Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'm playing around with binwalk -E and am just looking at some entropy graphs as I try to reverse engineer some CTF binaries. I kinda understand the use of data/information entropy in cryptography (it's often used to help determine what cipher/encryption is used) but I haven't read or heard anything about entropy in analysis of program.
What does entropy really mean in reverse engineering? What does it say about a program? How can it be used?
Entropy is a measurement of the appearance of "randomness" of bytes. For example, if you were to take the entropy of the text content of this post, and then take the entropy of a SHA-512 hash or RSA ciphertext, you will see a dramatic increase in the hash and RSA ciphertext over the plaintext content of this post. There are known entropy levels for plaintext English, for instance.
How it can be used in reverse engineering
One useful function of entropy is to determine areas of ciphertext or other encryption outputs in a program. A concrete example would be to take a "packed" or compressed malware sample, and compare the entropy levels to a non-packed or non-compressed program. The packed malware sample will have entropy levels that are much higher. One useful application of this would be to simply write a script which batch-scans files and takes entropy readings, in order to identify files that have large areas of packed/compressed/encrypted data. These files will have higher entropy readings. A malware analyst will sometimes take an entropy reading of a file in an initial cursory analysis to determine if the file is packed or not.
Switching gears, if you wanted to pack or compress data in your own program, you could write your packing code, then compare the entropy of the output data with the entropy of the uncompressed data to see how much "randomness" you've introduced.
