Shannon
A Rust CLI utility that calculates and visualizes block-wise Shannon entropy of files.
What is Shannon Entropy?
Shannon entropy measures the randomness or information density in data. Values range from 0 to 8 bits per byte:
- 0: Completely uniform (e.g., a file of all zeros)
- ~4-5: Typical text or code
- ~7-8: High randomness (encrypted or compressed data)
Use Cases
- Malware analysis: Identify packed or encrypted sections in executables
- File forensics: Detect hidden or embedded data within files
- Compression analysis: Visualize which parts of a file are already compressed
- Binary reverse engineering: Understand file structure and locate data regions
Screenshot
Installation
The binary will be at target/release/shannon.
Usage
Options
| Option | Short | Default | Description |
|---|---|---|---|
--block-size |
-b |
1024 | Block size in bytes for entropy calculation |
--width |
180 | Chart width in characters | |
--height |
100 | Chart height in characters | |
--y-max |
-y |
auto | Maximum Y-axis value (defaults to max entropy found) |
Examples
Analyze a binary with default settings:
Use smaller blocks for finer granularity:
Compact output for smaller terminals:
Output
The tool renders a bar chart in the terminal where:
- X-axis: Block index (position in file)
- Y-axis: Entropy value (0-8 bits per byte)
High entropy regions appear as tall bars, making it easy to spot encrypted or compressed sections at a glance.
License
MIT