We present an automatic static tool CryFind to identify cryptographic algorithms in a binary executable. Our main strategy is using string match to search for cryptographic constants and API names. To expand our search range and improve our hit rate, our tool matches strings under different encodings and XOR'ed with different keys, as well as incorporates techniques to extract strings on stack. As a result, we have a more effective and efficient detection tool compared with a wide range of state-of-the-art static analysis tools.

1. Cryfind : A Static Tool to Identify
Cryptographic Algorithm in Binary
Wei Chieh Chao

2. Goal
• Automatically identify crypto algorithms in binary
• Using static, signature-based analysis
Malwares Cryfind Crypto
Algorithm
Security
Researcher

3. Main Strategy
SHA-1 Init Array
h0 := 0x67452301
h1 := 0xEFCDAB89
h2 := 0x98BADCFE
h3 := 0x10325476
advapi32.dll
A_SHAInit
A_SHAFinal
CryptCreateHash
Cryptographic Constants Cryptographic API Names
Search for

4. Related Works
Name File Format constant crypto api
x3chun-Crypto-Searcher PE32 Executable ✔ ✔
HCD PE32 Executable ✔ ✔
draca PE32 Executable ✔
Krypto Analyzer PEiD Plugin ✔ ✔
findcrypt2 IDA Plugin ✔
bfcrypt C Source Code ✔
crypto-detector Python Source Code ✔ ✔
Collect constants
from these tools

5. Testing
MD5
Can’t find
crypto constants

6. The source code
#define ROTLEFT(a,b) ((a << b) | (a >> (32-b)))
#define F(x,y,z) ((x & y) | (~x & z))
#define FF(a,b,c,d,m,s,t) { a += F(b,c,d) + m + t;
a = b + ROTLEFT(a,s); }
FF(a,b,c,d,m[0], 7,0xd76aa478);
FF(d,a,b,c,m[1], 12,0xe8c7b756);
FF(c,d,a,b,m[2], 17,0x242070db);
...

7. #define ROTLEFT(a,b) ((a << b) | (a >> (32-b)))
#define F(x,y,z) ((x & y) | (~x & z))
#define FF(a,b,c,d,m,s,t) { a += F(b,c,d) + m + t;
a = b + ROTLEFT(a,s); }
FF(a,b,c,d,m[0], 7,0xd76aa478);
FF(d,a,b,c,m[1], 12,0xe8c7b756);
FF(c,d,a,b,m[2], 17,0x242070db);
...
Constants are here.
The source code

8. sub eax, 28955B88h
...
sub eax, 173848AAh
...
add eax, 242070DBh
subtract
negative value
The source code

9. Encoding
Encoding Value
Big Endian 0xfaceb00c
Little Endian 0x0cb0cefa
Big Endian → Negative → Big Endian 0x05314ff4
Little Endian → Negative → Big Endian 0xf34f3106
Big Endian → Negative → Little Endian 0xf44f3105
Little Endian → Negative → Little Endian 0x06314ff3

10. Size
Size Bytes Value
FULLWORD ALL
'x01#Egx89xabxcdxefxfexdc
xbax98vT2x10'
DWORD 4
'x01#Eg', 'x89xabxcdxef',
'xfexdcxbax98', 'vT2x10'
QWORD 8
'x01#Egx89xabxcdxef',
'xfexdcxbax98vT2x10'

11. FULLWORD
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Base64 Table ( FULLWORD )
...............................................................
...............................................................
............ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxy
z0123456789+/..................................................
...............................................................
...................................................

12. DWORD
'x01#Eg', 'x89xabxcdxef', 'xfexdcxbax98', ...
SHA1 Init Array ( DWORD )
...............................................................
.....x01#Eg...............................................
..............................xfexdcxbax98...............
.............................................................
...........x89xabxcdxef..................................
.............................................................

13. False Positive Cases

14. False Positive Cases
11111111 happened to appear many times

15. Grouping the constants
There should be only one group of constant.

16. Grouping the constants
address 0x21 0x30 0x35 0x42 0x58 0x63 0x7f 0xa0
index 0 0 1 2 3 2 1 3
Q : Find a smallest interval that includes all constants
A : binary search interval size
index value
0 0x11111111
1 0x22222222
2 0x33333333
3 0x44444444

17. Search
1. Using python in operator
• O(nk + m) time
2. Using AC ( Aho-Corasick ) Algorithm
• O(n + m) time
• https://github.com/abusix/ahocorapy
3. Using yara rules

18. Search
Second
0
8.571
17.143
25.714
34.286
42.857
51.429
60
3.3 MB 13.4 MB 26.8 MB 53.6 MB
'in' operator Aho-Corasick yara rules

19. Search with yara
$c_0_fullword_big
rule cry_134 {
meta:
id = 133
name = "TEAN [32 rounds]"
length = 8
strings:
$c_0_fullword_big = { 2037efc6b979379e }
$c_0_fullword_little = { 9e3779b9c6ef3720 }
$c_0_dword_big = { 2037efc6 }
...
$c_0_qword_little = { 9e3779b9c6ef3720 }
$c_0_qword_bnb = { dfc810394686c862 }
...
condition:
(any of ($c_0_fullword_*)) or (any of ($c_0_dword_*)) and (any of
($c_1_dword_*)) or (any of ($c_0_qword_*))
}
Index
Size
Encoding

20. Bypass XOR Encryption
• Bypass xor encryption with key length 1 ( can be extended to longer key length )
• Brute force for 256 possibilities are too slow
• Try to search in xor difference array
3 5
6
⊕
7
⊕
2
3 ⊕ 2 5 ⊕ 2
6
⊕
7 ⊕ 2
⊕
2
4
⊕
1
Signature Binary

21. StackStrings
• Using radare2 reverse engineering framework to do emulation
• Pull out all functions
• Building a spanning tree on the function CFG to avoid cycle
• Emulate each path and dump the stack
• Search cryptographic constant in the stack

22. Conclusion
Cryptographic
Constants
Yara
Engines
Encoding XOR
EmulationBinary

23. Demo
Address
Constant
Encoding

24. Speed ( 3 MB sample )
0s
1s
2s
3s
4s
Cryfind Krypto Analyzer x3chun's
Crypto Searcher
HCD
3.61s
2.09s
2.4s
0.89s

25. Signatures
0
45
90
135
180
Cryfind Krypto Analyzer x3chun's
Crypto Searcher
HCD
90
97
116
171

26. Thanks for listening.