IDA7.5安装findcrypt3插件

随便打开了一个可执行文件，翻了翻最下面的Output windows，直接支持python3，欣喜若狂

1.下载脚本插件
https://github.com/polymorf/findcrypt-yara
2.将findcrypt3.py和findcrypt3.rules放到IDA7.5/plugins

3.python3安装yara-python
pip3 install yara-python
插件安装完毕
再次打开Edit>Plugins>Findcrypt，插件可以使用

P.S.
为findcrypt3添加国密SM4算法的识别规则
打开findcrypt3.rules，在最后添加

rule SM4_FK {
	meta:
		author = "Basstorm"
		description = "Look for SM4_FKbox constants"
		date = "2020-08"
	strings:
		$c0 = { C6 BA B1 A3 50 33 AA 56 97 91 7D 67 DC 22 70 B2 }
	condition:
		$c0
}

rule SM4_CK {
	meta:
		author = "Basstorm"
		description = "Look for SM4_CKbox constants"
		date = "2020-08"
	strings:
		$c0 = { 15 0E 07 00 31 2A 23 1C 4D 46 3F 38 69 62 5B 54 85 7E 77 70 A1 9A 93 8C }
	condition:
		$c0
}

保存退出
以2020纵横杯friendlyRE为例，Ctrl+Alt+F直接可以识别出sm4