Skip to content

strings Command Cheat Sheet

strings prints the sequences of printable characters in files. It is primarily used for determining the contents of non-text files (binaries, executables, memory dumps).

Synopsis

strings [options] [file]

Basic Usage

Scan a Binary

strings /bin/ls
This outputs thousands of lines. Pipe it to less.

strings /bin/ls | less

Search for Content

Find help text or version info inside a binary.

strings /bin/ls | grep "Copyright"

Options

Minimum String Length (-n)

Default is 4 characters. To see only longer strings (e.g., 10 chars):

strings -n 10 image.jpg
Reduces noise significantly.

Show the location (offset) of the string in the file.

  • -t d: Decimal
  • -t x: Hexadecimal
strings -t x program.exe
# Output:
# 104a  Hello World

Scan Entire File (-a)

By default, strings may only scan initialized and loaded sections of object files. -a scans the whole file.

strings -a firmware.bin

Encoding (-e)

Select the character encoding of the strings.

  • s: 7-bit (default)
  • S: 8-bit
  • b: 16-bit bigendian
  • l: 16-bit littleendian
# Good for Windows wide-character strings (UTF-16)
strings -e l windows_program.exe

Common Use Cases

Malware Analysis

Checking a suspicious binary for URLs or IPs.

strings suspicious_file | grep "http"

Forensics

Recovering text from a raw disk image or memory dump.

strings -n 8 /dev/sda1 | grep "password"

Checking Compiler/Packer

strings binary | grep "GCC"
strings binary | grep "UPX"

Notes

  • Noise: Expect a lot of garbage output if the minimum length is low (-n 4). Increasing it to 8 or 10 cleans up the results.