PDA

View Full Version : DataSmoke


felice2011
18-04-2017, 08:04
Entropy Calculation Files (DataSmoke By Bulat Ziganshin)

https://github.com/Bulat-Ziganshin/DataSmoke

https://i.imgsafe.org/6287742b37.png

https://i.imgsafe.org/62c421e41f.png

https://i.imgsafe.org/629ac56611.png

Provides the following results on each scanned file.

1) Byte entropy

2) Word entropy

3) Order-1 byte entropy

4) DWord hash entropy

5) DWord coverage

6) 2-pass DWord coverage

7) 2-pass QWord coverage

Possibility of scanning the full directory, with real-time calculation of the average percentage for each result.

Calculation of the real-time percentage average of all results, with estimated final size.

Thanks to Gozarck for the idea.

felice2011
19-04-2017, 14:59
Added DataSmoke Test.

ChronoCross
20-04-2017, 09:46
Upsss. datasmoke.exe crash.

PD:I would like the application create a list of files which have a specific entropy percentage.
Example:
Sort files with 90% of entropy and create a list of those files.
Result in prompt:
data_1.pkg 91% entropy
data_2.pkg 31% entropy
data_3.pkg 11% entropy
data_4.pkg 92% entropy
data_5.pkg 94% entropy
Result in list.txt:
D:\Game\data\data_1.pkg
D:\Game\data\data_4.pkg
D:\Game\data\data_5.pkg

felice2011
20-04-2017, 10:22
Upsss. datasmoke.exe crash.

Crash..Crash..What Crash did you exaggerate with the bufsize?:rolleyes:

ChronoCross
20-04-2017, 18:55
Buf 4 mb default crash
Buf 1 k crash
Smoke.exe works fine.
I use smoke since 2015. It's a great tool.

felice2011
20-04-2017, 22:35
Tested in W10x64 v1607 b14393 & W7x64 no crash.

elit
28-09-2017, 05:04
Thank you for pointing me here from my thread, this looks really great, will try it later.