Extract printable strings from binary data, similar to the strings command.
(self, data, min_length=4)
| 44 | self.kill = module_options["KILL"] |
| 45 | |
| 46 | def extract_strings(self, data, min_length=4): |
| 47 | """Extract printable strings from binary data, similar to the strings command.""" |
| 48 | results = [] |
| 49 | |
| 50 | # ASCII strings extraction |
| 51 | ascii_strings = re.findall(b"[ -~]{%d,}" % min_length, data) |
| 52 | for s in ascii_strings: |
| 53 | try: |
| 54 | results.append(("ASCII", s.decode("ascii"))) |
| 55 | except Exception as e: |
| 56 | self.context.log.fail(f"Failed extracting ASCII strings: {e}") |
| 57 | |
| 58 | # UTF-16LE strings extraction (common in Windows) |
| 59 | utf16_pattern = re.compile(b"(?:[\x20-\x7E]\x00){%d,}" % min_length) |
| 60 | utf16_strings = utf16_pattern.findall(data) |
| 61 | for s in utf16_strings: |
| 62 | try: |
| 63 | decoded = s.decode("utf-16-le") |
| 64 | results.append(("UTF-16LE", decoded)) |
| 65 | except Exception as e: |
| 66 | self.context.log.fail(f"Failed extracting UTF-16LE strings: {e}") |
| 67 | |
| 68 | return results |
| 69 | |
| 70 | def is_meaningful_content(self, string): |
| 71 | """Check if a string has meaningful content.""" |
no test coverage detected