.\" STAN - Stream Analyzer .\" Copyright (c) 2001-2004 Konrad Rieck .\" The Roqefellaz, http://www.roqe.org/stan .\" .\" Man page for stan... written from scratch. .\" $Id: stan.1,v 1.4 2001/03/11 23:34:18 kr Exp $ .TH stan 1 "15. September 2004" "Konrad Rieck" .SH NAME stan - Stream Analyzer .SH SYNOPSIS stan [ -bhvV ] [ -f .I filter ] [ -n .I number ] [ -p .I patlen ] [ .I file\ ... ] .SH DESCRIPTION Stan is a console application that analyzes binary streams and calculates several useful statistical information from the observed data. It features statistical, pattern and bit analysis. Stan has been designed as a "swiss-knife" for first steps in reverse engineering and cryptographic analysis. .P Stan expects a list of files at the end of the command line. If no files are specified data is read from Standard Input (stdin). .P Stan's functionality can be divided into three types of analysis: .I general statistics, .I pattern analysis and .I bit analysis. .SS General Statistics Stan uses the bytes of the input data to calculate statistic standard values, such as the mean, the median, the deviation, the chi-square value, and the entropy per byte. Where possible the corresponding ASCII characters are printed after the decimal value in order to simplify text analysis. .SS Pattern Analysis Stan records all observed patterns up to the pattern length .I patlen and efficiently stores them in a treap (binary tree with heap properties). Stan can easily process patterns up to a length of 10 on non-random data .SS Bit Analysis Stan observes so called runs which are sequences of the same bit, e.g. 000 or 11. According to the analysis of pseudo random number generators, it then calculates the following ratios: .P .I Length Ratios. The number runs of length n is divided by the number of runs of length (n+1). If the input data is rather random, the ratio should be 2. .P .I 0/1 Ratios. The number of 0-runs of length n is divided by the number of 1-runs of the same length. If the input data is rather random, this ratio should be 1. .SH OPTIONS .P -b .RS Enable bit analysis. .RE .P -h .RS Print a help screen to stderr. .RE .P -v .RS Print verbose information. .RE .P -V .RS Display the version and copyright notice. .RE .P -f .I filter .RS Use a .I filter before passing the data to the analysis engine. The following .I filter may be used to restrict the range of data. .RS .P 0 No filter (default) .P 1 Analyze only printable characters. .P 2 Analise only alphanumeric characters. .RE .RE .P -n .I number .RS Display .I number of patterns. The default value is 10. You should keep this value rather small because a lot of patterns may be found in a large data stream. .RE .P -p .I patlen .RS Analise patterns from 1 to .I patlen length. The length of the pattern is measured in bytes. .RE .SH EXAMPLES Learn about your password file. Before you execute the following command, guess which is the most common 2 byte pattern. .P .RS $ stan /etc/passwd. .RE .P If you want to analyse your PRNG device, try the following setup .P .RS $ dd if=/dev/urandom count=10 | stan -b .RE .P You may also use stan to analyse text. Let's look at the most common letter patterns in this man page. .P .RS $ man stan | stan -p 5 -f 2 .RS .SH NOTES Stan was designed with efficiency in mind, but if you are using a large .I patlen e.g. 6 or above, you may run into memory problems, especially if you are analyzing random or nearly random data. Just remember that there are 256^6 patterns of the length 6, which could require 281 terabyte of memory! .P If you discover bugs or want to contribute improvements contact the Konrad Rieck . You can always grab the latest version of stan at http://www.roqe.org/stan.