9

I've heard of tools that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have certain entropy patterns that could suggest compressed or encrypted data?

  • What definition of entropy are you interested in, e.g. binary Shannon entropy? – JamalS Jul 23 '14 at 12:20
10

You could use the #entropy command radare2. binwalk can calculate entropy, too.

Radare2

From the manual page of Radare2:

 #[hash]     Calculates the sha1, sha256, sha384, sha512, par, xor,
             xorpair, hamdist, mod255, crc16, crc32, md4, md5, entropy of
             the current block from the selected seek

So, using this command is as follow:

$ radare2 /bin/ls
[0x00404890]> #entropy
5.338618

Binwalk

If you get binwalk from the original Github project, you will also grad a few Python modules, one of these is computing the entropy of the analyzed file.

Get these modules and run it on your file.

  • Those are both good suggestions, but I'd add that there is great insight to be gained in writing your own tools. – Edward Jul 23 '14 at 12:34
6

Detect It Easy can do it:

Entropy

There is version for Linux.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.