Hi All,
While completing some work for a particular project, I was examining
various Win32 files (executables and DLL's) as well as a few MS Word
Documents.
I know that many applications store strings in Unicode format and
because I didn't RTFM, was frustrated that "strings" did not pick them
out... Well, at least it didn't used to pick them out and I've never
assumed different.
I noticed that Strings from the GNU binutils has the ability to find
16-bit strings, using the '-e' (encoding) option.
A quick Google revealed the following:
(http://www.cl.cam.ac.uk/~mgk25/ucs/strings.diff)
---=== Message from Markus Kuhn ===---
The "strings" tool in the GNU binutils-2.11.2 could only find strings
consisting of 8-bit characters. Therefore it was not useable for
finding 16-bit Unicode strings in Win32 EXE files or 32-bit wchar_t
strings in GNU/Linux binaries. The patch below adds a new option -e
with which "strings" can now also be used to locate 16/32-bit strings,
both big and little endian. I found that little extension extremely
useful and therefore hope you will add it to strings in the next
binutils release. I am the sole author of this patch and I hereby
donate it to the public domain.
Cheers,
Markus
--
Markus Kuhn, Computer Laboratory, University of Cambridge
http://www.cl.cam.ac.uk/~mgk25/ || CB3 0FD, Great Britain
---=== End of Message ===---
I have read many books and attended several forensic courses but as
yet, I haven't seen this option ever being pointed out - hence the
reason for this post.
No doubt there are some people who have been using this or a similar
technique for a while now, but hopefully this information will be
useful to some people.
The command: strings -e l <filename>
will output the 16-bit Unicode strings that are often found in Win32
files. (The 'l' is for little endian, which is going to be typical
for x86 files.)
If you haven't tried this option yet, give it a try on some Win32
files and you'll be surprised by how many strings are stored in
Unicode and how much information you can obtain. (Some VB projects
seems to give away the original location for the project on the
developer's machine!)
I hope this is of use to some people.
Kind regards
Byrne Ghavalas
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
