String Searches in Linux

By use of the strings command we can search the memory image for ASCII or Unicode strings, the output can be written to a text file and further searched for keywords or can be filtered down using grep. The below example searches the image file for ASCII text and lists the byte offset writing the output to a file called winmem.img.ascii.str.



A Unicode string search can be achieved with the following command;

srch_strings -o winmem.img > winmem.img.uni.str

-o list byte offset in the file

GREP

Grep can be used to narrow down the search further by either piping strings to grep or using grep on the strings output file.




grep -i [search term] winmem.img

-i ignore case


To use a list of grep expressions and or keywords;

grep -i -f [keyword list file name] winmem.img

-f path to word list

grep -i -f keywords.txt winmem.img