Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
executable file 50 lines (41 sloc) 1.36 KB
#!/usr/bin/python
import pefile
import sys
import os
# Analyse PE Section entropy
# v 0.2
# Need https://code.google.com/p/pefile et on lui doit TOUT
# Copyleft Thanat0s
# http://Thanat0s.trollprod.org
#
# Licence GNU GPL
SECTIONS = ['.text', '.bss', '.rdata', '.data', '.edata', '.idata', '.pdata', '.debug', '.xdata', '.reloc', '.rsrc', '.code', '.tls']
# Needs two arg if not... help
if len(sys.argv) != 2:
print ('Compute the entropy of PE sections')
print ('To Use: '+ sys.argv[0]+ ' filename')
sys.exit(1)
FILENAME = sys.argv[1]
# Test if file exists
if not os.path.isfile(FILENAME):
print ('File not found')
sys.exit(1)
# Load an get sectiors
try:
PE = pefile.PE(FILENAME, fast_load=True)
except:
print ("Error in loading " + FILENAME)
print ("Section\t\tEntropy\tSize\tMD5\t\t\t\t\tRemark")
for section in PE.sections:
ENTROPY = section.get_entropy()
SECTION_NAME = section.Name.strip().replace(chr(0x00), "")
REMARKS = []
SECTION_USUAL = True
for names in SECTIONS:
if names==SECTION_NAME:
SECTION_USUAL = False
if SECTION_USUAL:
REMARKS.append("Unusal Segment")
if ENTROPY > 7:
REMARKS.append("High Entropy")
print ("%s%s\t%.3f\t%s\t%s\t%s" % (SECTION_NAME, ' ' * (8 - len(SECTION_NAME)), ENTROPY, section.SizeOfRawData, section.get_hash_md5(), ','.join(REMARKS)))