Cryptography reversing of software has playing an important role in malware detecting and vulnerability mining recently. This paper has proposed a four-level cryptography reversing model which contains crypto algorithms recognition, crypto mechanism reversing, wrong/weak implement, vulnerability mining. Both dynamic and static analysis technology takes its shortage, for solving this problem, we have brought forward a hybrid method based on the assumption that static disassemble result is correct, and have studied the density of arithmetic and bit wise operation, crypto dynamic constants and entropy value of memory operation data to filter the cryptography primitives.