the minimum number of instructions a basic block must have
  • max_instr (int) - the minimum number of instructions a basic block can have
  • min_call (int) - the minimum number of calls a basic block must have
  • max_call (int) - the minimum number of calls a basic block can have

get_aritlog_blocks(self, min_rating, max_rating, min_instr, max_instr, min_api, max_api, is_nonzero)

source code 

get all blocks that are within the limits specified by the heuristic parameters. parameters are the same as in function "update_thresholds" except param is_nonzero: defines whether zeroing instructions (like xor eax, eax) shall be counted or not. type is_nonzero: boolean

Returns:
a list of AritlogBasicBlock data objects, according to the parameters

get_unfiltered_block_count(self)

source code 

returns the number of basic blocks that have been analyzed.

Returns:
(int) number of basic blocks

get_segment_data(self)

source code 

returns the raw bytes of the segments as stored by IDA

Returns:
a list of Segment data objects.

scan_crypto_patterns(self, pattern_size=32)

source code 

perform a scan ofr signatures. For matching, the standard python re module is used.

Returns:
A list of CryptoSignatureHit data objects

get_signature_length(self, signature_name)

source code 

returns the length for a signature, identified by its name

Parameters:
  • signature_name (str) - name for a signature, e.g. "ADLER 32"
Returns:
(int) length of the signature.

get_xrefs_to_address(self, address)

source code 

get all references to a certain address. These are no xrefs in IDA sense but references to the crypto signatures. If the signature points to an instruction, e.g. if a constant is moved to a register, the return is flagged as "True", meaning it is an in-code reference.

Parameters:
  • address (int) - an arbitrary address
Returns:
a list of tuples (int, boolean)

get_signature_hits(self)

source code 

Get all signature hits that have a length of at least match_filter_factor percent of the signature they triggered. Hits are grouped by signature names.

Returns:
a dictionary with key/value entries of the following form: ("signature name", [CryptoSignatureHit])