I want to write a script to extract the entropy of each sections of an EXE file. What is the best tool that I can use to do this? I tried Ghidra but it doesn't have an entropy API which I can use.

  • You are looking for script or just a tool to calculate entropy?
    – morsisko
    Jul 10 '20 at 16:52
  • @morsisko I am looking for a script to save the output of the entropy. Jul 13 '20 at 9:08

You can use r2 to get the data and r2pipe to script it.

iS entropy produce the entropy values for each section. Adding j will produce it in JSON format and scripting it with r2pipe is easy.

import r2pipe
p = r2pipe.open('<path_to_exe>')
res = p.cmdj('iSj entropy')
print([(x['name'],x['entropy']) for x in res['sections']])

[('.text', '6.00602992'), ('.rdata', '3.94265366'), ('.data', '6.85876398'), ('.pdata', '3.46591559'), ('.rsrc', '4.70150326'), ('.reloc', '4.96848447')]

  • Thank you so much, this is what I wanted. For some weird reason I am getting a keyerror when I try to print the entropy. If I remove x['entropy'] from your code, I get the section names. Jul 10 '20 at 15:21
  • try printing the whole x and see what properties are available - one of them should be the entropy Jul 10 '20 at 15:23
  • When I just print res or x as you mentioned, I can see the entropy values for each section, but it shows a keyerror when I try to just get the entropy value Jul 10 '20 at 15:25
  • well, keyerror means there's no such entry and since there is such entry maybe there's a subtle typo? hard to guess w/o actual code Jul 10 '20 at 15:26
  • I realized why I am getting the error. The radare didn't calculate the entropy of .bss section of the file. {'name': '.bss', 'size': 0, 'vsize': 4096, 'perm': '-rw-', 'paddr': 0, 'vaddr': 4214784} That is why it shows a keyerror Jul 10 '20 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.