2

I'm running macOS BigSur 11.6.5 (20G527) and I've installed binutils with homebrew and it provides a gnu version of strings.

It has different output for the same file, e.g /bin/ls

%> strings /bin/ls | head
I9H0
J8I9H8
H9J0
O8H9J8
I9H
J(I9H(
H9J
O(H9J(
I9H@
JHI9HH

%> gstrings /bin/ls | head
__PAGEZERO
__TEXT
__text
__TEXT
__stubs
__TEXT
__stub_helper
__TEXT
__const
__TEXT

I'm wondering how mac strings works? Why does it produce different output?

1
  • 2
    From the man page of the mac version: strings looks in all sections of the object files except the (__TEXT,__text) section . This clause is not present in the man page of the gnu version. Jul 21, 2022 at 9:51

1 Answer 1

3

Various versions of strings have existed. Most of them simply look for a certain number (four or more) of printable ASCII characters, and decide, without context, that it's found a human-readable "string." This appears to be the case with the supplied strings command.

GNU gstrings appears to be much smarter. I don't have gstrings installed, but it seems to be using a heuristic that is a bit smarter than merely looking for printable ASCII characters. (Some 40 years ago, in a C programming class I took, one of our assignments was to write a better version of strings. It wasn't very difficult!)

To better understand the discrepancy, I suggest you use a different utility, hexdump.

hexdump -C /bin/ls will show you the hexadecimal codes in a table for every byte in the file, with ASCII interpretations of them an the end of each row:

00000000  cf fa ed fe 07 00 00 01  03 00 00 00 02 00 00 00  |................|
00000010  13 00 00 00 10 07 00 00  85 00 20 00 00 00 00 00  |.......... .....|
00000020  19 00 00 00 48 00 00 00  5f 5f 50 41 47 45 5a 45  |....H...__PAGEZE|
00000030  52 4f 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |RO..............|
00000040  00 00 00 00 01 00 00 00  00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00  19 00 00 00 28 02 00 00  |............(...|
00000070  5f 5f 54 45 58 54 00 00  00 00 00 00 00 00 00 00  |__TEXT..........|
00000080  00 00 00 00 01 00 00 00  00 50 00 00 00 00 00 00  |.........P......|
00000090  00 00 00 00 00 00 00 00  00 50 00 00 00 00 00 00  |.........P......|

As you can see, the same "real" human-readable strings shown on the right are also in the gstrings output.

So, the simple answer is, GNU strings does a better job than the default BSD strings.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .