How to view strings in an executable?

Question

I have been playing around, searching for Strings

  "Please wait!!!"
   "Done!!"

Then I didn't find them in a Debugger so somebody suggested BinText can do the job, so I found this

 File pos Mem pos ID Text 
 ======== ======= == ==== 
 0000000922E8 000000492EE8 0 Caption 
 00000009230A 000000492F0A 0 Checked 
 00000009232C 000000492F2C 0 SubMenuImages 
 000000092354 000000492F54 0 Default 
 000000092376 000000492F76 0 Enabled 
 000000092402 000000493002 0 ImageIndex 
 000000092426 000000493026 0 RadioItem 
 00000009244B 00000049304B 0 ShortCut 
 00000009246E 00000049306E 0 Visible 
  000000092490 000000493090 0 OnClick 

Here follows the troublesome strings

  0000000ED716 0000004EE316 0 EJPEG 
  0000000EEB97 0000004EF797 0 ;w8tF 
  0000000EFE33 0000004F0A33 0 C(D   O 
  0000000EFFA4 0000004F0BA4 0 T;{$| 
  0000000F002C 0000004F0C2C 0 T;{$| 
  0000000F004F 0000004F0C4F 0 ;K$|  
  0000000F0995 0000004F1595 0 ;K4w/ 
  0000000F09CF 0000004F15CF 0 ;K4w, 
  0000000F0A05 0000004F1605 0 ;K4w, 
  0000000F0A9D 0000004F169D 0 T;{$| 
  0000000F0AE4 0000004F16E4 0 T;{$| 
  0000000F1A11 0000004F2611 0 D$$PU 
  0000000F1D3B 0000004F293B 0 A;K$| 
  0000000F3377 0000004F3F77 0 0;C$| 
  0000000F3426 0000004F4026 0 K,;K(u 
  0000000F36DA 0000004F42DA 0 T$$;L$ 
  0000000F372D 0000004F432D 0 Jx;L$ 
  0000000F39C4 0000004F45C4 0 $;Zx| 
  0000000F3F52 0000004F4B52 0 t&ItZ 
  0000000F41E7 0000004F4DE7 0 D$$;T$ 
  0000000F41FB 0000004F4DFB 0 L$ ;\$ 
  0000000F4265 0000004F4E65 0 L$,;T$ 
  0000000F4279 0000004F4E79 0 L$(;\$ 
  0000000F42EE 0000004F4EEE 0 L$0;T$ 
  0000000F4363 0000004F4F63 0 L$4;T$ 
  0000000F43D2 0000004F4FD2 0 L$8;T$ 
  0000000F4441 0000004F5041 0 L$<;T$ 
  0000000F44E4 0000004F50E4 0 D$D;T$ 
  0000000F44F8 0000004F50F8 0 L$@;\$ 
  0000000F46C7 0000004F52C7 0 D$,;L$ 
  0000000F46DF 0000004F52DF 0 T$(;\$ 
  0000000F4740 0000004F5340 0 l$$B; 
  0000000F5466 0000004F6066 0 T;s$| 
  0000000F55A8 0000004F61A8 0 P$;T$ 
  0000000F56A4 0000004F62A4 0 P$;T$ 
  0000000F5767 0000004F6367 0 P$;T$ 
  0000000F58A3 0000004F64A3 0 rMtsJ 
  0000000F58D4 0000004F64D4 0 C4;CH 
  0000000F5940 0000004F6540 0 C4;CHr3

Are these real strings or they broken encrypted or something? How can I achieve this?

Answer 1

These are not real strings, thats just binary data that can be interpreted as strings. That's how tools like BinText work - by trying to evaluate any sequence of bytes as a string and accepts it as one when a threshold is passed (usually around 4 characters).

I'm not familiar with BinText, but the tool I frequently use for such tasks is 010 Editor (http://www.sweetscape.com/010editor). It's a really good text and hex editor and it has a free trial license. It can basically edit anything on your computer (text and binary files, hard drive, processes), has templates for parsing known file formats, scripts and advanced binary search options. The feature you're looking for is their "Find Strings" option that finds all strings regardless of formats and can be easily tuned with a few parameters.

Because strings may be represented in several formats having a tool that's aware of that and supports searching multiple formats simultaneously can be really helpful with these type of searches.

Obviously the strings may be obfuscated and in that case searching won't do, but that's a bit out of the scope of this question. Open another one and I'll answer that as well.

Answer 2

If you are running Linux, you can run the strings command to view the hardcoded strings within the binary you are analyzing.

Example:

$ strings my_executable

The strings program is also available for Windows here.

You would run it the same way you would on Linux:

C:> strings my_executable.exe

I would also like to point out that some strings are generated dynamically upon runtime only. If you are running Windows, you can use process hacker to view the strings in the process's memory.

If you are using process hacker, just select the process with the strings you want to find->Properties->Memory. Then, in the top right corner, you should see a strings... button. That will search for all strings in the process.

Also, those strings seem too short to be legitimate ones. Strings with about 10 characters will likely reveal information that you may find more relevant.

Answer 3

To search for strings you could always use radare2 once installed use a terminal to navigate to the directory the file is in then type rabin2 -z filename

Answer 4

I recall Virustotal shows you all strings in a sample you upload.