Explain that to the German judges that fined some poor fella for finding passwords in a binary by [doing the equivalent of] running strings on it. They claim he 'circumvented' the software's 'security measures'.

https://www.theregister.com/2024/01/19/germany_fine_security...

Can you elaborate?

If you put something like

  if mySecretPassword == "Qwerty123" {
     ...

then "Qwerty123" will be easily seen by strings utility. Which is pretty obvious but I'm guessing some junior folks will be surprised.

You probably know this, but in C, if you wrote the comparison like this

  if (password[0] == 'Q'
   && password[1] == 'w'
   /* the rest of the letters... */
   && password[8] == '3'
   // C strings are 0 terminated
   && password[9] == '\0')
  {
      ...
  }

It will probably compile to something like this on x86-64, assuming a "password" is a pointer held in RDI (although I didn't look at a compiler's output):

  cmp byte [rdi], 0x51 ; 'Q'
  jne false
  ;; the rest of the letters...
  cmp byte [rdi + 9], 0x0 ; '\0'
  jne false

The benefit is that the strings utility wouldn't see the string "Qwerty123" anywhere in the binary.

Unicode and bounds checking code probably complicate this generated assembly in other languages.

It would be nice if there were some way to write a macro or an inline function so that you could write a comparison like

  if inlineStringEqualP(mySecretPassword, "Qwerty123") {
    ...

And then it would expand into something like the assembly I wrote above, so that way, the string literal "Qwerty123" isn't embedded in the final binary executable anywhere. I bet it's possible with C++ templates somehow, but it would be messy.

I think that was the very first crackmes i ever solved =)

You can run the `strings` command on most executables (or PDFs) and get an output of the strings represented in the file. Of course you can obfuscate some of those strings if you do things right but a lot of people who don't know about `strings` could write a password protected feature in a compile bit of code and be embarrassed to see how easy it is to find out what the password is.

The other replies are pretty good. You can find all sorts of goodies in string data inside a binary: hostnames, URL fragments, error messages or templates, credentials. Pretty much any string constants that a program might use.

It's even quite interesting to run strings on programs I wrote and I do it regularly. For example it can be faster to get the version string from an .exe using strings if you know what to grep for than to run "wine program.exe --version".

man strings