# polymorf/findcrypt-yara

IDA pro plugin to find crypto constants (and more)

Repository: https://github.com/polymorf/findcrypt-yara
Canonical: https://ross.abutalabs.com/products/findcrypt-yara
Language: Python
License: BSD-3-Clause
License Family: permissive
Last push: 2024-11-19T11:36:18+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3453, "days_push": 652, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1735, forks 268 (observed 2026-08-28T04:05:29.133186+00:00)

## What it is
An IDA Pro plugin that uses YARA rules to scan binaries for known cryptographic constants and other recognizable byte patterns. It helps reverse engineers quickly identify crypto algorithms and other embedded signatures in disassembled code.

## Use cases
- find crypto constants in a binary with IDA Pro
- identify AES or SHA tables while reverse engineering malware
- scan a disassembled binary for known byte patterns with YARA rules
- add custom YARA rules to flag patterns in IDA
- locate encryption algorithm usage in firmware

## When to avoid
- you use a disassembler other than IDA Pro
- you need standalone binary analysis without IDA Pro

## Facets
- artifact type: plugin
- maturity: active
- function: reverse-engineering, search-engine, security
- domain: security, reverse-engineering, developer-tools
- platform: windows, python
- tags: ida-pro, yara, crypto-constants, binary-analysis, disassembler-plugin, linux, macos

## Member repositories
- polymorf/findcrypt-yara (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:29.133186+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:30:50.185455+00:00, confidence not recorded.
  - readme: https://github.com/polymorf/findcrypt-yara (fetched 2026-08-28T04:05:29.133186+00:00, sha 36a64855584a)
- Data as of 2026-08-30T08:39:29.467469+00:00.