3

I have two binaries. Both contain the string "precondition failed" (without the quotes).

The corresponding byte sequence 70 72 65 63 6C 65 64 00 is the same for both binaries. However, the bytes before and after the string are different.

Binary 1:

00000000000006E0  00 00 00 00 2F 00 00 00  70 72 65 63 6F 6E 64 69  ..../...precondi
00000000000006F0  74 69 6F 6E 20 66 61 69  6C 65 64 00 FF FF FF FF  tion failed.....
0000000000000700  69 6E 76 61 6C 69 64 20  61 72 67 75 6D 65 6E 74  invalid argument

Binary 2:

00000000000006E0  00 00 00 00 FF FF FF FF  70 72 65 63 6F 6E 64 69  ........precondi
00000000000006F0  74 69 6F 6E 20 66 61 69  6C 65 64 00 2F 00 00 00  tion failed./...
0000000000000700  69 6E 76 61 6C 69 64 20  61 72 67 75 6D 65 6E 74  invalid argument

For Binary 1, strings --encoding=S finds the "precondition failed".

For Binary 2, strings --encoding=S does not find the "precondition failed".

Why? Does it have to do with the enclosing bytes?

For both binaries, IDA Pro recognises only one version of "precondition failed" and says it is of type "C".

EDIT: I am working with GNU strings (GNU Binutils) 2.39

1 Answer 1

3

Works for me with strings version 2.37:

$ strings --encoding=S bin1.bin 
precondition failed
����invalid argument
$ strings --encoding=S bin2.bin 
����precondition failed
invalid argument
1
  • Indeed a bug, or different behavior, in 2.39. Feb 3, 2023 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.