Strings

Extract strings from a file with optional filter - similar to binutils strings command.

python · Common Scripts

Source

import re
import string

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def strings(args):
    # Optional arguments and default values
    chars = 4
    if "chars" in args:
        chars = int(args["chars"])
    size = 1024
    if "size" in args:
        size = int(args["size"])
    regex = None
    if "filter" in args:
        regex = re.compile(args["filter"], re.IGNORECASE)
    fEntry = demisto.executeCommand("getFilePath", {"id": args["entry"]})[0]
    if not isError(fEntry):
        matches = []
        # type: ignore[call-overload]
        with open(demisto.get(fEntry, "Contents.path"), buffering=1024 * 1024, errors="ignore") as f:  # pragma: no cover
            buff = ""
            c = f.read(1)
            while c != "":
                if c in string.printable:
                    buff += c
                else:
                    if len(buff) >= chars:
                        if regex:
                            if regex.match(buff):
                                matches.append(buff)
                        else:
                            matches.append(buff)
                        if len(matches) >= size:
                            break
                    buff = ""
                c = f.read(1)
            if len(buff) >= chars and len(matches) < size:
                if regex:
                    if regex.match(buff):
                        matches.append(buff)
                else:
                    matches.append(buff)
        if matches:
            return "\n".join(matches)
        else:
            return "No strings were found."
    else:
        return fEntry  # pragma: no cover


def main():  # pragma: no cover
    args = demisto.args()
    demisto.results(strings(args))


if __name__ in ["__main__", "builtin", "builtins"]:
    main()

README

Extracts strings from a file with an optional filter. This is similar to binutils strings command.

Script Data


Name Description
Script Type python
Tags server, file

Inputs


Argument Name Description
entry The entry ID of a file entry to retrieve strings from.
chars The number of consecutive characters needed in order for it to be considered a string. The default is 4.
size The display first ‘size’ results. The default is 1024.
filter The regex to filter the strings. This will be compiled with the ignore case.

Outputs


There are no outputs for this script.