Can it automatically identify standard algorithms?

Yes, it uses pattern recognition for S-boxes, magic constants, and round structures to identify algorithms like AES, DES, Blowfish, MD5, and various SHA families.

Is this useful for real-world malware analysis?

While optimized for CTFs, the methodologies for key extraction, string analysis, and algorithm identification are highly applicable to analyzing encryption used in malware.

Do I need Ghidra to use the CTF Crypto skill?

Yes, this skill is part of the ReVa (Reverse Engineering Assistant) repository and operates as an MCP server that interacts directly with the Ghidra decompiler.

Does this skill solve mathematical crypto challenges?

No, this skill is specifically designed for 'crypto-in-binaries' where the challenge lies in implementation weaknesses, hardcoded material, or reverse engineering the logic, rather than pure mathematical cryptanalysis.

How does it handle custom ciphers?

It uses a systematic approach of renaming variables, documenting transformations, and tracing data dependencies to help the user understand and replicate the custom logic in a scripting language like Python.

CTF Crypto Analysis

Name: CTF Crypto Analysis
Author: cyberkaida

bycyberkaida

•

479

Seguridad y Pruebas

Analyzes and exploits cryptographic implementations in compiled binaries to recover flags and keys during CTF challenges.

Acerca de

The CTF Crypto Analysis skill provides a specialized framework for investigating cryptographic logic within compiled binaries, specifically tailored for Capture The Flag (CTF) environments. It enables Claude to identify standard algorithms like AES or RSA through constant patterns, detect custom cipher implementations, and locate hardcoded keys or weak random number generation seeds. By integrating with Ghidra via the ReVa MCP server, it facilitates systematic variable renaming, data flow analysis, and decryption routine replication, helping users move from initial discovery to successful flag extraction.

Características Principales

Analysis of custom or obfuscated cryptographic implementation logic
Automatic identification of standard crypto primitives and magic constants
Detection of common implementation flaws like ECB mode or predictable RNG
479 GitHub stars
Structured data flow tracing from plaintext to ciphertext
Extraction of hardcoded keys and initialization vectors (IVs) from binary data

Casos de Uso

Reverse engineering a custom XOR-based encryption scheme to write a decryption script
Exploiting weak key derivation functions seeded with predictable system timestamps
Identifying and extracting a hardcoded AES key from a CTF challenge binary

Acerca de

Características Principales

Analysis of custom or obfuscated cryptographic implementation logic
Automatic identification of standard crypto primitives and magic constants
Detection of common implementation flaws like ECB mode or predictable RNG
479 GitHub stars
Structured data flow tracing from plaintext to ciphertext
Extraction of hardcoded keys and initialization vectors (IVs) from binary data

Casos de Uso

Reverse engineering a custom XOR-based encryption scheme to write a decryption script
Exploiting weak key derivation functions seeded with predictable system timestamps
Identifying and extracting a hardcoded AES key from a CTF challenge binary