strings

display printable strings in binary files 

Command

SYNOPSIS

strings [-aNopxz] [-n number] [-s seclist] [-t format] [-U[b|B|l|L]] [file ...]

strings [-] [-Nopxz] [-s seclist] [-t format] [-number] [-U[b|B|l|L]] [file ...]

DESCRIPTION

The strings utility displays strings of printable characters found in the specified files. These strings are at least four characters long and must be terminated by a NUL character or a newline. If you specify a file name of - or no file names at all, strings reads the standard input. This utility finds interesting pieces of information in binary files. It is frequently used for looking through executable files to uncover copyright notices, error messages, undocumented features, and so on.

Options

-a 

examines all of an executable file; normally strings ignores the header and the symbol table. On systems with sufficient information in executable files to differentiate code from data, the code is normally ignored as well.

-N 

considers extended ASCII characters (mostly European accented characters and punctuation) as printable. If the top bit of a character is set, it is normally disqualified as a printable character.

-n number 

displays strings of printable characters that are at least number characters in length.

-o 

displays each string with its octal offset within the file. This is the same as -t o.

-p 

only examines the bottom seven bits of each character.

-s seclist 

specifies a comma-separated list of file sections to search for strings. Each item in the list is case-insensitive and can be one of the following: 

TEXT	read only code and static strings (of absolute origin)
DATA	initialized data (of absolute origin)
BSS	uninitialized data
SYM	symbol table
RELT	read only code and static strings (of run-time relocatable origin) 
RELD	initialized data (of run-time relocatable origin)
STACK	function call stack
OTHER	any other type of section

You can specify multiple -s options. All seclist values are treated as if they were specified in a single list.

When -s is not specified, the value of the TK_STRINGS_DEFAULT_SECTIONS determines which sections are searched. When that variable is unset, the DATA section is searched by default.

-t format 

displays each string with an offset within the file. The base of the offset is set to decimal, octal, or hexadecimal by specifying format as d, o, or x, respectively.

-U[b|B|l|L] 

searches for and displays strings of 16-bit Unicode characters.

By default, strings assumes that Unicode characters are little-endian. If a byte-order marker is present, that is used to determine the byte order for the characters. You can force Unicode characters to be treated as big-endian by specifying -Ub or -UB. Similarly, you can force them to be treated as little-endian by specifying -Ul or -UL.

This option cannot be used with -p or -N.

-x 

displays each string with its hexadecimal offset within the file. This is the same as -t x.

-z 

ignores the POSIX definition of a string, and searches for any group of printable characters greater than four in length.

- 

is the obsolete version of -a.

-number 

is the obsolete version of -n number.

ENVIRONMENT VARIABLES

TK_STRINGS_DEFAULT_SECTIONS 

contains a comma-separated list of file sections to search for strings. Each item in the list is case-insensitive and can be one of the following: 

TEXT    read only code and static strings (of absolute origin)
DATA    initialized data (of absolute origin)
BSS     uninitialized data
SYM     symbol table
RELT    read only code and static strings (of run-time relocatable origi
n)
RELD    initialized data (of run-time relocatable origin)
STACK   function call stack
OTHER   any other type of section

When no -s is specified, the value of this environment variable determines which sections are searched. When it is unset, the DATA section is searched by default.

DIAGNOSTICS

Possible exit status values are:

0 

Successful completion.

1 

Failure due to any of the following:

— invalid command line option
— insufficient memory

PORTABILITY

POSIX.2. x/OPEN Portability Guide 4.0. Windows 8.1. Windows Server 2012 R2. Windows 10. Windows Server 2016. Windows Server 2019. Windows 11. Windows Server 2022.

A Berkeley addition to most UNIX systems. Most Berkeley versions do not require the terminating NUL or newline.

The -N, -o, -p, -U, -x and -z options are extensions to the POSIX standard.

NOTE

NUL-terminated strings are a convention used primarily by the C programming language. Other languages and programs may not terminate strings with a newline or NUL. The strings utility does not find these strings.

WARNING

By default, the strings utility begins its search at the data segment where the programs store initialized data. In bundled (dual-mode) executables, such as found on Windows systems or any executable format which stores data in an unconventional location, strings may perform an incomplete search. In these cases, use the -a option to force strings to search the entire executable.

AVAILABILITY

PTC MKS Toolkit for System Administrators
PTC MKS Toolkit for Developers
PTC MKS Toolkit for Interoperability
PTC MKS Toolkit for Professional Developers
PTC MKS Toolkit for Professional Developers 64-Bit Edition
PTC MKS Toolkit for Enterprise Developers
PTC MKS Toolkit for Enterprise Developers 64-Bit Edition

PTC MKS Toolkit 10.4 Documentation Build 39.