# What Linux software can I use to explore entropy of a file?

I've heard of tools that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have certain entropy patterns that could suggest compressed or encrypted data?

• What definition of entropy are you interested in, e.g. binary Shannon entropy? Jul 23, 2014 at 12:20

You could use the #entropy command radare2. binwalk can calculate entropy, too.

From the manual page of Radare2:

`````` #[hash]     Calculates the sha1, sha256, sha384, sha512, par, xor,
xorpair, hamdist, mod255, crc16, crc32, md4, md5, entropy of
the current block from the selected seek
``````

So, using this command is as follow:

``````\$ radare2 /bin/ls
[0x00404890]> #entropy
5.338618
``````

## Binwalk

If you get binwalk from the original Github project, you will also grad a few Python modules, one of these is computing the entropy of the analyzed file.

Get these modules and run it on your file.

• Those are both good suggestions, but I'd add that there is great insight to be gained in writing your own tools. Jul 23, 2014 at 12:34
• commands: `radare2 -q -c '#entropy' file` and `binwalk -E file` May 10, 2022 at 9:53

Detect It Easy can do it: There is version for Linux.

Use `ent`: https://www.fourmilab.ch/random/ to run statistical tests checking for randomness.

``````\$ cat 1-gb-file.img | ent
Entropy = 7.999998 bits per byte.

Optimum compression would reduce the size
of this 100000000 byte file by 0 percent.

Chi square distribution for 100000000 samples is 249.38, and randomly
would exceed this value 58.75 percent of the times.

Arithmetic mean value of data bytes is 127.4928 (127.5 = random).
Monte Carlo value for Pi is 3.141514686 (error 0.00 percent).
Serial correlation coefficient is -0.000094 (totally uncorrelated = 0.0).
``````