blob: 42e5d28e20d3ecc63a7a4f48d1bb87dee5ecdc86 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
function Get-Entropy
{
<#
.SYNOPSIS
Calculates the entropy of a file or byte array.
PowerSploit Function: Get-Entropy
Author: Matthew Graeber (@mattifestation)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
.PARAMETER ByteArray
Specifies the byte array containing the data from which entropy will be calculated.
.PARAMETER FilePath
Specifies the path to the input file from which entropy will be calculated.
.EXAMPLE
C:\PS>Get-Entropy -FilePath C:\Windows\System32\kernel32.dll
.EXAMPLE
C:\PS>ls C:\Windows\System32\*.dll | % { Get-Entropy -FilePath $_ }
.EXAMPLE
C:\PS>$RandArray = New-Object Byte[](10000)
C:\PS>foreach ($Offset in 0..9999) { $RandArray[$Offset] = [Byte] (Get-Random -Min 0 -Max 256) }
C:\PS>$RandArray | Get-Entropy
Description
-----------
Calculates the entropy of a large array containing random bytes.
.EXAMPLE
C:\PS> 0..255 | Get-Entropy
Description
-----------
Calculates the entropy of 0-255. This should equal exactly 8.
.OUTPUTS
System.Double
Get-Entropy outputs a double representing the entropy of the byte array.
.LINK
http://www.exploit-monday.com
#>
[CmdletBinding()] Param (
[Parameter(Mandatory = $True, Position = 0, ValueFromPipeline = $True, ParameterSetName = 'Bytes')]
[ValidateNotNullOrEmpty()]
[Byte[]]
$ByteArray,
[Parameter(Mandatory = $True, Position = 0, ParameterSetName = 'File')]
[ValidateNotNullOrEmpty()]
[IO.FileInfo]
$FilePath
)
BEGIN
{
$FrequencyTable = @{}
$ByteArrayLength = 0
}
PROCESS
{
if ($PsCmdlet.ParameterSetName -eq 'File')
{
$ByteArray = [IO.File]::ReadAllBytes($FilePath.FullName)
}
foreach ($Byte in $ByteArray)
{
$FrequencyTable[$Byte]++
$ByteArrayLength++
}
}
END
{
$Entropy = 0.0
foreach ($Byte in 0..255)
{
$ByteProbability = ([Double] $FrequencyTable[[Byte]$Byte]) / $ByteArrayLength
if ($ByteProbability -gt 0)
{
$Entropy += -$ByteProbability * [Math]::Log($ByteProbability, 2)
}
}
Write-Output $Entropy
}
}
|