This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
By Mark Russinovich
Published: June 22, 2021
Download Strings (534 KB)
Working on NT and Win2K means that executables and object files will many times have embedded UNICODE strings that you cannot easily see with a standard ASCII strings or grep programs. So we decided to roll our own. Strings just scans the file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more UNICODE (or ASCII) characters. Note that it works under Windows 95 as well.
Usage:
strings [-a] [-f offset] [-b bytes] [-n length] [-o] [-q] [-s] [-u] <file or directory>
Strings takes wild-card expressions for file names, and additional command line parameters are defined as follows:
| Parameter | Description |
|---|---|
| -a | Ascii-only search (Unicode and Ascii is default) |
| -b | Bytes of file to scan |
| -f | File offset at which to start scanning. |
| -o | Print offset in file string was located |
| -n | Minimum string length (default is 3) |
| -s | Recurse subdirectories |
| -u | Unicode-only search (Unicode and Ascii is default) |
| -nobanner | Do not display the startup banner and copyright message. |
To search one or more files for the presence of a particular string using strings use a command like this:
strings * | findstr /i TextToSearchFor
Download Strings (534 KB)
Runs on:
Documentation
Sysinternals Suite - Sysinternals
The Windows Sysinternals troubleshooting Utilities have been rolled up into a single suite of tools.
Windows Stress test utility.
VMMap is a process virtual and physical memory analysis utility.
Training
Module
Work with data in Microsoft Sentinel using Kusto Query Language - Training
Work with data in Microsoft Sentinel using Kusto Query Language