BinStat

Detect packed executables using statistics on the n-grams of their blocks and boosted decision trees.

BinStat is an implementation of this paper into a Python package with a console script to detect whether an executable is packed, using statistics on the n-grams of its blocks and boosted decision trees.

A model trained on PE files is included ; scikit-learn is only needed for training your own models.

$ pip install binstat

$ binstat --help
[...]
usage examples:
- binstat detect program.exe
- binstat detect program.exe --threshold 0.6 --ratio
- binstat features program.exe --label yes
- binstat train -p packed/ -n not-packed/ -o model.json --max-blocks 100

Detection Mechanism

1. Split the executable into blocks of 1024 bytes
2. Compute the frequencies of the unigrams (bytes) of each block
3. Compute 13 statistical and information theory measures on these frequencies (Simpson's index, Canberra's distance, entropy, Kullback-Leibler's divergence, ...)
4. Classify each block as packed or not with boosted decision trees
5. If at least 50% of the blocks are packed, the input executable is packed ; otherwise, it is not

Related Projects

You may also like these:

• Awesome Executable Packing: A curated list of awesome resources related to executable packing.
• Bintropy: Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes (inspired from this paper).
• Dataset of packed ELF files: Dataset of ELF samples packed with many different packers.
• Dataset of packed PE files: Dataset of PE samples packed with many different packers (fork of this repository).
• Docker Packing Box: Docker image gathering packers and tools for making datasets of packed executables.
• DSFF: Library implementing the DataSet File Format (DSFF).
• PEiD: Python implementation of the well-known Packed Executable iDentifier (PEiD).
• PyPackerDetect: Packing detection tool for PE files (fork of this repository).
• REMINDer: Packing detector using a simple heuristic (inspired from this paper).