/binrub

Snaillike binwalk copycat ๐ŸŒ

Primary LanguageRuby

Find magic bytes inside any file, and plot Shannon entropy.

$ ./binrub file.bin

DECIMAL         HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0               0x0             PDF document
55080           0xD728          Zlib compressed data, No Compression (with preset dictionary)
64692           0xFCB4          Zlib compressed data, No Compression (with preset dictionary)

To plot nice entropy graphs in the terminal, install that gem : gem install unicode_plot.

$ ./binrub -E file.bin 

DECIMAL         HEXADECIMAL     ENTROPY
-------------------------------------------------------------------------
0               0x0             Falling entropy edge (0.5848887341528269)

              Entropy (block size = 1024)
       โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
   0.7 โ”‚โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โก โ”‚
       โ”‚โข„โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โก โ Šโ €โ”‚
       โ”‚โ €โ ‰โ ขโก€โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โข€โ €โ €โ €โ €โ €โ €โ €โ €โก โ Šโ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ ˆโ ขโก€โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โข€โฃ€โ คโ ’โ Šโ โ ‰โ ‰โ ’โ ’โ ขโ คโ ”โ Šโ €โ €โ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ €โ €โ ˆโ ขโก€โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โก”โ ‰โ โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ €โ €โ €โ €โ ‘โก„โ €โ €โ €โ €โ €โ €โ €โ €โข€โ œโ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ €โ €โ €โ €โ €โ ˆโข†โ €โ €โ €โ €โ €โ €โข€โ Žโ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ ฃโก€โ €โ €โ €โก โ ƒโ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ ‘โก„โ €โกฐโ โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
       โ”‚โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ ˆโ žโ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
   0.5 โ”‚โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ €โ”‚
       โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
       1                                        7
  • TODO
    • reduce false positive
    • extract files
    • regex for some magic numbers