-1

I want to write a script to extract the entropy of each sections of an EXE file. What is the best tool that I can use to do this? I tried Ghidra but it doesn't have an entropy API which I can use.

  • You are looking for script or just a tool to calculate entropy? – morsisko Jul 10 at 16:52
  • @morsisko I am looking for a script to save the output of the entropy. – Sajjad Zulphekari Jul 13 at 9:08
1

You can use r2 to get the data and r2pipe to script it.

iS entropy produce the entropy values for each section. Adding j will produce it in JSON format and scripting it with r2pipe is easy.

import r2pipe
p = r2pipe.open('<path_to_exe>')
res = p.cmdj('iSj entropy')
print([(x['name'],x['entropy']) for x in res['sections']])

[('.text', '6.00602992'), ('.rdata', '3.94265366'), ('.data', '6.85876398'), ('.pdata', '3.46591559'), ('.rsrc', '4.70150326'), ('.reloc', '4.96848447')]

| improve this answer | |
  • Thank you so much, this is what I wanted. For some weird reason I am getting a keyerror when I try to print the entropy. If I remove x['entropy'] from your code, I get the section names. – Sajjad Zulphekari Jul 10 at 15:21
  • try printing the whole x and see what properties are available - one of them should be the entropy – Paweł Łukasik Jul 10 at 15:23
  • When I just print res or x as you mentioned, I can see the entropy values for each section, but it shows a keyerror when I try to just get the entropy value – Sajjad Zulphekari Jul 10 at 15:25
  • well, keyerror means there's no such entry and since there is such entry maybe there's a subtle typo? hard to guess w/o actual code – Paweł Łukasik Jul 10 at 15:26
  • I realized why I am getting the error. The radare didn't calculate the entropy of .bss section of the file. {'name': '.bss', 'size': 0, 'vsize': 4096, 'perm': '-rw-', 'paddr': 0, 'vaddr': 4214784} That is why it shows a keyerror – Sajjad Zulphekari Jul 10 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.