Radare2: rahash2

Published: 2016-10-10. Last Updated: 2016-10-10 10:51:14 UTC
by Didier Stevens (Version: 1)
1 comment(s)

Radare2 is an open-source reverse-engineering framework.

Some time ago I wrote about recovering ransomed pictures. By calculating the entropy of the ransomed files with my byte-stats tool, I could see that the file was not completely encrypted.

rahash2 is one of the tools in the Radare2 framework. As it names implies, it calculates (cryptographic) hashes, but it is quite versatile. For example, it will also calculate entropy:

And like my byte-stats.py tool, it can also split the file in blocks and calculate the entropy for each block. You do this with option -b blocksize, and it will also produce a nice ASCII-art graph:

If you have interesting tips for rahash2 (or other Radare2 tools), please post a comment.

Didier Stevens
Microsoft MVP Consumer Security
blog.DidierStevens.com DidierStevensLabs.com

Keywords: radar2 ransomware revsering
1 comment(s)

Comments

First I applaud you on your efforts for the counter measure, and while I do myself considering activities like this a logic puzzle, so even if it was for a mundane issue (this one isn't) it is interesting none the less. I must say that things like ransomware are so counterproductive for society as a whole, it just wastes resources that could be spent on better things, and time that could be so much more valuable in another field or area of computer science. Anyhow keep up the good work.

Anonymous

Oct 11th 2016
8 years ago

Login here to join the discussion.


Top of page
Diary Archives