IFAU – Index Frequency Analysis Utility
by sharpe on Jun.04, 2009, under Reverse Code Engineering, Utilities
IFAU is a simple utility that was written to analyse binary files and count how many times each hex byte is present in a given file. This is useful when attempting to identify frequently used op codes. The results are written to a hash which is dumped to an XML report as well as a graph upon completion.
A sample XML report might resemble the following:
<?xml version=”1.0″ encoding=”iso-8859-1″ ?>
<bytes count=”10″>
<byte value=”11″ count=”1″ />
<byte value=”23″ count=”1″ />
<byte value=”32″ count=”1″ />
<byte value=”38″ count=”1″ />
<byte value=”4a” count=”1″ />
<byte value=”69″ count=”1″ />
<byte value=”87″ count=”2″ />
<byte value=”ad” count=”1″ />
<byte value=”df” count=”1″ />
<byte value=”fa” count=”1″ />
</bytes>
As mentioned above, this information is also presented in a graph. A large number of different bytes can result in the graph being difficult to read, which is why the previously presented XML report is also generated.
As an illustration, a graph for a small binary file might resemble the following:
IFAU can be downloaded here: ifau (46). This is a beta release so use at your own risk.
