Skip to content

Instantly share code, notes, and snippets.

Last active July 14, 2022 21:10
What would you like to do?
Extract ASCII and Unicode strings using Python.
import re
from collections import namedtuple
ASCII_BYTE = " !\"#\$%&\'\(\)\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\]\^_`abcdefghijklmnopqrstuvwxyz\{\|\}\\\~\t"
String = namedtuple("String", ["s", "offset"])
def ascii_strings(buf, n=4):
reg = "([%s]{%d,})" % (ASCII_BYTE, n)
ascii_re = re.compile(reg)
for match in ascii_re.finditer(buf):
yield String("ascii"), match.start())
def unicode_strings(buf, n=4):
reg = b"((?:[%s]\x00){%d,})" % (ASCII_BYTE, n)
uni_re = re.compile(reg)
for match in uni_re.finditer(buf):
yield String("utf-16"), match.start())
except UnicodeDecodeError:
def main():
import sys
with open(sys.argv[1], 'rb') as f:
b =
for s in ascii_strings(b, n=4):
print('0x{:x}: {:s}'.format(s.offset, s.s))
for s in unicode_strings(b):
print('0x{:x}: {:s}'.format(s.offset, s.s))
if __name__ == '__main__':
Copy link

# ASCII strings from GNU strings
$ strings -n 4 -e l -a /bin/ls  | wc -l

# Unicode strings from GNU strings
$ strings -n 4 -a /bin/ls  | wc -l                                                               

# ASCII and Unicode strings from this snippet
$ env/bin/python /bin/ls | wc -l

Copy link

the issue is also present here, mandiant/flare-floss#347
Need to convert all the regex to bytes type 'rb'

Copy link

if you are getting the mandiant/flare-floss#347 issue, i have fixed the code.
Try this,

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment