stng is strings(1) for people who read malware. It knows about XOR, base64, Go and Rust string layouts, x86 and arm64 stack strings, and Windows wide strings, and it drops the compiler noise by default. Use it for triage, C2 and credential discovery, and building YARA signatures. Local, no account, no API key.

Capabilities

• Garbage filtering: drops unusable noise by default; --unfiltered brings it back
• XOR detection: single- and multi-byte keys with entropy analysis, plus double-layer encoding-then-XOR
• Encodings: Base64, Base32, Base85, hex, URL-encoding, Unicode escapes
• Compiled languages: Go and Rust {ptr, len} layouts, Go pclntab symbols, x86 and arm64 stack strings
• Mixed inputs: recovers campaign markers from polyglot and mostly-binary files
• Network structures: hardcoded IPs and ports in socket structs
• IOC classification: IPs, URLs, hostnames, shell commands, paths, wallets, tokens, API keys, ransom-note text
• Wide strings: UTF-16LE in Windows PE binaries
• Formats: ELF, PE, Mach-O with code-signing and entitlement context, raw binaries, overlays

Install

Homebrew (macOS and Linux):

brew install atomdrift-project/tap/stng

From source:

cargo install --git https://github.com/atomdrift-project/stng

Usage

$ stng malware.bin              # full analysis with XOR auto-detection
$ stng -i malware.bin           # interesting strings only
$ stng --json malware.bin       # machine-readable with encoding metadata

Rizin or radare2 is optional. When installed, it enables deeper address recovery and --xorscan; otherwise stng skips those passes.

Library

let strings = stng::extract_strings(&std::fs::read("sample")?, 4);