atomdrift/stng
1
5
Fork
You've already forked stng
0
strings(1) for malware analysts - stronger, better, faster
  • Rust 99.3%
  • Makefile 0.6%
2026年07月12日 20:35:06 +02:00
.tuna add recursion, jemalloc, tuna configs 2026年05月23日 17:12:06 -04:00
benches upgrade to Rust 2024 syntax 2026年05月26日 10:48:28 -04:00
media remove .svg gitignore 2026年04月16日 17:51:34 -04:00
scripts add precommit hook 2026年06月17日 14:35:48 -04:00
src improve self-clearing cache 2026年07月12日 20:35:06 +02:00
testdata improve PE string extraction, perf 2026年06月19日 18:15:37 -04:00
tests cpu optimizations: ~5X wall-clock improvement 2026年07月11日 21:16:21 +02:00
.gitignore remove .svg gitignore 2026年04月16日 17:51:34 -04:00
Cargo.lock update deps 2026年07月11日 16:26:34 +02:00
Cargo.toml update deps 2026年07月09日 20:27:39 +02:00
LICENSE fix extraction for exotic C binaries 2026年03月08日 18:30:24 -04:00
Makefile add make fix 2026年06月25日 12:32:52 -04:00
README.md v1.2.0 2026年04月21日 09:24:19 -04:00
test_profile.rs more micro-benchmarking 2026年04月19日 11:52:27 -04:00

stng

stng — modern string extraction for binary analysis. All of the good stuff, none of the garbage.

screenshot

Installation

brew install atomdrift/tap/stng

Or with cargo:

cargo install --git https://codeberg.org/atomdrift/stng

Quick Start

stng malware.bin # Full analysis with XOR auto-detection
stng -i malware.bin # Show interesting strings
stng --json malware.bin # Machine-readable output with encoding metadata

Features

  • Garbage filtering: Filters unusable noise by default (--unfiltered to disable)
  • Language-aware extraction: Go/Rust {ptr, len}, Go pclntab symbols, stack-string reconstruction (x86 and arm64)
  • XOR obfuscation: Single/multi-byte keys, entropy analysis, arm64 stack-XOR, double-layer (encoding+XOR)
  • Script deobfuscation: Decodes obfuscated Python/JS/PHP/PowerShell payloads and re-scans them
  • Encoding detection: Base64, Base32, Base85, hex, URL-encoding, Unicode escapes, UTF-16LE wide strings
  • IOC classification: IPs, URLs, hostnames, shell commands, suspicious paths, crypto wallets, Tor addresses, JWTs, API keys, mining pools, ransom notes
  • Mach-O specifics: Code signatures, entitlements, fat/universal binaries
  • Format support: ELF, PE, Mach-O, raw binaries, overlays

Useful for initial triage, C2 enumeration, credential extraction, and YARA signature development.

License: Apache-2.0