strings command

 

strings

Purpose

The strings command is used to extract and display readable text (ASCII or Unicode strings) from binary files, such as executables, object files, or core dumps.

It’s very useful to:

• Find hidden text or messages inside compiled programs or data files

• Inspect binaries for debugging or reverse engineering

• Check what libraries, error messages, or paths a binary uses

---

🧩 Basic Syntax

strings [options] filename

If used without options, strings prints all readable text sequences of 4 or more characters found in the file.

---

🧪 Example 1: Using strings on an Executable

Suppose you have a compiled C program:

gcc -o hello hello.c

Now run:

strings hello

Example Output:

/lib64/ld-linux-x86-64.so.2
libc.so.6
Hello, world!
printf
__libc_start_main
GLIBC_2.2.5

🧩 Explanation:

• It shows text strings inside the binary file.

• You can see library names (libc.so.6), system paths, and even your program’s output string ("Hello, world!").

---

🧪 Example 2: Using strings on Any File

You can also run it on a non-text file:

strings image.png | head

This will display readable text within the image file, such as:

• File metadata

• Author name

• Software used to create the image

---

🧩 Example 3: Searching for Specific Strings

Combine strings with grep to find specific text patterns.

strings a.out | grep "error"

This filters and shows only lines containing the word “error”.

---

🧩 Example 4: Minimum String Length

By default, strings prints sequences of 4 or more characters.
You can change this with the -n option:

strings -n 6 myfile

This will print only strings 6 characters or longer.

---

🧩 Example 5: Show Offset of Each String

strings -t d myfile

This prints the byte offset (in decimal) where each string occurs in the file.

Example output:

1234 Hello
2056 File not found
4120 /usr/lib/libc.so

Here, the numbers represent the positions in the binary file where each string starts.

---

🧩 Example 6: Reading from Standard Input

You can pipe data into strings:

cat myfile | strings

---

🧾 Useful Options Summary

Option	Description
-a	Scan the entire file (default)
-n <number>	Minimum string length (default = 4)
-t <format>	Print offset (format: d=decimal, o=octal, x=hex)
-e <encoding>	Specify character encoding (e.g., s=single-byte, l=16-bit little-endian)
-f	Print the filename before each string (useful with multiple files)

---

🧠Summary

• It demonstrates how executables and binary files still contain human-readable data.

• Helps students see the difference between source code and compiled output.

• Useful for understanding binary inspection, debugging, and security basics.

• Builds a foundation for reverse engineering concepts later in the course.

---

🧪 Simple Lab Exercise

Task:

1. Write a C program that prints a message and compile it:

   #include <stdio.h>
   int main() {
       printf("Operating System Lab Test\n");
       return 0;
   }
   

   gcc -o test test.c
   

2. Use the strings command:

   strings test | grep "Operating"
   

3. Observe how your program’s message appears inside the compiled binary.