042_逆向工程必备工具：Linux strings命令详解与二进制文件字符串分析实战指南

strings [选项] [文件...]

strings 文件名

strings /bin/ls

strings /lib/libc.so.6

strings /bin/cat /bin/grep

strings /bin/ls | grep -i error

strings -n 2 /bin/ls

strings -n 8 /bin/ls

strings -t x /bin/ls

000023c0 $Id: ls.c 8865 2018-06-14 14:48:51Z iozef@gnu.org $
000023f0 This is %s, version %s
00002420 Report bugs to <bug-coreutils@gnu.org>.
...

strings -t d /bin/ls

strings -t o /bin/ls

strings -e l /bin/ls

strings -e b /bin/ls

strings -e L /bin/ls  # 小端序
strings -e B /bin/ls  # 大端序

strings -a /bin/ls

strings -d /bin/ls

strings -f /bin/cat /bin/grep /bin/ls

/bin/cat: $Id: cat.c 8865 2018-06-14 14:48:51Z iozef@gnu.org $
/bin/cat: This is %s, version %s
/bin/grep: $Id: grep.c 8865 2018-06-14 14:48:51Z iozef@gnu.org $
/bin/grep: This is %s, version %s
/bin/ls: $Id: ls.c 8865 2018-06-14 14:48:51Z iozef@gnu.org $
...

strings -ftx /bin/cat /bin/grep

strings -n 10 -tx /bin/ls

strings -e l -tx /bin/ls

# 查找包含"password"或"key"的字符串
strings /bin/someapp | grep -i "password\|key"

# 查找可能的URL
strings /bin/someapp | grep -E "http://|https://|ftp://"

# 查找可能的文件路径
strings /bin/someapp | grep -E "/[a-zA-Z0-9_./-]+
"```

#### 与sort和uniq组合查找唯一字符串

```bash
# 查找唯一的字符串并排序
strings /bin/ls | sort | uniq

# 计算重复字符串的出现次数
strings /bin/ls | sort | uniq -c | sort -nr

# 统计文件中的字符串数量
strings /bin/ls | wc -l

# 统计包含特定模式的字符串数量
strings /bin/ls | grep "error" | wc -l

# 分析目录中所有可执行文件的字符串
find /bin -type f -executable -exec strings {} \; | grep "version"

# 分析指定类型的文件
find /usr/lib -name "*.so" -exec strings {} \; | grep "copyright"

strings /bin/someapp | grep -E "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}"

strings /bin/someapp | grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}"

strings /bin/someapp | grep -E "[0-9]{4}[-/][0-9]{1,2}[-/][0-9]{1,2}"

strings mystery_app | head -20

strings mystery_app | grep -i "usage\|help\|usage:"

strings mystery_app | grep -i "error\|fail\|warning"

strings mystery_app | grep -E "/[a-zA-Z0-9_./-]+
"```

这可能会显示程序访问的文件和目录。

5. **查找URL和网络相关信息**：

```bash
strings mystery_app | grep -E "http://|https://|ftp://|socket|connect"

strings mystery_app | grep -i "password\|key\|secret"

Usage: mystery_app -i <input_file> -o <output_file> -e encrypt|decrypt [-k <key>]
Encryption/decryption utility v1.0
Error: invalid input file format
Error: incorrect password
Error: insufficient permissions
/tmp/mystery_cache/
encrypt_data()
decrypt_data()
verify_password()
http://update.mysteryapp.com/check

strings suspicious.exe | grep -i "virus\|worm\|trojan\|malware"

strings suspicious.exe | grep -E "http://|https://|ftp://|socket|connect|bind"

strings suspicious.exe | grep -i "createfile\|writefile\|deletefile\|movefile"

strings suspicious.exe | grep -i "registry\|regopenkey\|regsetvalue"

strings suspicious.exe | grep -i "createprocess\|terminateprocess\|inject"

strings suspicious.exe | grep -E "XOR|encrypt|encode|decode"

XOR encryption key: 0x5A
http://evil-command-center.com/cmd
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d "%APPDATA%\\system32\\updater.exe"
CreateProcessA
DeleteFileA
shell32.dll
kernel32.dll
GetProcAddress
LoadLibraryA

strings device_firmware.bin | head -50

strings device_firmware.bin | grep -i "version\|firmware\|build"

strings device_firmware.bin | grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}"

strings device_firmware.bin | grep -i "admin\|password\|user\|login"

strings device_firmware.bin | grep -E "ext[2-4]|squashfs|jffs2|ubifs"

strings device_firmware.bin | grep -i "console\|shell\|terminal"

Device Firmware v2.3.4 (Build 1234)
Default IP: 192.168.1.1
Default username: admin
Default password: admin123
Linux version 3.14.5
BusyBox v1.22.1 (2020-01-15 10:00:00 UTC) multi-call binary.
Available commands: [list of commands...]
/dev/mtdblock0
/jffs2/

strings challenge | grep -i "flag\|key\|password"

strings challenge | grep -E "[A-Za-z0-9+/]{20,}=*"  # 可能的Base64编码
strings challenge | grep -E "[0-9a-fA-F]{32,}"  # 可能的十六进制字符串

strings challenge | grep -i "hint\|clue\|solve"

strings challenge | grep -E "_[a-zA-Z0-9_]{5,}"

strings challenge | grep -E "0x[0-9a-fA-F]+"

Welcome to the CTF challenge!
To find the flag, you need to reverse this program.
The flag is encoded with a simple XOR cipher.
The key is: SECRET
Check the verify_flag() function.
Encoded flag: \\x04\\x02\\x15\\x13\\x1f\\x4a\\x51\\x4b\\x57\\x48\\x1e\\x0c\\x1a\\x18\\x4b\\x5a

strings complex_app | grep -E "\.so$|\.dll$"

strings complex_app | grep -i "qt\|gtk\|wxwidgets\|mfc"

strings complex_app | grep -i "version\|lib\|framework"

strings complex_app | grep -i "license\|copyright\|gpl\|mit"

Qt 5.15.0 (x86_64-little_endian-lp64 shared (dynamic) release build; by GCC 9.3.0)
libssl.so.1.1
libcrypto.so.1.1
libz.so.1
libpng16.so.16
This program uses Qt, which is licensed under the GNU Lesser General Public License (LGPL)
OpenSSL 1.1.1j  16 Feb 2021
Copyright (C) 2021 The Qt Company Ltd.

# 安装
pip install floss

# 使用
floss malware_sample.exe

# 提取所有字符串
rabin2 -z binary_file

# 提取Unicode字符串
rabin2 -Z binary_file

# 分析固件并提取字符串
binwalk -strings firmware.bin

# 1. 首先使用strings命令快速了解程序
strings program | grep -i "password\|key\|secret"

# 2. 使用Floss提取可能被混淆的字符串
floss program

# 3. 使用objdump查看程序的符号表
objdump -t program

# 4. 使用IDA Pro进行深入的静态分析
# (这一步需要在GUI环境中进行)

# 5. 使用GDB进行动态分析
gdb program

# 提取UTF-16小端序字符串
strings -e l binary_file

# 提取UTF-16大端序字符串
strings -e b binary_file

# 提取可能的UTF-16字符串（小端序）
hexdump -C binary_file | grep -E "( [0-9a-fA-F]{2})\1" | awk '{print $0}'

#!/bin/bash
# 一个简单的自动化字符串分析脚本

# 提取字符串并按长度排序
strings -n 8 "$1" | awk '{print length, $0}' | sort -nr > strings_sorted.txt

# 提取可能的URL
strings "$1" | grep -E "http://|https://|ftp://" > urls.txt

# 提取可能的文件路径
strings "$1" | grep -E "/[a-zA-Z0-9_./-]+
" > paths.txt

# 提取可能的电子邮件地址
strings "$1" | grep -E "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}" > emails.txt

# 提取可能的IP地址
strings "$1" | grep -E "([0-9]{1,3}\.){3}[0-9]{1,3}" > ips.txt

# 提取可能的密码或密钥
strings "$1" | grep -i "password\|key\|secret" > credentials.txt

echo "字符串分析完成。结果保存在以下文件中："
echo "- strings_sorted.txt: 按长度排序的所有字符串"
echo "- urls.txt: 可能的URL"
echo "- paths.txt: 可能的文件路径"
echo "- emails.txt: 可能的电子邮件地址"
echo "- ips.txt: 可能的IP地址"
echo "- credentials.txt: 可能的密码或密钥"

#!/usr/bin/env python3
# 一个更高级的自动化字符串分析脚本

import re
import subprocess
import argparse
from collections import Counter

# 定义正则表达式模式
URL_PATTERN = re.compile(r'http://|https://|ftp://')
PATH_PATTERN = re.compile(r'/[a-zA-Z0-9_./-]+')
EMAIL_PATTERN = re.compile(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}')
IP_PATTERN = re.compile(r'([0-9]{1,3}\.){3}[0-9]{1,3}')
CREDENTIAL_PATTERN = re.compile(r'password|key|secret|token', re.IGNORECASE)
HEX_PATTERN = re.compile(r'0x[0-9a-fA-F]+')
BASE64_PATTERN = re.compile(r'[A-Za-z0-9+/]{20,}=*')

# 分析函数
def analyze_strings(file_path):
    # 使用strings命令提取字符串
    result = subprocess.run(['strings', '-n', '6', file_path], 
                           capture_output=True, text=True)
    strings = result.stdout.split('\n')
    
    # 分析结果字典
    analysis = {
        'total_count': len(strings),
        'urls': [],
        'paths': [],
        'emails': [],
        'ips': [],
        'credentials': [],
        'hex_values': [],
        'base64_strings': [],
        'top_words': [],
        'length_distribution': Counter()
    }
    
    # 分析每个字符串
    for string in strings:
        if not string:
            continue
            
        # 记录长度分布
        analysis['length_distribution'][len(string)] += 1
        
        # 检查URL
        if URL_PATTERN.search(string):
            analysis['urls'].append(string)
        
        # 检查文件路径
        for match in PATH_PATTERN.finditer(string):
            analysis['paths'].append(match.group(0))
        
        # 检查电子邮件
        for match in EMAIL_PATTERN.finditer(string):
            analysis['emails'].append(match.group(0))
        
        # 检查IP地址
        for match in IP_PATTERN.finditer(string):
            analysis['ips'].append(match.group(0))
        
        # 检查凭据
        if CREDENTIAL_PATTERN.search(string):
            analysis['credentials'].append(string)
        
        # 检查十六进制值
        for match in HEX_PATTERN.finditer(string):
            analysis['hex_values'].append(match.group(0))
        
        # 检查Base64字符串
        if BASE64_PATTERN.search(string):
            analysis['base64_strings'].append(string)
    
    # 分析最常见的单词
    words = []
    for string in strings:
        words.extend(string.split())
    analysis['top_words'] = Counter(words).most_common(20)
    
    return analysis

# 输出结果
def print_analysis(analysis):
    print(f"总字符串数量: {analysis['total_count']}")
    print(f"URL数量: {len(analysis['urls'])}")
    if analysis['urls']:
        print("\n示例URL:")
        for url in analysis['urls'][:5]:
            print(f"  - {url}")
    
    print(f"\n文件路径数量: {len(analysis['paths'])}")
    if analysis['paths']:
        print("\n示例文件路径:")
        for path in analysis['paths'][:5]:
            print(f"  - {path}")
    
    print(f"\n电子邮件数量: {len(analysis['emails'])}")
    if analysis['emails']:
        print("\n发现的电子邮件:")
        for email in analysis['emails']:
            print(f"  - {email}")
    
    print(f"\nIP地址数量: {len(analysis['ips'])}")
    if analysis['ips']:
        print("\n发现的IP地址:")
        for ip in analysis['ips'][:5]:
            print(f"  - {ip}")
    
    print(f"\n潜在凭据字符串数量: {len(analysis['credentials'])}")
    if analysis['credentials']:
        print("\n潜在凭据字符串:")
        for cred in analysis['credentials'][:5]:
            print(f"  - {cred}")
    
    print(f"\n最常见的20个单词:")
    for word, count in analysis['top_words']:
        print(f"  - {word}: {count}次")

# 主函数
def main():
    parser = argparse.ArgumentParser(description='自动化字符串分析工具')
    parser.add_argument('file', help='要分析的文件路径')
    args = parser.parse_args()
    
    print(f"分析文件: {args.file}")
    analysis = analyze_strings(args.file)
    print_analysis(analysis)

if __name__ == "__main__":
    main()

# 第一步：基本分析
strings binary_file

# 第二步：添加长度过滤
strings -n 6 binary_file

# 第三步：显示偏移量
strings -tx binary_file

# 第四步：组合使用
strings -n 8 -tx binary_file

# 保存所有字符串到文件
strings -a binary_file > all_strings.txt

# 然后对保存的文件进行分析
grep -i "password" all_strings.txt
grep -E "http://|https://" all_strings.txt