Hacker News Reader

Comment by tomrod | Hacker News Reader

> Aha! So this mysteriously-named /usr/sbin/eis3920 program is responsible for the decryption. eis3920 is an ARM binary, but running strings on it came up with some items of interest:

    ...
    /sys/devices/platform/omap/omap_i2c.2/i2c-2/2-0057/eeprom
    %s%s%s%s%s
    /home/root
    .ecryptfs
    sig-cache.txt
    ecryptfs_fnek_sig=
    %s%s%s%s%s%s%s%s%s%s%s%s
    mount -t ecryptfs

I'm at a bit of a loss here. What does he mean by "running strings on it"?

View on HN

Are you on linux? You might have it installed.

Try running:

  man strings

I get:

  strings - print the strings of printable characters in files.

https://linux.die.net/man/1/strings

Basically it will print out any strings of ascii charters in a file. Which in a binary usually represent string constants or "hard coded" strings that have not been obfuscated.

It's a program that spits out all the printable strings from a binary file.

https://en.wikipedia.org/wiki/Strings_(Unix)

EDIT: lol... we're all so helpful (4 replies all at '0 minutes ago' at the moment)

THIS! This is why I love hacker news. Much thanks for the pointer. I've never actually used (or, I believe, needed to directly use) strings before. Thanks so much.

Please be careful when running strings, if possible, don't, as it can be used as an attack surface. Just take a look at CVE-2014-8485 if you need clarification.

Thank you for the heads up.

Sysinternals has a Windows equivalent[1]. Although most of the hex editors[2][3] have an in-built strings dumping functionality.

[1] https://technet.microsoft.com/en-us/sysinternals/strings.asp...

[2] https://www.safer-networking.org/products/filealyzer/

[3] http://www.catch22.net/software/hexedit

'strings' is a standard *nix command for reading a binary file and displaying only the chunks of data that appear to be ASCII character strings.

strings is a Unix program that prints out all the ASCII strings it finds in an arbitrary file. It is very handy for examining random programs.

https://linux.die.net/man/1/strings

Crazy, I've never heard of this before.

Could I use this on random Windows exe files if I'm running a linux box? EXE files are just compiled binary blogs, right?

>compiled binary blogs

That, or view/edit them with a hex editor.

Yep - useful on any kind of binary. I've used strings on exes, pdfs, database files...

Blobs, not blogs. Darn autocorrect.

Yes, you can run strings on a Windows exe from Linux or a Mac. I just tried this and it gives everything from "!This program cannot be run in DOS mode." to DLL names to Windows function names. However, Windows text strings that get displayed are 16-bit so you need the "-e l" flag to see them; this flag works on Linux but not Mac.

TL;DR: running strings on an exe is trickier than I expected, but works.

JFYI there is a little (35 Kb) and little known free tool for Windows (by McAfee, I know, I know) that is very easy to use/convenient:

http://www.mcafee.com/it/downloads/free-tools/bintext.aspx

(a number of hex editors AFAIK want you to specify if ASCII or Unicode)

Reply on news.ycombinator.com