1

I am looking for certain strings in (Windows) executable files.

First I started with

grep -a string file

as that treats binary files like text files. The problem there is there is no neat output, line breaks happen by chance (when the right bytes come in order) etc.pp.

So I thought I'd use strings:

strings file | grep -i string

To my astonishment 'strings' does not find strings that I was able to find using 'grep -a'. However 'strings' is nice in the way that it outputs each item of whatever it finds on a new line.

How do I get the best of both worlds? Meaning I want to really find everything and also get sensible output of what was found.

  • How long is the search string? strings by default prints printable strings with at least 4 characters, so if your search string is shorter, some lines would be missed. – muru Oct 6 '14 at 16:32
  • Holy.... I swear I read^H^H^H^Hopened the man page. Please post as answer, will gladly accept. – Marki Oct 6 '14 at 16:46
3

That strings doesn't find the same patterns as your string is most likely caused by strings finding patterns at least 4 characters long and followed by a non-printable character. From man strings for GNU strings:

For each file given, GNU strings prints the printable character
sequences that are at least 4 characters long (or the number given
with the options below) and are followed by an unprintable character.

In addition to that strings b y default only scans initialised and loaded sections of object files, which might further reduce the number of lines output.

You can try the -a and -n options to change that behaviour:

strings -n 1 -a file | grep -i string

That should get you more strings, and probably all you are expecting.

Difference in output on my python exececutable:

$ strings $(which python) | wc
  31923   68075  474068
$ strings -n 1 $(which python) | wc
 501231  531837 1541204
$ strings -n 1 -a $(which python) | wc
 501398  531995 1541762
0

Why not:

grep -a string file | strings

strings prints the printable character sequences that are at least 4 characters long. So if you grep for something shorter than 4 characters, processing via strings first will cause it to miss out. Use strings -n 1 to set the minimum length to 1.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.