Skip to main content

Command documentation sourced from the linux-command project This comprehensive command reference is part of the linux-command documentation project.

strings - Find Printable Strings in Files

The strings command finds and extracts printable character sequences from binary files, making it useful for analyzing executable files, examining unknown file formats, and recovering text from corrupted documents.

Basic Syntax​

strings [OPTION]... FILE...

Common Options​

Output Control​

  • -a, --all - Scan the entire file, not just the data section
  • -f, --print-file-name - Print the name of the file before each string
  • -n, --bytes=[MIN-LEN] - Print sequences of MIN-LEN characters or more (default: 4)

Formatting Options​

  • -t, --radix={o,d,x} - Write the offset in base 8, 10, or 16 (default: none)
  • -o - An alias for -t o (octal offset)
  • -w, --include-all-whitespace - Include all whitespace characters

Encoding Options​

  • -e, --encoding={s,S,b,l,B,L} - Select character size and endianness:
    • s = 7-bit single-byte encoding (ASCII)
    • S = 8-bit single-byte encoding (ISO-8859-1)
    • b = 16-bit big endian
    • l = 16-bit little endian
    • B = 32-bit big endian
    • L = 32-bit little endian

Target Specification​

  • -T, --target=BFDNAME - Specify the binary file format

Help Options​

  • --help - Display help message and exit
  • --version - Output version information and exit

Usage Examples​

Basic String Extraction​

# Extract all printable strings from a binary
strings /bin/ls

# Extract strings with minimum length of 10 characters
strings -n 10 program.exe

# Include file names in output
strings -f *.exe

# Show offset for each string
strings -t d /bin/bash

Format Options​

# Show offsets in decimal
strings -t d binary_file

# Show offsets in hexadecimal
strings -t x program.exe

# Show offsets in octal
strings -o system_file

# Include all whitespace characters
strings -w data.bin

Encoding Variants​

# 16-bit little endian strings
strings -e l file.exe

# 32-bit big endian strings
strings -e B data.bin

# 8-bit extended ASCII
strings -e S program

# Multiple encodings
strings -e s -e l -e B binary_file

Practical Examples​

Binary File Analysis​

# Extract version information from executable
strings program.exe | grep -i version

# Find error messages in application
strings app.bin | grep -i error

# Extract URLs from browser executable
strings browser.exe | grep -E "https?://"

# Find library dependencies
strings program | grep "\.so"

System Administration​

# Extract strings from kernel modules
strings /lib/modules/$(uname -r)/kernel/fs/ext4/ext4.ko

# Analyze system binaries
strings -f /usr/bin/* | grep -i copyright

# Check compiled programs for embedded paths
strings program | grep -E "^/"

# Extract configuration hints
strings /etc/sshd | grep -i config

Security Analysis​

# Find embedded credentials
strings suspicious_file | grep -E "password|passwd|secret"

# Extract file paths from malware
strings malware.exe | grep -E "^[A-Za-z]:\\|/"

# Find network addresses
strings binary | grep -E "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}"

# Identify compiler information
strings program | grep -i "gcc\|clang\|visual studio"

Advanced Usage​

File Format Identification​

# Identify file type from embedded strings
strings unknown_file | head -20

# Extract metadata from images
strings image.jpg | grep -E "JPEG|EXIF|Camera"

# Find document properties
strings document.pdf | grep -E "Title|Author|Creator"

# Extract archive contents list
strings archive.zip | grep "\.txt$|\.doc$|\.pdf$"

Data Recovery​

# Extract text from corrupted document
strings corrupted.doc > recovered_text.txt

# Recover data from damaged filesystem image
strings disk_image.dd | grep -E "email|address|phone"

# Extract readable content from memory dump
strings memory.dmp > memory_strings.txt

# Find SQL queries in database files
strings database.mdb | grep -i "select\|insert\|update"

Development and Debugging​

# Extract debug information from compiled code
strings -a program.o | grep -i debug

# Find function names in library
strings library.so | grep -E "^_?[A-Za-z_][A-Za-z0-9_]*"

# Extract embedded resources
strings resource.dll | grep -E "\.bmp$|\.wav$|\.txt$"

# Check for hardcoded constants
strings program | grep -E "[0-9]{1,6}|[0-9a-fA-F]{8}"

Real-World Applications​

Malware Analysis​

# Extract C2 server addresses
strings malware.exe | grep -E "https?://|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}"

# Find API function calls
strings malware.dll | grep -E "^Advapi\|^Kernel32\|^User32"

# Identify packing/obfuscation tools
strings packed.exe | grep -i "upx\|packed\|obfuscated"

# Extract encryption keys or certificates
strings suspicious.bin | grep -E "BEGIN CERTIFICATE|PRIVATE KEY"

Forensics​

# Extract URLs from browser cache
strings browser_cache.dat | grep -E "https?://"

# Find file names in disk images
strings disk.img | grep -E "\.(exe|txt|doc|pdf)$"

# Recover email addresses
strings email_archive.dat | grep -E "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}"

# Extract system information
strings memory_dump | grep -E "Windows|Linux|MAC Address|Serial Number"

Software Development​

# Extract version information
strings application.exe | grep -E "[0-9]+\.[0-9]+\.[0-9]+"

# Find embedded license information
strings program | grep -i "license\|copyright\|gpl\|mit"

# Extract build configuration
strings compiled_app | grep -E "DEBUG|RELEASE|OPTIMIZED"

# Check for hardcoded configuration
strings config_binary | grep -E "host|port|password|api_key"

Special Use Cases​

Embedded Systems​

# Extract firmware version
strings firmware.bin | grep -i "version|firmware"

# Find device information
strings embedded_app.bin | grep -E "model|serial|vendor"

# Extract network configuration
strings router_firmware.bin | grep -E "192\.168|ssid|password"

Database Analysis​

# Extract table names from database file
strings database.db | grep -E "CREATE TABLE|INSERT INTO"

# Find column names
strings database.mdb | grep -E "^[a-zA-Z_][a-zA-Z0-9_]*$"

# Recover SQL queries
strings corrupted_db | grep -i "select\|insert\|update\|delete"

Integration with Other Tools​

Pipeline Combinations​

# Extract and sort unique strings
strings program.exe | sort -u

# Count string occurrences
strings data.bin | sort | uniq -c | sort -nr

# Filter for specific patterns
strings binary | grep -E "^[A-Z][a-z]+$"

# Extract and save to files
strings -f *.exe | awk '{print $1 > $2}'

Automated Analysis​

# String analysis script
#!/bin/bash
for file in *.exe; do
    echo "=== $file ==="
    strings "$file" | grep -i "version\|copyright\|error"
    echo "---"
done

# Extract all email addresses
find . -name "*.dat" -exec strings {} \; | grep -E "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" | sort -u

Performance Considerations​

Large File Processing​

# Process specific sections only
strings -a -n 10 huge_file.bin

# Limit output length
strings binary_file | head -1000

# Process in parallel for multiple files
for file in *.bin; do strings "$file" > "${file}.strings" & done
wait

Memory Usage​

# Filter as you extract
strings large_binary | grep -m 100 "pattern"

# Extract to file then process
strings binary_file > all_strings.txt
grep "pattern" all_strings.txt

Troubleshooting​

Common Issues​

# Not finding expected strings - try different encoding
strings -e l binary_file
strings -e B binary_file

# Short strings - reduce minimum length
strings -n 1 binary_file

# Binary data in text - use proper filtering
strings file | grep -v "[^[:print:][:space:]]"

Character Encoding​

# Try multiple encodings
strings -e s -e S -e l file.bin

# Extract Unicode strings
strings -e l unicode_file.bin

# Handle mixed encoding files
strings -a file.bin | iconv -f latin1 -t utf8
  • hexdump - Display file contents in hexadecimal
  • od - Octal dump
  • file - Determine file type
  • grep - Search for patterns in files
  • xxd - Hexdump and reverse

Best Practices​

  1. Use appropriate minimum string length to avoid noise
  2. Filter output with grep for meaningful analysis
  3. Try different encodings for international applications
  4. Use -f option when processing multiple files
  5. Consider using -a for complete file scanning
  6. Combine with other tools for advanced analysis

Security Considerations​

When analyzing unknown or potentially malicious files:

# Extract strings safely in isolated environment
strings suspicious_file | grep -E "url|password|key" > strings_analysis.txt

# Look for suspicious patterns
strings malware.exe | grep -E -i "cmd\.exe|powershell|registry"

# Check for embedded executables
strings data.bin | grep -E "MZ\x90\x00"

The strings command is an essential tool for binary file analysis, reverse engineering, and data recovery. It provides valuable insights into file contents and structure, making it indispensable for system administrators, security professionals, and developers working with binary data.

Sponsors:DigitalOceanVultrSetappCloudflare