Hacker News Reader

Comment by im2w1l | Hacker News Reader

>[strings] is an ancient (mid-1980s) program that simple extracts human readable strings out of a binary file, discarding the rest. It's really a stupid simple program.

No it isn't.

http://lcamtuf.blogspot.se/2014/10/psa-dont-run-strings-on-u...

View on HN

No it isn't, what?

Nothing he said discounts what you added. You should have just said "be careful with strings" and linked your link, rather than making some vague hand waving correction which wasn't...

It isn't a dumb and simple program. It does a lot of complicated stuff under the hood, and it is good to be aware of that.

It's simple in what it does, which is what the OP was going for. He never really made any claims of it being simple in how it does it.

It's not a complicated thing it does at all: it uses the standard system facilities for opening an object file to scan through the data section instead of the entire file. In the '80s, it used a.out format, which was dead simple. Today, GNU strings uses the GNU libbfd library, which is quite a bit more complicated, although the fundamental process of parsing an ELF file is also not that complicated.

The actual problem here is that such a dumb simple task as parsing an ELF file isn't something you'll do without vulnerabilities, if you're not paying attention to vulnerabilities. Run `man elf` on your favorite Linux system, and you'll see docs of <elf.h>, which you can use to read ELF files. Write something to just dump the text section -- it shouldn't take you more than like 30 lines of C. Then tell me how many integer overflows you managed to squeeze in those 30 lines. :)

It's worth noting though that this article used the MS/Sysinternals version of strings and not the binutils version in most Linux distros. The Sysinternals version is unlikely to be parsing ELF and the like.

(One quick test: try "strings -n 2 cmd.exe" and see if the output starts with MZ.)

Then again, he did let the 'malware' infect himself. (Ghetto reversing as he calls it.) I'm pretty sure it wouldn't be a big deal if strings failed... but you still have a good point!

My guess is that he ran in a vm, at least that is what I would do.

Reply on news.ycombinator.com