Package: binary2strings
binary2strings - Python module to extract strings from binary blobsPython module to extract Ascii, Utf8, and wide strings from binary data. Supports Unicode characters. Fast wrapper around c++ compiled code. This is designed to extract strings from binary content such as compiled executables.Supported extracting strings of formats:Utf8 (8-bit Unicode variable length characters)Wide-character strings (UCS-2 Unicode fixed 16-bit characters)International language string extraction is supported for both Utf8 and wide-character string standards - for example Chinese simplified, Japanese, and Korean strings will be extracted.Optionally uses a machine learning model to filter out erroneous junk strings.InstallationRecommended installation method:pip install binary2stringsAlternatively, download the repo and run:python setup.py installDocumentationApi:importbinary2stringsasb2s[(string,encoding,span,is_interesting),]=b2s.extract_all_strings(buffer,min_chars=4,only_interesting=False)Parameters:buffer:A bytes array to extract strings from. All strings within this buffer will be extracted.min_chars:(default 4) Minimum number of characters in a valid extracted string. Recommended minimum 4 to reduce noise.only_interesting:Boolean on whether only interesting strings should be returned. Interesting strings are non-gibberish strings, and a lightweight machine learning model is used for this identification. This will filter out the vast majority of junk strings, with a low risk of filtering out strings you care about.Returns an array of tuples ordered according to the order in which they are located in the binary:string:The resulting string that was extracted in standard python string. All strings are converted to Utf8 here.encoding:"UTF8" | "WIDE_STRING". This is the encoding of the original string within the binary buffer.span:(start, end) tuple describing byte indices of where the string starts and ends within the buffer.is_interesting:Boolean describing whether the string is likely interesting. An interesting string is defined as non-gibberish. A machine learning model is used to compute this flag.Example usagesExample usage:importbinary2stringsasb2sdata=b"hello world\x00\x00a\x00b\x00c\x00d\x00\x00"result=b2s.extract_all_strings(data,min_chars=4)print(result)# [#   ('hello world', 'UTF8', (0, 10), True),#   ('abcd', 'WIDE_STRING', (13, 19), False)# ]It also supports international languages, eg:importbinary2stringsasb2s# "hello world" in Chinese simplifiedstring="\x00ä¸–ç•Œæ‚¨å¥½\x00"data=bytes(string,'utf-8')result=b2s.extract_all_strings(data,min_chars=4)print(result)# [#   ('ä¸–ç•Œæ‚¨å¥½', 'UTF8', (1, 12), False)# ]Example extracting all strings from a binary file:importbinary2stringsasb2swithopen("C:\\Windows\\System32\\cmd.exe","rb")asi:data=i.read()for(string,type,span,is_interesting)inb2s.extract_all_strings(data):print(f"{type}:{is_interesting}:{string}")Example extracting only interesting strings from a binary file:importbinary2stringsasb2swithopen("C:\\Windows\\System32\\cmd.exe","rb")asi:data=i.read()for(string,type,span,is_interesting)inb2s.extract_all_strings(data,only_interesting=True):print(f"{type}:{is_interesting}:{string}")