Commit f330cbb4 by devttys0

Entropy analysis now provides a summary by default; --verbose enables full output

parent 1e5c176a
...@@ -68,6 +68,9 @@ class Entropy(Module): ...@@ -68,6 +68,9 @@ class Entropy(Module):
self.max_description_length = 0 self.max_description_length = 0
self.file_markers = {} self.file_markers = {}
self.trigger_high = .95
self.trigger_low = .85
if self.use_zlib: if self.use_zlib:
self.algorithm = self.gzip self.algorithm = self.gzip
else: else:
...@@ -118,6 +121,8 @@ class Entropy(Module): ...@@ -118,6 +121,8 @@ class Entropy(Module):
pg.exit() pg.exit()
def calculate_file_entropy(self, fp): def calculate_file_entropy(self, fp):
last_edge = None
# Clear results from any previously analyzed files # Clear results from any previously analyzed files
self.clear(results=True) self.clear(results=True)
...@@ -141,11 +146,28 @@ class Entropy(Module): ...@@ -141,11 +146,28 @@ class Entropy(Module):
i = 0 i = 0
while i < dlen: while i < dlen:
entropy = self.algorithm(data[i:i+block_size]) entropy = self.algorithm(data[i:i+block_size])
display = self.display_results
description = "%f" % entropy
if not self.config.verbose:
if last_edge in [None, 0] and entropy > self.trigger_high:
description = "Rising entropy edge (%f)" % entropy
display = self.display_results
last_edge = 1
elif last_edge in [None, 1] and entropy < self.trigger_low:
description = "Falling entropy edge (%f)" % entropy
display = self.display_results
last_edge = 0
else:
display = False
description = "%f" % entropy
r = self.result(offset=(file_offset + i), r = self.result(offset=(file_offset + i),
file=fp, file=fp,
entropy=entropy, entropy=entropy,
description=("%f" % entropy), description=description,
display=self.display_results) display=display)
i += block_size i += block_size
if self.do_plot: if self.do_plot:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment