reverse-skills-max/vendor-new/analyst-ai-pack/skills/identifying-cryptographic-routines-in-binaries/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
identifying-cryptographic-routines-in-binaries	Identifies cryptographic algorithms embedded in a binary by scanning for well-known constants and tables (AES S-box, SHA-256/MD5 init constants, ChaCha sigma, CRC32 table, base64 alphabet). Activates for requests to identify crypto in a binary, find AES/SHA constants, or detect which encryption algorithm a sample uses.	cybersecurity	reverse-engineering	reverse-engineering cryptography constants aes detection	1.0.0	analyst-ai-pack	Apache-2.0	T1027 T1486 T1573	D3-SDA D3-DA	FIPS 197 (AES) S-box — https://csrc.nist.gov/publications/detail/fips/197/final FIPS 180-4 (SHA-2) constants — https://csrc.nist.gov/publications/detail/fips/180/4/final

Identifying Cryptographic Routines in Binaries

When to Use

• You need to determine which cryptographic algorithms a sample implements (ransomware crypto, C2 encryption, config protection) by locating constant tables.
• You want fast triage before manually reversing the crypto routine.

Do not use constant detection as proof of a specific mode/usage — it identifies the primitive, not how it is applied. This skill reads the binary statically and executes nothing.

Prerequisites

• The binary (read inertly).

Safety & Handling

• Read bytes statically; treat the sample as malicious data.

Workflow

Step 1: Scan for crypto constants

python scripts/analyst.py scan sample.bin

Searches for AES S-box/Te tables, SHA-256 H/K init constants, MD5 init, ChaCha/Salsa expand 32-byte k sigma, the CRC32 polynomial table, and the base64 alphabet, reporting offsets.

Step 2: Corroborate with imports/strings

Pair constant hits with crypto API imports (CryptDecrypt, BCryptEncrypt, EVP_*) or library strings to confirm.

Step 3: Locate the routine

Use the constant offset to find the referencing function for deeper reversing/key extraction.

Step 4: Document

Record which primitives are present and where, mapping to behavior (e.g., AES → file encryption).

Validation

• Each hit references a real, named constant table (not a coincidental byte run).
• Detected primitives are corroborated by imports/strings where possible.
• Offsets point into the binary and can be navigated in a disassembler.

Pitfalls

• Statically linked crypto libraries adding constants unused by the malware's logic.
• Custom/modified S-boxes evading exact-match detection.
• Assuming AES presence implies ransomware — corroborate with behavior.

References

• See references/api-reference.md for the scanner.
• FIPS 197 and FIPS 180-4 constant references (linked in frontmatter).