2

This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive.

What I`m looking for is to build what Strings does from Sysinternals. My goal is to read any windows binary files and extract all the strings ASCII/UNICODE in a fast and efficient way.

At the moment I`m opening the file from disk, reading into a buffer, and then assigning that buffer into a vector and using booyer_moore search. This operation is pretty CPU expensive, especially when the file is big (a few mb) and because the code searches through "everything".

I've found this https://github.com/glmcdona/strings2 but it does not support x64 due to the approach taken, and I cannot seem to find any source code for the Sysinternals tool.

Would it be possible to show me (even some pseudo code) on how to approach this matter?

1 Answer 1

3

If all you're trying to do is replicate what the SysInternals project does, the strings2 project you linked does that and should suit your purposes. The x86/x64 thing is only for a special extraction mode they added, which is separate from the functionality of SysInternals Strings.

On the other hand, if you do need to extract strings stored more sneakily (stack, obfuscation etc.), take a look at FLOSS.

1
  • I don't really understand what's going on in that "strings2" project, everything is everywhere... and a ton of code for no reason. I was thinking of something much simpler, looking "inside" of sysinternals strings project (at least the very old one), the author makes use of _ismbcprint, IsCharAlphaNumericW and other things in just a couple of lines.
    – Mecanik
    Apr 16, 2021 at 6:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.