IDAtropy

m4n0w4r 发表于 2018-2-6 22:51

IDAtropy is a plugin for Hex-Ray's IDA Pro designed to generate charts of entropy and histograms using the power of idapython and matplotlib.

Dependencies:

IDAtropy requires the matplotlib python's library. Personally, I prefer the following steps to install it, that not requiere compile Numpy:

Download the lasted numpy .whl from: http://www.lfd.uci.edu/~gohlke/pythonlibs/#numpy
Install with pip:
IDA <= 6.9: pip install numpy-1.13.3+mkl-cp27-cp27m-win32.whl
IDA >= 7.0 (for python x64): pip install numpy-1.13.3+mkl-cp27-cp27m-win_amd64.whl
Finally, install matplotlib: pip install matplotlib

The plugin was only extensively tested on IDA Pro 6.9 and 7.0 for Windows/Mac, with Python 2.7 and matplotlib 1.4.3, but it should work with other versions and OS's. If you find any inconsistency, let me know.
Screenshot:
https://user-images.githubusercontent.com/1675387/35856350-0c473678-0b36-11e8-9f84-3f5dbcd03522.png

https://user-images.githubusercontent.com/1675387/35856708-18d7a340-0b37-11e8-9643-9cf51a74a4d6.png

More infor : https://github.com/danigargu/IDAtropy/

A-new 发表于 2018-2-7 12:32

主要是计算软件熵的，根据熵值可以判断软件是加壳或者被修改等die也有类似功能，die把熵的范围定义为0~8，加壳限值好像是6.8，更多关于软件熵的东西大家可以看看http://n10info.blogspot.com/2014/06/entropy-and-distinctive-signs-of-packed.html
和
https://zh.wikipedia.org/wiki/%E8%BB%9F%E9%AB%94%E7%86%B5

ch5566 发表于 2018-2-6 23:13

没看明白

桃夭国际 发表于 2018-2-6 23:43

完全不懂什么意思

田田爱崽崽 发表于 2018-2-6 23:47

是为了计算反汇编代码内部的杂乱程度？

coldnight 发表于 2018-2-7 01:22

字面意思是计算各个段的熵应该和代码复杂度有关

偶来啦 发表于 2018-2-7 11:13

感谢分享支持楼主

Qistan 发表于 2018-2-7 11:17

感谢分享

丶提莫 发表于 2018-2-7 11:20

感谢分享，小白默默路过{:301_1009:}

tangfangxi 发表于 2018-2-7 12:07

感谢分享支持楼主，楼主是不是可以简单的说明一下？

页: [1] 2

吾爱破解 - 52pojie.cn's Archiver

IDAtropy