23

I have a bunch of binaries and I know that inside these binaries there are strings I want to find.

I want to do a:

grep -lir "the string I am looking for"

and get a list of all binaries inside a particular directory that contain that string but grep -lir is apparently not working with these files.

Is there a command that can do this kind of search from terminal?

23

With GNU grep, you can use -a option to make it treats binary files as text files:

grep -ali -- string file

If your grep version does not support -a, you can use ack instead. With ack 1.x, you need to include -a option, with ack 2.x, you don't, since when searching include non-text file by default (only ignored non-text file when you did not specify any files).

  • Am I misreading ack's self-description? (in the manual) "ack 2.x will search through every regular, non-binary file that is not explicitly ignored [by blah blah]" So it sounds like ack 2.x should still stop reading a file early if the contents look binary. – Peter Cordes Jul 24 '15 at 4:09
  • 1
    @PeterCordes: That's occured when no files were selected. Try ack grep /bin/grep and you will get the result. I updated my answer to prevent confusing. – cuonglm Jul 24 '15 at 4:15
  • 1
    Try using the strings command to get the strings from your binary. – Uwe Burger Jul 24 '15 at 21:10
8

Your question is about find binary files that contain a pattern (and we have already very good answers!). Complementary we may like to get the occurrences.

I often use

grep -aPo '.{0,20}pattern.{0,20}'  binfile

to get a surrounding context of 20-char.

22

The command strings will extract all ascii data from a file, if you then grep its output, you can search for your data:

strings <filename> | grep "search text"
  • This should be the accepted answer. This binary is good fit for this task. – Vladislavs Dovgalecs Jul 23 '15 at 22:47
  • 5
    @xeon: It's not always good to use strings, read here for more details. – cuonglm Jul 24 '15 at 1:55
  • 1
    Since the goal is to determine which binaries contain the string, strings -f would be more appropriate. – jamesdlin Jul 24 '15 at 9:51
  • This is a better answer. – Xofo Dec 7 '17 at 3:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.