Kanal

The name Kanal stands for Krypto Analyzer for PEiD. This plugin searches for known crypto algorithms inside of the specified module.

PEiD detects most common packers, cryptors and compilers for PE files. It can currently detect more than 600 different signatures in PE files. PEiD is special in some aspects when compared to other identifiers already out there!

It has an easy to use GUI and detection rates are amongst the best given by any other identifier. Special scanning modes for *advanced* detections of modified and unknown files are available.

- The detection is limited to crypto that's possible to identify by a specific signature (such as fixed s-boxes, permutation tables, initialization values, etc). Simple mathematical algorithms, such as RSA, cannot be detected. - A few of the algorithms are detected by a single DWORD - so, they are susceptible to false alarms. - Some crypto algorithm share a common initialization code - so if multiple crypto algorithms are present in the file, they may be "mixed up" a little. The plugin tries to filter the results somehow (to guess which algorithm it is from the "shared" code), but it may not be 100% of course.