[Vol-users] using hex values with strings command

Darren Spruell phatbuckett at gmail.com
Sun Apr 15 01:35:44 CDT 2012


Hi Mike,

Does malfind plugin + yara rule(s) work for your use case?

DS

On Apr 14, 2012, at 9:12 PM, Mike Lambert <dragonforen at hotmail.com> wrote:

> I have read the command reference for the strings plugin and do not see an option to specify the string to look for in anything other than ascii.
> 
> Could strings be expanded to include hex values, perhaps in the form of \x55\x5e\xe2\xfd\x83\xc4 or something like that?
>  
> Thanks,
> Mike Lambert
>  
> 
> _______________________________________________
> Vol-users mailing list
> Vol-users at volatilityfoundation.org
> http://lists.volatilityfoundation.org/mailman/listinfo/vol-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.volatilityfoundation.org/pipermail/vol-users/attachments/20120414/aed4c70c/attachment.html


More information about the Vol-users mailing list