strings: Extract Readable Text From a Binary
strings scans a binary and prints sequences of printable characters at least 4 bytes long.
When you need the embedded version, a hardcoded path, or to scan an artifact for a leaked token, strings pulls the human-readable parts out of a binary.
What it does
strings reads a file (by default treating it as an object file, but -a/--all scans the whole thing) and prints each run of printable characters of at least a minimum length (default 4). It is part of binutils and common in CI for grepping compiled artifacts.
Common usage
# find an embedded version or build id
strings -a build/app | grep -i version
# only runs of 8+ printable chars
strings -n 8 firmware.bin
# print byte offsets alongside each string
strings -t x firmware.bin
# scan a release artifact for a leaked token pattern
strings -a dist/bundle | grep -E 'AKIA[0-9A-Z]{16}'Options
| Flag | What it does |
|---|---|
| -a, --all | Scan the entire file, not just loadable sections |
| -n <len> | Minimum string length to print (default 4) |
| -t x|d|o | Print the offset of each string in hex/dec/octal |
| -e <enc> | Character size/endianness: s (single), l, b (16-bit), etc. |
| -f | Prefix each line with the file name (multi-file scans) |
In CI
Use strings as a cheap secret-leak gate on release artifacts: strings -a dist/* | grep -Eq "BEGIN RSA PRIVATE KEY" && exit 1. It is not a real scanner, but it catches obvious embedded keys or tokens before they ship. Add -e l for wide (UTF-16LE) strings common in Windows binaries.
Common errors in CI
"strings: command not found" means binutils is missing (apt-get install -y binutils, apk add binutils). Missing expected text is usually the default 4-byte minimum splitting a wide/UTF-16 string; add -e l. Without -a, strings only scans loadable sections of an ELF and can skip data you expect; pass -a to scan everything.