SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
identifying-cryptographic-routines-in-binaries
0
Identifies cryptographic algorithms embedded in a binary by scanning for well-known constants and tables (AES S-box, SHA-256/MD5 init constants, ChaCha sigma, CRC32 table, base64 alphabet). Activates for requests to identify crypto in a binary, find AES/SHA constants, or detect which encryption algorithm a sample uses.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Identifying Cryptographic Routines in Binaries ## When to Use - You need to determine which cryptographic algorithms a sample implements (ransomware crypto, C2 encryption, config protection) by locating constant tables. - You want fast triage before manually reversing the crypto routine. **Do not use** constant detection as proof of a specific mode/usage — it identifies the primitive, not how it is applied. This skill reads the binary statically and executes nothing. ## Prerequisites - The binary (read inertly). ## Safety & Handling - Read bytes statically; treat the sample as malicious data. ## Workflow ### Step 1: Scan for crypto constants ```bash python scripts/analyst.py scan sample.bin ``` Searches for AES S-box/Te tables, SHA-256 H/K init constants, MD5 init, ChaCha/Salsa `expand 32-byte k` sigma, the CRC32 polynomial table, and the base64 alphabet, reporting offsets. ### Step 2: Corroborate with imports/strings Pair constant hits with crypto API imports (`CryptDecrypt`, `BCryptEncrypt`, `EVP_*`) or library strings to confirm. ### Step 3: Locate the routine Use the constant offset to find the referencing function for deeper reversing/key extraction. ### Step 4: Document Record which primitives are present and where, mapping to behavior (e.g., AES → file encryption). ## Validation - Each hit references a real, named constant table (not a coincidental byte run). - Detected primitives are corroborated by imports/strings where possible. - Offsets point into the binary and can be navigated in a disassembler. ## Pitfalls - Statically linked crypto libraries adding constants unused by the malware's logic. - Custom/modified S-boxes evading exact-match detection. - Assuming AES presence implies ransomware — corroborate with behavior. ## References - See [`references/api-reference.md`](references/api-reference.md) for the scanner. - FIPS 197 and FIPS 180-4 constant references (linked in frontmatter).