#!/usr/bin/env ruby # dsgrep [FILES...] - find lines with high entropy # # This tool works like grep; use radare2 or binwalk for binary files! THRESHOLD = Float(ENV["DSTHRES"]) rescue 5 def entropy(s) s = s.b (0..255).sum { |e| px = s.count(e.chr).to_f / s.size px > 0 ? (-px)*Math.log2(px) : 0 } end while line = gets next if line.size < 6 || line.size > 100 if entropy(line) >= THRESHOLD if ARGV.size > 1 print "#{ARGF.filename}:#{ARGF.file.lineno}:" end puts line end end