Truxton child file get entropy

This retrieves entropy of the file contents.

Syntax

double truxton_child_file_get_entropy( uint64_t child_handle );

Parameters

child_handle

The handle created by the truxton_child_file_create or truxton_file_create_child call.

Return value

The entropy of the file.

Remarks

This value is computed as data is written to Truxton. It becomes valid only after a call to truxton_child_file_end_write or truxton_child_file_save.

Entropy, aka Shannon's entropy, is a floating point number between zero and eight. It is the number of bits required to represent the information in the file. Lower values means there's less information, high values means there's lots of information in the data. A file containing a million 0xFF characters will have an entropy of zero, no information, because there's nothing but a single value represented in the file a million times. Text is usually in the 5.6 range. Compressed files will about 7.8 and encrypted files will be 7.99 or 8.

Truxton computes Shannon's entropy slightly differently. It uses the standard calculation for entropy but will promote any value less than 0.001 but greater than zero to 0.001. This was done because Truxton eliminates files with an entropy value of zero. Those files contain no information and are therefore useless. But, a file that is 10GB long with all but the last byte being zero will have an entropy of less than 0.001 but not zero. In order to avoid having very low entropy files eliminated, Truxton will set the minimum entropy to 0.001.

Sample

void add_folder(uint64_t truxton, uint64_t parent_file)
{
   truxton_start_adding_files(truxton);

   uint64_t child = truxton_child_file_create(truxton);

   char id[40];

   truxton_file_get_id(parent_file, id, sizeof(id));
   truxton_child_file_set_parent_id(child, id);
   truxton_child_file_set_type(child, Type_Directory);
   truxton_child_file_set_name(child, "Custom Exploits Folder");

   FILETIME now;

   GetSystemTimeAsFileTime(&now);

   ULARGE_INTEGER ticks;

   ticks.LowPart = now.dwLowDateTime;
   ticks.HighPart = now.dwHighDateTime;

   truxton_child_file_set_created(child, ticks.QuadPart);
   truxton_child_file_set_accessed(child, ticks.QuadPart);
   truxton_child_file_set_modified(child, ticks.QuadPart);

   truxton_child_file_set_origin(child, ORIGIN_GENERATED);

   if ( truxton_child_file_save(child) == 0 )
   {
      printf( "Failed to add child to Truxton\n" );
   }
   else
   {
      double entropy = truxton_child_file_get_entropy(child_file);
      printf( "Entropy:s %lf\n", entropy );
   }

   truxton_child_file_destroy(child);
}