Detect packed executables using statistics on the n-grams of their blocks and boosted decision trees.
BinStat is an implementation of this paper into a Python package with a console script to detect whether an executable is packed, using statistics on the n-grams of its blocks and boosted decision trees.
Models trained on PE (the default one) and ELF (used for ELF executables) files are included ; scikit-learn is only needed for training your own models.
$ pip install binstat
$ binstat --help
[...]
usage examples:
- binstat detect program.exe
- binstat detect program.exe --threshold 0.6 --ratio
- binstat features program.exe --label yes
- binstat train -p packed/ -n not-packed/ -o model.json --max-blocks 100
- Split the executable into blocks of 1024 bytes
- Compute the frequencies of the unigrams (bytes) of each block
- Compute 13 statistical and information theory measures on these frequencies (Simpson's index, Canberra's distance, entropy, Kullback-Leibler's divergence, ...)
- Classify each block as packed or not with boosted decision trees
- If at least 50% of the blocks are packed, the input executable is packed ; otherwise, it is not
You may also like these:
- Awesome Executable Packing: A curated list of awesome resources related to executable packing.
- Bintropy: Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes (inspired from this paper).
- Dataset of packed ELF files: Dataset of ELF samples packed with many different packers.
- Dataset of packed PE files: Dataset of PE samples packed with many different packers (fork of this repository).
- Docker Packing Box: Docker image gathering packers and tools for making datasets of packed executables.
- DSFF: Library implementing the DataSet File Format (DSFF).
- PEiD: Python implementation of the well-known Packed Executable iDentifier (PEiD).
- PyPackerDetect: Packing detection tool for PE files (fork of this repository).
- REMINDer: Packing detector using a simple heuristic (inspired from this paper).
