Strings2 is a Windows command-line tool for extracting ascii and unicode strings from binary data. On top of the classical Sysinternals strings approach, this improved version is also able to dump strings from process address spaces and reconstruct hidden assembly local variable assignment ascii/unicode strings.


Strings2 is available for Windows x86 and x64. Please download the appropriate executable.

Source Code

The source code for strings2 is available through GitHub. Contributions are welcome.

Example Usage

Options Description
-f Prints the filename/processname before each string.
-r Recursively process subdirectories.
-t Prints the type before each string: unicode, ascii, or assembly unicode/ascii stack push.
-asm Only prints the extracted ascii/unicode assembly stack push-hidden strings.
-raw Only prints the regular ascii/unicode strings.
-a Prints only ascii strings.
-u Prints only unicode strings.
-l [numchars] Minimum number of characters that is a valid string. Default is 4.
-nh No header is printed in the output.
-pid The strings from the process address space for the specified PID will be dumped. Use a 0x prefix to specify a hex PID.
-system Dumps strings from all accessible processes on the system. This takes awhile.


Fig. 1 - Main usage instructions for strings2.

Version History

Back to top