Following on from the previous [DFIR TOOLS] posts.
- [DFIR TOOLS] Timeline Explorer, what is it & how to use!
- [DFIR TOOLS] AmcacheParser, what is it & how to use
- [DFIR TOOLS] AppCompatCacheParser, what is it & how to use!
This time I will speak about bstrings again from the Eric Zimmerman suite.
We will start with Erics description on its purpose:-
Find them strings yo. Built in regex patterns. Handles locked files.
What is bstrings?
Bstrings is a tool that lets you extract strings from pretty much everything, you can search for a single file or a full directory recursively.
You can set minimum and maximum lengths or even by alphabetically and where this is not unique in itself bstrings also has some additional features not found elsewhere such as regular expression searching, some useful built-in regex patterns, and string clean-up (trimming white space from the returned string), sorting. duplicate removal, and so on.
How do we use bstrings?
Well, it is pretty simple as you can see.
First, we open CMD and navigate to the folder and then type in bstrings.exe and you will see all the details like switches and examples.
And if you type the -p switch you will see a list of built in regular expression patterns.
So lets try it and i will look for any emails addresses in this document.
bstrings.exe -f “c:\Tools\bstrings\Running Kali Linux on an M1 Mac (1).docx” –lr email
- bstrings.exe – states to use the tool bstrings
- -f is to state the file path and name like “c:\Tools\bstrings\Running Kali Linux on an M1 Mac (1).docx”
- –lr is to look for regular expression like email
And as you see we get 1 hit on the document.
Here is more commands.
A better strings utility!
bstrings version 22.214.171.124 Author: Eric Zimmerman (email@example.com) https://github.com/EricZimmerman/bstrings a If set, look for ASCII strings. Default is true. Use -a false to disable b Chunk size in MB. Valid range is 1 to 1024. Default is 512 d Directory to recursively process. Either this or -f is required f File to search. Either this or -d is required m Minimum string length. Default is 3 o File to save results to p Display list of built in regular expressions q Quiet mode (Do not show header or total number of hits) s Really Quiet mode (Do not display hits to console. Speeds up processing when using -o) u If set, look for Unicode strings. Default is true. Use -u false to disable x Maximum string length. Default is unlimited ls String to look for. When set, only matching strings are returned lr Regex to look for. When set, only strings matching the regex are returned fs File containing strings to look for. When set, only matching strings are returned fr File containing regex patterns to look for. When set, only strings matching regex patterns are returned ar Range of characters to search for in 'Code page' strings. Specify as a range of characters in hex format and enclose in quotes. Default is [\x20 -\x7E] ur Range of characters to search for in Unicode strings. Specify as a range of characters in hex format and enclose in quotes. Default is [\u0020-\u007E] cp Code page to use. Default is 1252. Use the Identifier value for code pages at https://goo.gl/ig6DxW mask When using -d, file mask to search for. * and ? are supported. This option has no effect when using -f ms When using -d, maximum file size to process. This option has no effect when using -f ro When true, list the string matched by regex pattern vs string the pattern was found in (This may result in duplicate strings in output. ~ denotes approx. offset) off Show offset to hit after string, followed by the encoding (A=1252, U=Unicode) sa Sort results alphabetically sl Sort results by length Examples: bstrings.exe -f "C:\Temp\UsrClass 1.dat" --ls URL bstrings.exe -f "C:\Temp\someFile.txt" --lr guid bstrings.exe -f "C:\Temp\aBigFile.bin" --fs c:\temp\searchStrings.txt --fr c:\temp\searchRegex.txt -s bstrings.exe -d "C:\Temp" --mask "*.dll" bstrings.exe -d "C:\Temp" --ar "[\x20-\x37]" bstrings.exe -d "C:\Temp" --cp 10007 bstrings.exe -d "C:\Temp" --ls test bstrings.exe -f "C:\Temp\someOtherFile.txt" --lr cc --sa bstrings.exe -f "C:\Temp\someOtherFile.txt" --lr cc --sa -m 15 -x 22 bstrings.exe -f "C:\Temp\UsrClass 1.dat" --ls mui --sl
bstrings.exe -p to see the following list of built in Regular Expressions:
Name Description aeon Finds Aeon wallet addresses b64 Finds valid formatted base 64 strings bitcoin Finds BitCoin wallet addresses bitlocker Finds Bitlocker recovery keys bytecoin Finds ByteCoin wallet addresses cc Finds credit card numbers dashcoin Finds DashCoin wallet addresses (D*) dashcoin2 Finds DashCoin wallet addresses (7|X)* email Finds embedded email addresses fantomcoin Finds Fantomcoin wallet addresses guid Finds GUIDs ipv4 Finds IP version 4 addresses ipv6 Finds IP version 6 addresses mac Finds MAC addresses monero Finds Monero wallet addresses reg_path Finds paths related to Registry hives sid Finds Microsoft Security Identifiers (SID) ssn Finds US Social Security Numbers sumokoin Finds SumoKoin wallet addresses unc Finds UNC paths url3986 Finds URLs according to RFC 3986 urlUser Finds usernames in URLs usPhone Finds US phone numbers var_set Finds environment variables being set (OS=Windows_NT) win_path Finds Windows style paths (C:\folder1\folder2\file.txt) xml Finds XML/HTML tags zip Finds zip codes To use a built in pattern, supply the Name to the --lr switch