Entropy of an encrypted (with GPG) file #1

$ gpg -o elf.5.gz.gpg -c /usr/share/man/man5/elf.5.gz

$ java ByteEntropy -c -r 512 -w 200 -o elf.5.gz.gpg.ent -f elf.5.gz.gpg

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' elf.5.gz.gpg.ent

Entropy average: 137.792

$ gpg -o motd.5.gz.gpg -c /usr/share/man/man5/motd.5.gz

$ java ByteEntropy -c -r 512 -w 200 -o motd.5.gz.gpg.ent -f motd.5.gz.gpg

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' motd.5.gz.gpg.ent

Entropy average: 137

$ gpg -o stdlib.h.gpg -c /usr/include/stdlib.h

$ java ByteEntropy -c -r 512 -w 200 -o stdlib.h.gpg.ent -f stdlib.h.gpg

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' stdlib.h.gpg.ent

Entropy average: 139.062

$ gpg -o elf.h.gpg -c /usr/include/elf.h

$ java ByteEntropy -c -r 512 -w 200 -o elf.h.gpg.ent -f elf.h.gpg

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' elf.h.gpg.ent

Entropy average: 138.357

$ gpg -o find.gpg -c /usr/bin/find

$ java ByteEntropy -c -r 512 -w 200 -o find.gpg.ent -f find.gpg

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' find.gpg.ent

Entropy average: 138.414

$ gpg -o strip.gpg -c /usr/bin/strip

$ java ByteEntropy -c -r 512 -w 200 -o strip.gpg.ent -f strip.gpg

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' strip.gpg.ent

Entropy average: 138.416

Entropy of a gzip file #1

$ java ByteEntropy -c -r 512 -w 200 -o elf.5.gz.ent -f /usr/share/man/man5/elf.5.gz

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' elf.5.gz.ent

Entropy average: 137

$ java ByteEntropy -c -r 512 -w 200 -o hosts.5.gz.ent -f /usr/share/man/man5/hosts.5.gz

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' hosts.5.gz.ent

Entropy average: 135.5

$ java ByteEntropy -c -r 512 -w 200 -o motd.5.gz.ent -f /usr/share/man/man5/motd.5.gz

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' motd.5.gz.ent

Entropy average: 138

$ java ByteEntropy -c -r 512 -w 200 -o passwd.5.gz.ent -f /usr/share/man/man5/passwd.5.gz

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' passwd.5.gz.ent

Entropy average: 138

$ java ByteEntropy -c -r 512 -w 200 -o proc.5.gz.ent -f /usr/share/man/man5/proc.5.gz

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' proc.5.gz.ent

Entropy average: 138.04

$ java ByteEntropy -c -r 512 -w 200 -o resolv.conf.5.gz.ent -f /usr/share/man/man5/resolv.conf.5.gz

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' resolv.conf.5.gz.ent

Entropy average: 136.833

 

$ java ByteEntropy -c -r 512 -w 200 -o securetty.5.gz.ent -f /usr/share/man/man5/securetty.5.gz

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' securetty.5.gz.ent

Entropy average: 140

$ java ByteEntropy -c -r 512 -w 200 -o services.5.gz.ent -f /usr/share/man/man5/services.5.gz

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' services.5.gz.ent

Entropy average: 136.6

Entropy of a header file #1

$ java ByteEntropy -c -r 512 -w 200 -o assert.h.ent -f /usr/include/assert.h

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' assert.h.ent

Entropy average: 42.3333

$ java ByteEntropy -c -r 512 -w 200 -o crypt.h.ent -f /usr/include/crypt.h

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' crypt.h.ent

Entropy average: 42.25

$ java ByteEntropy -c -r 512 -w 200 -o elf.h.ent -f /usr/include/elf.h

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' elf.h.ent

Entropy average: 41.5422

 

$ java ByteEntropy -c -r 512 -w 200 -o inttypes.h.ent -f /usr/include/inttypes.h

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' inttypes.h.ent

Entropy average: 36.3043

$ java ByteEntropy -c -r 512 -w 200 -o math.h.ent -f /usr/include/math.h

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' math.h.ent

Entropy average: 38.6452

$ java ByteEntropy -c -r 512 -w 200 -o stdio.h.ent -f /usr/include/stdio.h

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' stdio.h.ent

Entropy average: 40.8667

 

$ java ByteEntropy -c -r 512 -w 200 -o stdlib.h.ent -f /usr/include/stdlib.h

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' stdlib.h.ent

Entropy average: 41.4769

$ java ByteEntropy -c -r 512 -w 200 -o time.h.ent -f /usr/include/time.h

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' time.h.ent

Entropy average: 40.8462

Entropy of a binary file #2

$ java ByteEntropy -c -r 512 -w 200 -o find.ent -f /usr/bin/find

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' find.ent

Entropy average: 56.6122

$ java ByteEntropy -c -r 512 -w 200 -o make.ent -f /usr/bin/make

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' make.ent

Entropy average: 59.429

$ java ByteEntropy -c -r 512 -w 200 -o readelf.ent -f /usr/bin/readelf

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' readelf.ent

Entropy average: 46.1129

$ java ByteEntropy -c -r 512 -w 200 -o rsync.ent -f /usr/bin/rsync

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' rsync.ent

Entropy average: 59.8378

$ java ByteEntropy -c -r 512 -w 200 -o strip.ent -f /usr/bin/strip

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' strip.ent

Entropy average: 54.0469

 

$ java ByteEntropy -c -r 512 -w 200 -o sudo.ent -f /usr/bin/sudo

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' sudo.ent

Entropy average: 50.9658

$ java ByteEntropy -c -r 512 -w 200 -o top.ent -f /usr/bin/top

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' top.ent

Entropy average: 47

$ java ByteEntropy -c -r 512 -w 200 -o wget.ent -f /usr/bin/wget

$ awk -F',' '{s+=$1} END {printf "Entropy average: %s\n", s/NR}' wget.ent

Entropy average: 47.5117

ddent - Calculate the entropy of a part of a file

I've coded a small script to calculate the entropy of a part of a file (giving the start offset and the length), which is called ddent (source on GitHub), as it uses both dd and ent. It has a more compact output than ent, and I use it as a shortcut to a long command line I've been using regularly.

Usage: ddent FILE OFFSET LENGTH

OFFSET and LENGTH can be either decimal, or hexadecimal (just be sure to prefix with 0x in this case).

Entropy of a binary file #1

$ java ByteEntropy -c -r 512 -w 200 -o find.ent -f /usr/bin/find

$ objdump -h /usr/bin/find | awk '/[ ]+[0-9]+/ {printf "0x%s %s\n", $6, $2}'

0x00000200 .interp

0x0000021c .note.ABI-tag

0x0000023c .note.gnu.build-id

0x00000260 .hash

0x000006c0 .gnu.hash

0x00000720 .dynsym

0x000014e8 .dynstr

0x000019b8 .gnu.version

0x00001ae0 .gnu.version_r

0x00001b60 .rela.dyn

0x00001bd8 .rela.plt

0x00002850 .init

0x00002868 .plt

0x000030d0 .text

0x00028888 .fini

0x000288a0 .rodata

0x00030934 .eh_frame_hdr

0x000318c0 .eh_frame

0x00036000 .ctors

0x00036010 .dtors

0x00036020 .jcr

0x00036028 .dynamic

0x000361e8 .got

0x000361f8 .got.plt

0x00036640 .data

0x00036be8 .bss

.text section

$ echo $((0x000030d0/512))

24

We can see the .text section beginning at 24 on the picture.

.fini section

$ echo $((0x00028888/512))

324

At 324 the .fini section starts, and the .text section ends.

.data section

$ echo $((0x00036640/512))

435

The .data section corresponds to the sharp drop at 435.

.bss section

$ echo $((0x00036be8/512))

437

The .bss section begins right after the .data section at 437.