All right.
Welcome back.
We are going to mess around with strings today.
Now according to the textbook, as always, it is a utility and cybersecurity to analyze binary and
executable files for human readable text, i.e. strings.
We can use those strings in a variety of ways, but realistically, most of the time we're using it
for malware analysis, right?
We're looking for data that allows us to better understand what the program or what the application
is doing within the binary code.
Right.
So it really provides us with a glimpse into the artifacts or the specific details associated within
the program that we're analyzing.
Now, we're not going to go too far into depth of this, but I am going to show you a couple of commands
that you need to understand, or you need to know in order to better, uh, equip yourself to pass the
Cisa exam.
So to do that, I went ahead and downloaded a program already.
We're going to go up to our terminal like this.
I'm going to blow this up so you can see it.
There we go.
We should be able to see that.
And I need to get into the right folder of course.
Right.
So I'm going to do CD downloads.
And we used Minecraft for this specific lab.
So I just downloaded Minecraft.
No I didn't install it.
I didn't install it on Linux.
I actually believe it or not, I haven't played Minecraft in like 20 years.
Well, I shouldn't say this feels like 20 years, right?
Um, but we're going to dissect it today.
Okay.
So the first command we're going to do is just a simple strings.
And we're going to equip it back into that Minecraft just like that.
And it provides us some basic information.
Now, I know it doesn't look like you can read it because you kind of can't, but it outputs all the
strings within the executable, all the binary data.
Now there's maybe too much here.
And so what we want to do is we want to get this data to a portion where we can read it.
Maybe, for instance, we only need data.
That is at least let's say ten characters in length.
So I'm going to do a tac n ten and then we'll do that Minecraft dot dab right there.
So this is going to look for all this data that I already pulled up.
And it has to be a minimum of ten characters in length because I did a TAC in with a ten.
Now you can see here that it's providing that.
And I also want to point out I want to point out this right up here.
Right.
See this right here.
All this blanks are these spaces I should say it's character length.
Right.
So that means if somebody put a space in there then that counts as that ten character length.
However, maybe this isn't enough data.
Maybe we're looking at this and we're going, you know what?
That's just not enough.
Let's shorten this down.
Now instead of ten, we can do five, right.
We could also do eight.
We could do seven, we could do six.
We can do whatever we want.
We there's no requirement on there okay.
But that's the first one I wanted to show you.
The next one I wanted to show you is a, tak a, tak a, or switch a depending on how you read it.
And again where to do Minecraft.
Deb and this is going to look for the Ascii two strings within the file.
So anything that's Ascii two and you can see not much changed in our in random assortment of random
numbers and characters throughout this, but the Ascii two that is going to be a tak a.
The last one I want to show you is if we want to, uh, if we want to have a custom separator, right.
If we want to separate or to look within the program for a specific separator within it.
Right.
Maybe, maybe we're keen to understand that I could do strings, I can do a tac or a switch S and then
I can provide brackets like this if I wanted to.
And then Minecraft dot Deb just like that.
And you can see here that it's providing me all that juicy brackets or spaces or I should say, the
custom separators associated with it.
Now it doesn't have to be brackets, right?
I could do instead of brackets I could do well do that.
Right.
And again you can see here that it's providing me those custom separators okay.
So those are the three that I really wanted to show you to really kind of look at it now size.
Plus they're not going to ask you to go through and start typing in these commands.
Right.
But it would be a good idea to understand the basics of the three that I showed you.
And to understand that what a string actually is trying to accomplish, which if you don't remember,
strings are looking for data within a binary or it's more appropriate.
It's looking for bits, bits within data, right?
Specifically within binary or within executable files.
Right.
And that's all we're trying to accomplish with that.
Right.
So that's strings.
Uh, we will see you next time Thanks.