radareorg/radare2

Add entropy edges printing mode

Open

#15,510 建立於 2019年11月27日

在 GitHub 查看
 (0 留言) (0 反應) (0 負責人)C (23,826 star) (3,229 fork)batch import
good first issuehackatonprint

描述

We currently have per-block entropy printing with p=e. Would be nice to have the more condensed mode of printing only the rising/falling edges, like in the binwalk -E mode:

[i] ℤ binwalk -E hugo_elf                                                                                                                                                                                                          17:14:18 

DECIMAL       HEXADECIMAL     ENTROPY
--------------------------------------------------------------------------------
0             0x0             Falling entropy edge (0.669811)
33920000      0x2059400       Falling entropy edge (0.500119)
34128896      0x208C400       Falling entropy edge (0.814289)
34181120      0x2099000       Falling entropy edge (0.739773)

[i] ℤ binwalk -E hugo_gz                                                                                                                                                                                                           17:14:32 

DECIMAL       HEXADECIMAL     ENTROPY
--------------------------------------------------------------------------------
0             0x0             Rising entropy edge (0.995563)
3024896       0x2E2800        Rising entropy edge (0.965233)
5500928       0x53F000        Rising entropy edge (0.990217)
5543936       0x549800        Rising entropy edge (0.970625)
5672960       0x569000        Rising entropy edge (0.957641)
6060032       0x5C7800        Rising entropy edge (0.978857)
7462912       0x71E000        Rising entropy edge (0.961115)
7530496       0x72E800        Rising entropy edge (0.958497)
7591936       0x73D800        Rising entropy edge (0.952436)
7622656       0x745000        Rising entropy edge (0.953014)

貢獻者指南

技術棧
c
領域
clisecurity
議題類型
feature
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-2 days
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
fresh
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
C programmingradare2 basics
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
45
研究方向
Examine the existing per block entropy printing mode triggered by 'p=e'. Study the binwalk E output to understand what constitutes rising/falling edges (e.g., significant changes in entropy between adjacent blocks). Identify the relevant source files (likely in libr/core/cmd anal.c or similar) and modify the entropy printing logic to support an optional edge only output format. Ensure the new mode is selectable via a command line flag or command suffix. No maintainer comments or linked PRs exist. The contributor should propose the design before implementing.