polymorf / findcrypt-yara

IDA pro plugin to find crypto constants (and more)
BSD 3-Clause "New" or "Revised" License
1.36k stars 243 forks source link

Add rule to detect Sosemanuk constants #26

Closed recvfrom closed 4 years ago

recvfrom commented 4 years ago

Reference: https://labs.sentinelone.com/enter-the-maze-demystifying-an-affiliate-involved-in-maze-snow/

polymorf commented 4 years ago

Can you do a PR with new findcrypt3.rules rules ?

recvfrom commented 4 years ago

@polymorf yeah I can as soon as I get a chance