nentropy

A lightweight, zero-dependency process memory entropy scanner written in Nim.

nentropy attaches to a target process by PID, iterates over its virtual memory regions, reads memory chunks, and calculates the Shannon entropy for each block. High entropy (approaching 8.0) typically indicates encrypted data, compressed payloads, or packed code sections.

Features

• Zero External Dependencies: Pure Nim standard library with direct OS interaction.
• Cross-Platform Support: Full support for both Windows (WinAPI) and Linux (/proc).
• Fast & Minimal: Compiles to a tiny native binary without runtime overhead.
• Privilege Management: Automatically requests SeDebugPrivilege on Windows for elevated process access.
• Shannon Entropy Calculation: Accurately computes entropy on a scale from 0.0 to 8.0.
• Memory Map Inspection: Parses memory regions and protection flags.

Requirements

• Nim compiler (v2.0+)
• Windows: Windows 10/11 or Windows Server (MinGW gcc/clang)
• Linux: Kernel with /proc/[pid]/maps and /proc/[pid]/mem interface

Installation & Build

Clone the repository and compile with release optimizations:

git clone [https://github.com/itsventie/nentropy.git](https://github.com/itsventie/nentropy.git)
cd nentropy
nim c -d:release --opt:speed src/nentropy.nim

Usage

Windows

Run from an elevated PowerShell / CMD terminal:

.\src\nentropy.exe <PID>

Linux

Run with superuser privileges (required to read memory of other processes via /proc):

sudo ./src/nentropy <PID>

Example Output

Windows:

[+] Attached to PID: 4124 (Windows API)
BASE ADDR           SIZE (KB)   PERMS      ENTROPY
--------------------------------------------------------
0x00007FF61200      328         0x0020     6.12
0x00007FF61400      4           0x0004     2.41
0x00007FF61A00      132         0x0004     7.94

Linux:

[+] Attached to PID: 1337 (Linux /proc)
START ADDR       END ADDR         PERMS   SIZE(KB)  ENTROPY
-----------------------------------------------------------
00400000         00452000         r-xp        328      6.12
00651000         00652000         rw-p          4      2.41
7ffc8a120000     7ffc8a141000     rw-p        132      7.94

How It Works

1. Memory Region Querying:
2. Windows: Iterates through virtual memory pages using VirtualQueryEx and reads chunks via ReadProcessMemory. Automatically enables SeDebugPrivilege via AdjustTokenPrivileges.

3. Linux: Reads /proc/<PID>/maps to locate readable memory ranges, then seeks and reads bytes directly from /proc/<PID>/mem.

4. Calculating Entropy: Applies Shannon's Entropy formula:

$$H(X) = -\sum_{i=1}^{n} P(x_i) \log_2 P(x_i)$$