in reply to Re^2: Portable way to extract string from a binary (strings.pl)
in thread Portable way to extract string from a binary
Hmm, while I take your point about looking for null termination the code you present does not work for me. The first issue is this:
C:\>strings.pl myscript.exe Quantifier in {,} bigger than 32766 before HERE mark in regex m/([\n\t + -~]{ << HERE 4,32768})\0/
After reducing the $max value down to 32766 to keep the RE happy it fails to find 'This program cannot be run in DOS mode' which it certainly should:
C:\>strings.pl myscript.exe RES> .text `.rdata @.data 5@e@ C:\>type strings.pl my( $min, $max ) = ( 4, 32766 ); local( $/ ) = \(32*1024); my $prev = ''; while( <> ) { $prev .= $_; while( $prev =~ /([\n\t -~]{$min,$max})\0/g ) { print "$1\n"; } $prev =~ s/.*\0//s; }
The bug (on win32 and Mac) is not allowing \r. BTW it took me about 5 minutes to realise what ' -~' was doing :-) I have written it longhand octol for slow learners like me. There is a CRLF before the terminating $ in the assembly.
C:\>strings.pl myscript.exe !This program cannot be run in DOS mode. $ RES> .text `.rdata @.data 5@e@ C:\>type strings.pl my( $min, $max ) = ( 4, 32766 ); local( $/ ) = \(32*1024); my $prev = ''; while( <> ) { $prev .= $_; while( $prev =~ /([\t\r\n\040-\176]{$min,$max})\0/g ) { print "$1\n"; } $prev =~ s/.*\0//s; } C:\>
cheers
tachyon
|
|---|