E-STR
strings
Pull printable text out of binaries, dumps, and firmware images.
OVERVIEW
strings is part of GNU binutils (sourceware.org/binutils). It scans a file for sequences of printable characters and prints them, which is often enough to surface a hardcoded URL, an API key pattern, a file path, or a debug banner inside a binary, minified blob, or firmware image before you open a disassembler.
`-n` sets the minimum length (8 is a common start). `-a` scans the whole file, not just initialized data. `-e` selects 16-bit encodings when you suspect a Windows binary. Pipe into grep or save the output next to the sample; do not treat a string that looks like a password as live until you have confirmed it in the running system.
USE CASES
Practical use cases
- 01
Skimming a vendor binary for URLs, paths, and version strings.
- 02
Pulling readable fragments out of a memory dump or core file.
- 03
Checking firmware or an IoT image for leftover credentials or endpoints.
- 04
Grepping extracted strings for key= / token / password patterns as leads.
QUICK START
When you have a binary, crash dump, or firmware image and need embedded URLs, keys, or error strings without a full reversing session.
- Confirm the file is in scope to inspect (binary, dump, or image).
- Run strings with a minimum length and save the output beside the sample.
- Grep for URLs, paths, and credential-like tokens; keep the raw list.
- Validate any suspected secret against the live system before reporting it as active.
strings -n 8 ./loot.binBEFORE YOU RUN IT
What to check before running it
A string that looks like a password may be a placeholder, an old value, or random bytes that happened to print — confirm before reporting it as a live credential.
Memory dumps and firmware can contain personal data; handle the extract under the same NDA as the rest of the loot.
Windows Sysinternals ships a different strings.exe; flags do not match GNU strings, so check which binary you invoked.