nabla-utils 0.1.0

Utility functions for binary analysis and security research
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

pub fn extract_strings(contents: &[u8]) -> Vec<String> {
    let mut strings = Vec::new();
    let mut current_string = Vec::new();

    tracing::debug!("Extracting strings from {} bytes", contents.len());

    for &byte in contents {
        if byte.is_ascii_graphic() || byte == b' ' || byte == b'\t' {
            current_string.push(byte);
        } else {
            if current_string.len() >= 3 {
                // Reduced minimum for small files
                if let Ok(s) = String::from_utf8(current_string.clone()) {
                    // Filter out very common/useless strings
                    if !s.trim().is_empty() && !is_junk_string(&s) {
                        strings.push(s.trim().to_string());
                    }
                }
            }
            current_string.clear();
        }
    }

    // Process any remaining string
    if current_string.len() >= 3 {
        if let Ok(s) = String::from_utf8(current_string) {
            if !s.trim().is_empty() && !is_junk_string(&s) {
                strings.push(s.trim().to_string());
            }
        }
    }

    // Deduplicate and limit
    strings.sort();
    strings.dedup();
    strings.truncate(50);

    tracing::debug!("Extracted {} strings", strings.len());
    strings
}

fn is_junk_string(s: &str) -> bool {
    // Filter out strings that are likely padding or noise
    s.chars().all(|c| c == '\0' || c == ' ') ||
    s.len() > 200 || // Very long strings are often noise
    s.chars().all(|c| c.is_ascii_punctuation())
}