I've heard of tools that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have certain entropy patterns that could suggest compressed or encrypted data?
1
-
What definition of entropy are you interested in, e.g. binary Shannon entropy?– JamalSJul 23, 2014 at 12:20
Add a comment
|
3 Answers
You could use the #entropy command radare2. binwalk can calculate entropy, too.
Radare2
From the manual page of Radare2:
#[hash] Calculates the sha1, sha256, sha384, sha512, par, xor,
xorpair, hamdist, mod255, crc16, crc32, md4, md5, entropy of
the current block from the selected seek
So, using this command is as follow:
$ radare2 /bin/ls
[0x00404890]> #entropy
5.338618
Binwalk
If you get binwalk from the original Github project, you will also grad a few Python modules, one of these is computing the entropy of the analyzed file.
Get these modules and run it on your file.
-
Those are both good suggestions, but I'd add that there is great insight to be gained in writing your own tools.– EdwardJul 23, 2014 at 12:34
-
Use ent: https://www.fourmilab.ch/random/ to run statistical tests checking for randomness.
$ cat 1-gb-file.img | ent
Entropy = 7.999998 bits per byte.
Optimum compression would reduce the size
of this 100000000 byte file by 0 percent.
Chi square distribution for 100000000 samples is 249.38, and randomly
would exceed this value 58.75 percent of the times.
Arithmetic mean value of data bytes is 127.4928 (127.5 = random).
Monte Carlo value for Pi is 3.141514686 (error 0.00 percent).
Serial correlation coefficient is -0.000094 (totally uncorrelated = 0.0).
