4 ms·

I'm a regular user of this utility and this came as a complete surprise to me. So much so that I checked the source myself before believing the article. I thou

by avian 12y ago

I'm a regular user of this utility and this came as a complete surprise to me. So much so that I checked the source myself before believing the article. I thought "strings" was just a dumb scan over the file. Does this mean that with a properly crafted binary it is also possible to hide strings from a quick check with "strings"?

gwern 12y ago
Based on the man page, I'm going to guess yes: -a --all - Do not scan only the initialized and loaded sections of object files; scan the whole files. Both the name and description imply that by default it won't scan the whole thing.
eli 12y ago
Yes, though a properly crafted binary has always been able to hide from strings with even a minimal amount of obfuscation or encryption. There's no way to know all the strings a program can output without running it.
- avian 12y ago
  Of course, a properly crafted program can always arbitrarily obfuscate strings. But if you manage to trick libbfd into thinking it's looking at a particular format, you can hide plain text from a simple "strings" invocation even in files that are not executable. I've been using "strings" on all kinds of files, not only executables, and assumed that it will always display all sequences of printable characters present in the file.
  - eli 12y ago
    Ah, I see. Fair enough, but I don't think it was ever a great assumption that "strings" would uncover all the text in a file. There are so many ways to screw with a file at the byte level that could confuse "strings" but still appear fine when read by an application.
- revelation 12y ago
  If you solve the problem of determining all output strings of a given program with running it, please leave a message ;)
  - chime 12y ago
    cough https://en.wikipedia.org/wiki/Halting_problem https://en.wikipedia.org/wiki/Halting_problem cough
    - repsilat 12y ago
      Sure, you can reduce it down to the Halting Problem, but it's much simpler just to invoke Rice's Theorem. http://en.wikipedia.org/wiki/Rice's_theorem http://en.wikipedia.org/wiki/Rice's_theorem
saurik 12y ago
This tool has always, going way back to at least BSD 4.3 (if not earlier), been a tool for dumping the strings table of a binary object, which just so happened to also have a fallback mode for things it didn't know how to parse as an object file.

by avian 12y ago

gwern 12y ago

Based on the man page, I'm going to guess yes: -a --all - Do not scan only the initialized and loaded sections of object files; scan the whole files. Both the name and description imply that by default it won't scan the whole thing.

eli 12y ago

Yes, though a properly crafted binary has always been able to hide from strings with even a minimal amount of obfuscation or encryption. There's no way to know all the strings a program can output without running it.

avian 12y ago
Of course, a properly crafted program can always arbitrarily obfuscate strings. But if you manage to trick libbfd into thinking it's looking at a particular format, you can hide plain text from a simple "strings" invocation even in files that are not executable. I've been using "strings" on all kinds of files, not only executables, and assumed that it will always display all sequences of printable characters present in the file.
- eli 12y ago
  Ah, I see. Fair enough, but I don't think it was ever a great assumption that "strings" would uncover all the text in a file. There are so many ways to screw with a file at the byte level that could confuse "strings" but still appear fine when read by an application.
revelation 12y ago
If you solve the problem of determining all output strings of a given program with running it, please leave a message ;)
- chime 12y ago
  cough https://en.wikipedia.org/wiki/Halting_problem https://en.wikipedia.org/wiki/Halting_problem cough
  - repsilat 12y ago
    Sure, you can reduce it down to the Halting Problem, but it's much simpler just to invoke Rice's Theorem. http://en.wikipedia.org/wiki/Rice's_theorem http://en.wikipedia.org/wiki/Rice's_theorem

saurik 12y ago

This tool has always, going way back to at least BSD 4.3 (if not earlier), been a tool for dumping the strings table of a binary object, which just so happened to also have a fallback mode for things it didn't know how to parse as an object file.