Re:Visualizing Entropy in Binary Files
by cortesi on Saturday November 08, 2014 @02:34PM
(#8577912)
Author of the post here. I'm working on a browser-based interactive analysis tool based on these visualizations. It's nowhere near ready for release, but those who are interested can find a demo here:
This is not even an alpha yet - I plan to announce the initial release in the next month or so. Eventually, I would like to add the ability to upload, share and annotate files for analysis. Comments and criticisms welcome!
Re:Visualizing Entropy in Binary Files
by cortesi on Saturday November 08, 2014 @04:48PM
(#8578246)
Frequency analysis and byte dot plots are definitely on the way. Do you have a concrete example of the digraph frequency feature you can link me to? Any other feature suggestions are welcome too.
Regarding other space-filling curves - I'm in two minds about this. I've implemented z-order and the H-curve for binvis, but for different reasons neither of these are as useful as the Hilbert curve, so they're not exposed in the interface. My feeling now is that I should pick one locality preserving layout and one intuitive layout to keep things simple and usable. I want binvis to be a workaday tool, so I'm keeping my space-filling curve geekery to another project (https://github.com/cortesi/scurve).
Re:Visualizing Entropy in Binary Files
by wxs on Saturday November 08, 2014 @04:40PM
(#8578229)
These images remind me of Piet[1], an esoteric programming language where the programs are images. There you see the structure of the algorithm, rather than the binary, visually presented.
Re:Visualizing Entropy in Binary Files
by cyphunk on Sunday November 09, 2014 @06:33AM
(#8579671)
reverse engineering binaries. as patterns are visualised you can also skip reverse engineering for some goals. for example general entropy levels of bytes (in relation to their siblings) may allow one to quickly pull out encryption keys from binaries or memory images.
http://binvis.io
This is not even an alpha yet - I plan to announce the initial release in the next month or so. Eventually, I would like to add the ability to upload, share and annotate files for analysis. Comments and criticisms welcome!
https://i.imgur.com/lsRA1RN.png
Regarding other space-filling curves - I'm in two minds about this. I've implemented z-order and the H-curve for binvis, but for different reasons neither of these are as useful as the Hilbert curve, so they're not exposed in the interface. My feeling now is that I should pick one locality preserving layout and one intuitive layout to keep things simple and usable. I want binvis to be a workaday tool, so I'm keeping my space-filling curve geekery to another project (https://github.com/cortesi/scurve).
The author says in a presentation [2] that CD is based on Cortesi's work.
[1] https://sites.google.com/site/xxcantorxdustxx/visual-re
[2] https://www.youtube.com/watch?v=4bM3Gut1hIk
Here is a demo: https://media.blackhat.com/bh-us-12/Arsenal/Domas/_cantor.du...
[1] http://www.dangermouse.net/esoteric/piet/samples.html
I remember reading a Slashdot article on it in which one of the examples was a 3D, freely-rotating view of the Linux kernel binary.
Does anyone know what I'm talking about? I can't seem to recall the name of the project or find it.
Also related:
http://vimeo.com/110257380
http://gynvael.coldwind.pl/?id=199
https://www.youtube.com/watch?v=5f7hZBoEwV0
https://github.com/pwaller/binview