4 ms·

>[strings] is an ancient (mid-1980s) program that simple extracts human readable strings out of a binary file, discarding the rest. It's really a stupid simple

by im2w1l 12y ago

>[strings] is an ancient (mid-1980s) program that simple extracts human readable strings out of a binary file, discarding the rest. It's really a stupid simple program. No it isn't. http://lcamtuf.blogspot.se/2014/10/psa-dont-run-strings-on-untrusted-files.html http://lcamtuf.blogspot.se/2014/10/psa-dont-run-strings-on-u...

lucb1e 12y ago
Then again, he did let the 'malware' infect himself. (Ghetto reversing as he calls it.) I'm pretty sure it wouldn't be a big deal if strings failed... but you still have a good point!
- tomjen3 12y ago
  My guess is that he ran in a vm, at least that is what I would do.
Someone1234 12y ago
No it isn't, what? Nothing he said discounts what you added. You should have just said "be careful with strings" and linked your link, rather than making some vague hand waving correction which wasn't...
- im2w1l 12y ago
  It isn't a dumb and simple program. It does a lot of complicated stuff under the hood, and it is good to be aware of that.
  - mynameisvlad 12y ago
    It's simple in what it does, which is what the OP was going for. He never really made any claims of it being simple in how it does it.
  - geofft 12y ago
    It's not a complicated thing it does at all: it uses the standard system facilities for opening an object file to scan through the data section instead of the entire file. In the '80s, it used a.out format, which was dead simple. Today, GNU strings uses the GNU libbfd library, which is quite a bit more complicated, although the fundamental process of parsing an ELF file is also not that complicated. The actual problem here is that such a dumb simple task as parsing an ELF file isn't something you'll do without vulnerabilities, if you're not paying attention to vulnerabilities. Run `man elf` on your favorite Linux system, and you'll see docs of <elf.h>, which you can use to read ELF files. Write something to just dump the text section -- it shouldn't take you more than like 30 lines of C. Then tell me how many integer overflows you managed to squeeze in those 30 lines. :)
rb12345 12y ago
It's worth noting though that this article used the MS/Sysinternals version of strings and not the binutils version in most Linux distros. The Sysinternals version is unlikely to be parsing ELF and the like. (One quick test: try "strings -n 2 cmd.exe" and see if the output starts with MZ.)

by im2w1l 12y ago

lucb1e 12y ago

Then again, he did let the 'malware' infect himself. (Ghetto reversing as he calls it.) I'm pretty sure it wouldn't be a big deal if strings failed... but you still have a good point!

tomjen3 12y ago
My guess is that he ran in a vm, at least that is what I would do.

Someone1234 12y ago

No it isn't, what? Nothing he said discounts what you added. You should have just said "be careful with strings" and linked your link, rather than making some vague hand waving correction which wasn't...

im2w1l 12y ago
It isn't a dumb and simple program. It does a lot of complicated stuff under the hood, and it is good to be aware of that.
- mynameisvlad 12y ago
  It's simple in what it does, which is what the OP was going for. He never really made any claims of it being simple in how it does it.
- geofft 12y ago
  It's not a complicated thing it does at all: it uses the standard system facilities for opening an object file to scan through the data section instead of the entire file. In the '80s, it used a.out format, which was dead simple. Today, GNU strings uses the GNU libbfd library, which is quite a bit more complicated, although the fundamental process of parsing an ELF file is also not that complicated. The actual problem here is that such a dumb simple task as parsing an ELF file isn't something you'll do without vulnerabilities, if you're not paying attention to vulnerabilities. Run `man elf` on your favorite Linux system, and you'll see docs of <elf.h>, which you can use to read ELF files. Write something to just dump the text section -- it shouldn't take you more than like 30 lines of C. Then tell me how many integer overflows you managed to squeeze in those 30 lines. :)

rb12345 12y ago

It's worth noting though that this article used the MS/Sysinternals version of strings and not the binutils version in most Linux distros. The Sysinternals version is unlikely to be parsing ELF and the like. (One quick test: try "strings -n 2 cmd.exe" and see if the output starts with MZ.)