Entropy / Heat Map View (Hex)

[Manouchehri]

Similar to binwalk (and Hopper), it would be great if Binja had an entropy view.

(Source: https://fwhacking.blogspot.ca/2014/05/grandstream-gxp2000-7-binwalk-entropy.html)

This could be implemented by changing the background of each hex byte (e.g. more red == more random, less red == less random). See Hexinator's UI as an example.

(Source: https://www.mac4n6.com/blog/2015/2/8/hfs-grammar-updates-now-with-windows-linux-support)

[psifertex]

We definitely like the idea of including some entropy visualizations, but to be clear, neither of the above to images are doing what you're asking before. The first is just showing a histogram graph which isn't at all useful for local entropy but only the total frequency.

The second isn't showing entropy on the bytes but rather just sections in a decoded file format which is a completely different thing (that we also want to do, but I digress) because the tricky part is /which/ rolling range do you want to include for your entropy.

Hopper has some great entropy visualizations that are very similar to many of those first demonstrated by cantor.dust, but again, none of them work on a per-byte basis but are rather bigrams or fixed-width entropic measurements mapped over a hilbert curve into a 2d plane.

Anyway, all this to say, yeah, we've thought about visualizing binary data a lot and are interested in it, but probably a ways out on the priority list.

[Mild edit -- the first one isn't just a histogram, I didn't look closely -- point remains though that they just pick a fixed size to operate over and summarize]

[Manouchehri]

Sorry, I meant for the second image to used as more of a vision/idea rather than taken as verbatim.

Once the highlighting for hex view is implemented in the API, I can probably do this myself (seems easier/faster than trying to explain it). (binwalk is easy to use from Python.)

Correct, it's an approximation. I still like using it to help myself narrow down what an unknown binary might contain (there's probably better methods I don't know about). http://www.devttys0.com/2013/06/differentiate-encryption-from-compression-using-math/

[plafosse]

Although I think it would be a nice to have. I'm going to close this because this is very low on our priority list. I believe when we have GUI plugins people 3rd parties will be able to implement what they want easily.