Strings

Details

ID	`Strings`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	server file

README

Extracts strings from a file with an optional filter. This is similar to binutils strings command.

Script Data

Name	Description
Script Type	python
Tags	server, file

Inputs

Argument Name	Description
entry	The entry ID of a file entry to retrieve strings from.
chars	The number of consecutive characters needed in order for it to be considered a string. The default is 4.
size	The display first ‘size’ results. The default is 1024.
filter	The regex to filter the strings. This will be compiled with the ignore case.

Outputs

There are no outputs for this script.

Source

Strings.py Strings_test.py Strings.yml

Download History Raw

from Strings import *


def test_strings(mocker):
    mocker.patch.object(
        demisto, "executeCommand", return_value=[{"path": "./test_data/text_file.txt", "name": "text_file.txt", "Type": ""}]
    )
    mocker.patch.object(demisto, "get", return_value="./test_data/text_file.txt")
    entry = strings({"chars": 4, "size": 1024, "entry": "123"})
    assert entry == "abcabc"


def test_strings_no_string(mocker):
    mocker.patch.object(
        demisto, "executeCommand", return_value=[{"path": "./test_data/no_text_file.txt", "name": "text_file.txt", "Type": ""}]
    )
    mocker.patch.object(demisto, "get", return_value="./test_data/no_text_file.txt")
    entry = strings({"chars": 4, "size": 1024, "entry": "123"})
    assert entry == "No strings were found."


def test_strings_small_buff(mocker):
    mocker.patch.object(
        demisto, "executeCommand", return_value=[{"path": "./test_data/text_file.txt", "name": "text_file.txt", "Type": ""}]
    )
    mocker.patch.object(demisto, "get", return_value="./test_data/text_file.txt")
    entry = strings({"chars": 1, "size": 1024, "entry": "123"})
    assert entry == "abcabc"


def test_strings_regex(mocker):
    mocker.patch.object(
        demisto, "executeCommand", return_value=[{"path": "./test_data/text_file.txt", "name": "text_file.txt", "Type": ""}]
    )
    mocker.patch.object(demisto, "get", return_value="./test_data/text_file.txt")
    entry = strings({"chars": 1, "size": 1024, "entry": "123", "filter": ".*"})
    assert entry == "abcabc"


def test_pdf_file(mocker):
    mocker.patch.object(
        demisto, "executeCommand", return_value=[{"path": "./test_data/pdf_file.pdf", "name": "pdf_file.pdf", "Type": ""}]
    )
    mocker.patch.object(demisto, "get", return_value="./test_data/pdf_file.pdf")
    entry = strings({"chars": 1, "size": 1024, "entry": "123", "filter": ".*"})
    assert entry != ""