A string in a binary file

q8devilish · January 29, 2013, 5:05am

hi experts,
anyone knows how can i find a string in a multiple binary files in a multiple directories and display the file name containing the string?

i mean i have lots of folders with binary files and i am looking for specific string within one of these files i would like to know the right syntax to use for this kind of search, i know i should run strings or something similar.

OS Solaris 10 sparc

Skrynesaver · January 29, 2013, 5:43am

grep  $STRING $(find /root_path -type f)

Or if that returns too many arguments

for i in $(find /root_path - type f) ; do grep $STRING $i && echo $i;done

Of course you can reduce the search space by adding a -name =\*.o parameter or similar to the find command

Unfortunately Solaris grep does no support the -r flag as far as i know

q8devilish · January 29, 2013, 6:00am

i used the first code and got

bash: /usr/bin/grep: Arg list too long

i am trying to find a string SRV6000 and another string srv6000, i would like to know which file contain this string most probably will be a binary file in the machine.

Don_Cragun · January 29, 2013, 7:38am

You are correct in noting that you need to use strings when looking for a string in a binary file. The grep utility is only defined to work on text files. This may not be highly efficient, but it should do what you want. First create the following shell script as a file named $HOME/bin/st_gr_pr :

#!/bin/ksh
# Usage: st_gr_pr pattern file...
pattern="$1"
shift
for f in "$@"
do      if [ $(strings -a -n ${#pattern} "$f" | grep -ic "$pattern" ) -gt 0 ]
        then    printf "%s\n" "$f"
        fi
done

and make it executable using the command:

chmod +x $HOME/bin/st_gr_pr

Note that the -i option to the grep command in this script makes searches for alphabetic characters case insensitive. I use ksh, but bash should also work if you want to use it in this script.

Then run the command:

find . -type f -exec st_gr_pr 'srv6000' {} +

to get a list of all regular files rooted in the current directory that contain srv6000 , SRV6000 , or any of the other six strings with combinations of uppercase and lowercase s, r, and v in that order. Obviously, replace srv6000 if you want to find files containing a different pattern.

GP81 · January 29, 2013, 9:13am

bash: /usr/bin/grep: Arg list too long

Maybe man xargs will help you?

zazzybob · January 29, 2013, 11:43pm

Solaris 10 may also have ggrep (i.e. GNU grep - depending on the actual Update of Solaris 10) under /usr/sfw/bin.

$ uname -rsv
SunOS 5.10 Generic_147441-01
$ cat /etc/release
                    Oracle Solaris 10 8/11 s10x_u10wos_17b X86
  Copyright (c) 1983, 2011, Oracle and/or its affiliates. All rights reserved.
                            Assembled 23 August 2011
$ /usr/sfw/bin/ggrep -a -l "GNU" /usr/sfw/bin/ggrep
/usr/sfw/bin/ggrep
$ /usr/sfw/bin/ggrep -a "GNU" /usr/sfw/bin/ggrep
%s (GNU grep) %s
$ /usr/sfw/bin/ggrep "GNU" /usr/sfw/bin/ggrep
Binary file /usr/sfw/bin/ggrep matches

As you can see, you can use the -a option to treat all files as ascii text, and -l to just list the filename that matches. Leave off the -l to print the actual line that matches.

Cheers,
ZB

q8devilish · February 5, 2013, 7:34am

don cragun:

You are correct in noting that you need to use strings when looking for a string in a binary file. The grep utility is only defined to work on text files. This may not be highly efficient, but it should do what you want. First create the following shell script as a file named $HOME/bin/st_gr_pr :
#!/bin/ksh
# Usage: st_gr_pr pattern file...
pattern="$1"
shift
for f in "$@"
do      if [ $(strings -a -n ${#pattern} "$f" | grep -ic "$pattern" ) -gt 0 ]
   then    printf "%s\n" "$f"
   fi
done
and make it executable using the command:
chmod +x $HOME/bin/st_gr_pr
Note that the -i option to the grep command in this script makes searches for alphabetic characters case insensitive. I use ksh, but bash should also work if you want to use it in this script.

Then run the command:
find . -type f -exec st_gr_pr 'srv6000' {} +
to get a list of all regular files rooted in the current directory that contain srv6000 , SRV6000 , or any of the other six strings with combinations of uppercase and lowercase s, r, and v in that order. Obviously, replace srv6000 if you want to find files containing a different pattern.

works like a charm, perfect answer thanks mate..