diff --git a/src/core/config/Categories.js b/src/core/config/Categories.js index 69ef5155..8b828bc0 100755 --- a/src/core/config/Categories.js +++ b/src/core/config/Categories.js @@ -302,6 +302,7 @@ const Categories = [ ops: [ "Entropy", "Frequency distribution", + "Chi Square", "Detect File Type", "Scan for Embedded Files", "Disassemble x86", diff --git a/src/core/config/OperationConfig.js b/src/core/config/OperationConfig.js index 38dad80b..1e975118 100755 --- a/src/core/config/OperationConfig.js +++ b/src/core/config/OperationConfig.js @@ -3205,6 +3205,13 @@ const OperationConfig = { } ] }, + "Chi Square": { + module: "Default", + description: "Calculates the Chi Square distribution of values.", + inputType: "byteArray", + outputType: "number", + args: [] + }, "Numberwang": { module: "Default", description: "Based on the popular gameshow by Mitchell and Webb.", diff --git a/src/core/config/modules/Default.js b/src/core/config/modules/Default.js index 8e0c8872..a0e8bd23 100644 --- a/src/core/config/modules/Default.js +++ b/src/core/config/modules/Default.js @@ -143,6 +143,7 @@ OpModules.Default = { "Microsoft Script Decoder": MS.runDecodeScript, "Entropy": Entropy.runEntropy, "Frequency distribution": Entropy.runFreqDistrib, + "Chi Square": Entropy.runChiSq, "Detect File Type": FileType.runDetect, "Scan for Embedded Files": FileType.runScanForEmbeddedFiles, "Generate UUID": UUID.runGenerateV4, diff --git a/src/core/operations/Entropy.js b/src/core/operations/Entropy.js index 3451914d..aa9ed0bc 100755 --- a/src/core/operations/Entropy.js +++ b/src/core/operations/Entropy.js @@ -135,6 +135,31 @@ const Entropy = { }, + /** + * Chi Square operation. + * + * @param {byteArray} data + * @param {Object[]} args + * @returns {number} + */ + runChiSq: function(input, args) { + let distArray = new Array(256).fill(0), + total = 0; + + for (let i = 0; i < input.length; i++) { + distArray[input[i]]++; + } + + for (let i = 0; i < distArray.length; i++) { + if (distArray[i] > 0) { + total += Math.pow(distArray[i] - input.length / 256, 2) / (input.length / 256); + } + } + + return total; + }, + + /** * Calculates the Shannon entropy for a given chunk of data. *