Extracting strings

The first thing an analyst does with an unknown executable is pull out its strings, and that's exactly what the well-known strings tool does. Error messages, file names, URLs and any words written into the code stay inside the program as readable text among bytes you can't read.

The idea is simple. A printable ASCII character is anything from 0x20, the space, to 0x7e, the tilde ~. You walk through the bytes and collect every unbroken run of printable characters, and as soon as a non-printable byte comes along, the run ends. Random data contains a printable character or two by chance, so you drop any run shorter than a minimum length, which is four by default in strings:

blob = 00 01 'HELLO' 00 'ab' ff 'secret_key' 00
extract(blob)              ['HELLO', 'secret_key']
extract(blob, min_len=2)   ['HELLO', 'ab', 'secret_key']

Watch the end of the data: if it runs out while you're inside a long enough run, that's a string too, so don't forget it after the loop.