strings
Text processing
Usage
strings [file]Pulls printable text out of a binary; it grabs anything that looks like text, so most of the output is coincidence rather than meaning.
Common flags
| Flag | Meaning |
|---|---|
| -n | Report only runs of at least N characters; the default is 4 |
| -t | Print the offset in the file, as d, o or x |
| -a | Scan the whole file, not only the loaded sections |
| -o | BSD and macOS: prefix each hit with its decimal offset |
| -e | GNU: set the encoding, such as l for 16-bit little-endian |
Examples
strings app.bin | grep -i versionFinds a version string inside a binary.
strings -n 8 core.dumpOnly sequences of eight characters or more.
These were built to be piped together. Three joined commands are usually shorter than one that does everything.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does strings do?
Pulls printable text out of a binary; it grabs anything that looks like text, so most of the output is coincidence rather than meaning.
Q. How do I type it?
strings [file] — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
5 are listed here; the full set is in man strings. This command sits under Text processing.
Related commands
man page: man strings