Bintropy

Bintropy estimates how likely a binary is to contain compressed or encrypted bytes, which is a strong hint that it is packed. It implements the entropy-based analysis tool of Lyda and Hamrock, Using Entropy Analysis to Find Encrypted and Packed Malware, as a Python package with a console script.

Features

• The two criteria of the paper (see How it works): a binary is packed when both its average block entropy and its highest block entropy reach a threshold.
• Three modes of operation: the whole binary and per section, as in the paper, plus per segment.
• Three executable formats: PE, ELF and Mach-O, parsed with LIEF.
• Configurable: block size, thresholds and the handling of blocks that are mostly zeros (or mostly one byte).
• Plots of the entropy along the binary, with its sections and entry point.
• A command-line tool, bintropy, and a Python API.

Quick start

$ pip install bintropy
$ bintropy /bin/ls
False
$ bintropy /bin/ls --do-not-decide
5.932568219905103 5.012807161052562

From Python:

from bintropy import bintropy

print(bintropy("program.exe"))                # True or False
print(bintropy("program.exe", decide=False))  # (highest block entropy, average block entropy)

With --plot, Bintropy draws the entropy of the binary along its sections:

Related projects

Bintropy is part of the packing-box ecosystem:

• Awesome Executable Packing: a curated list of resources about executable packing.
• Dataset of packed ELF files and Dataset of packed PE files.
• Docker Packing Box: a Docker image of packers and tools for building datasets of packed executables.
• DSFF: the DataSet File Format library.
• PEiD: a Python implementation of the Packed Executable iDentifier.
• PyPackerDetect: a packing detector for PE files using several heuristics and PEiD signatures.
• REMINDer: a packing detector using a simple heuristic on the entry point section.

License

Bintropy is released under the GNU General Public License v3 or later.