Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

I've heard of tools that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have certain entropy patterns that could suggest compressed or encrypted data?

share|improve this question
    
What definition of entropy are you interested in, e.g. binary Shannon entropy? –  JamalS Jul 23 at 12:20

2 Answers 2

You could use the #entropy command radare2. binwalk can calculate entropy, too.

Radare2

From the manual page of Radare2:

 #[hash]     Calculates the sha1, sha256, sha384, sha512, par, xor,
             xorpair, hamdist, mod255, crc16, crc32, md4, md5, entropy of
             the current block from the selected seek

So, using this command is as follow:

$ radare2 /bin/ls
[0x00404890]> #entropy
5.338618

Binwalk

If you get binwalk from the original Github project, you will also grad a few Python modules, one of these is computing the entropy of the analyzed file.

Get these modules and run it on your file.

share|improve this answer
    
Those are both good suggestions, but I'd add that there is great insight to be gained in writing your own tools. –  Edward Jul 23 at 12:34

Detect It Easy can do it:

Entropy

There is version for Linux.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.