{"action":"created","issue":{"url":"https://api.github.com/repos/radare/radare2/issues/3190","labels_url":"https://api.github.com/repos/radare/radare2/issues/3190/labels{/name}","comments_url":"https://api.github.com/repos/radare/radare2/issues/3190/comments","events_url":"https://api.github.com/repos/radare/radare2/issues/3190/events","html_url":"https://github.com/radare/radare2/issues/3190","id":103830217,"number":3190,"title":"False Positive Strings","user":{"login":"Manouchehri","id":7232674,"avatar_url":"https://avatars.githubusercontent.com/u/7232674?v=3","gravatar_id":"","url":"https://api.github.com/users/Manouchehri","html_url":"https://github.com/Manouchehri","followers_url":"https://api.github.com/users/Manouchehri/followers","following_url":"https://api.github.com/users/Manouchehri/following{/other_user}","gists_url":"https://api.github.com/users/Manouchehri/gists{/gist_id}","starred_url":"https://api.github.com/users/Manouchehri/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Manouchehri/subscriptions","organizations_url":"https://api.github.com/users/Manouchehri/orgs","repos_url":"https://api.github.com/users/Manouchehri/repos","events_url":"https://api.github.com/users/Manouchehri/events{/privacy}","received_events_url":"https://api.github.com/users/Manouchehri/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/radare/radare2/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/radare/radare2/labels/search","name":"search","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-08-29T05:25:47Z","updated_at":"2015-10-27T18:05:02Z","closed_at":null,"body":"I don't think I have enough information to give a proper bug report, but @crowell suggested I try.\r\n\r\nThe binary is a deobfuscated firmware, which contains some ARM little-endian and a lot of other mess. It seems that r2 is having a harder time with strings compared to IDA, not sure why.\r\n\r\n# radare2\r\n```\r\n0x0 16 15 SAMSUNG_SSD_BIN\r\n0x10 20 19 0.01STH00001OEM_GEN\r\n0x2c 14 13 2013121819:43\r\n0x579 8 7  pG\\vIHh\r\n0x59b 16 15  pG\\a pG\\b pG\\t pG\r\n0x5ae 7 6 P \\nJQh\r\n0x689 5 4  pG@\r\n0x6b2 5 4 LF3H\r\n0x6f8 5 4 \"H80\r\n0x750 7 6 H\\a\\fI\\f9\r\n0x769 6 5 H\\f8Ah\r\n0x79d 7 5 hб@%O\r\n0x7c4 6 5 @2@Fk\r\n0x7e3 5 4 C4NO\r\n0x7ef 12 11 %1I2O\\f9O`xl\r\n0x800 8 7 Hh/I@l \r\n0x80f 40 19 c 矰Ǻ 瓰俺ô伴苰⅀نꏰ俼蓰⅀ن黰俼\r\n0x84d 6 5 #@F?!\r\n0x869 6 5 \")F8F\r\n0x89b 6 5 @1i 2\r\n0x932 9 8 \\bI\\bJ\\tH\\b`\r\n0x961 5 4 HAk!\r\n0x967 7 6 QAcAkA\r\n0x96f 6 5 qAcpG\r\n0x979 5 4 HAkA\r\n0x97f 6 5 QAcpG\r\n0x99d 8 7 F5I5Lpj\r\n0x9d2 5 4 *I`k\r\n0xa10 7 6 \\eHAk!y\r\n0xa4c 9 8 \\nJ0F!i 2\r\n0xa70 5 4 p@`G\r\n0xafd 36 17 !à脡酲쥫Ȁ釔쥫āǕ!à섡灲G氀舮\r\n0xbe6 6 5 \\fL`h \r\n0xbee 6 5 `` h \r\n0xbf5 6 5 ` `\\bH\r\n0xbfb 5 4 b h@\r\n0xc01 5 4 ` `B\r\n0xc2d 5 4 Lah!\r\n0xc34 6 5 a`!h!\r\n0xc47 7 4 ܀(\\bа\r\n0xc5d 7 5 ѡb h@\r\n0xc65 5 4 ` `B\r\n0xc99 6 5 H `\\n \r\n0xca7 6 5  ``\\n \r\n0xcc1 5 4 D\\vhC\r\n0xce9 6 5   a\\n \r\n0xd14 6 5  ` h \r\n0xd34 6 5  ` h \r\n0xf5e 6 5 \\rM\\b O\r\n0xf79 8 7  $`!h\"h\r\n```\r\n\r\n# IDA\r\n```\r\nROM:00000000 00000010 C SAMSUNG_SSD_BIN                    \r\nROM:00000010 00000014 C 0.01STH00001OEM_GEN                \r\nROM:000017BB 00000008 C I@h\\bapG                           \r\nROM:000071FF 00000005 C U'5t?                              \r\nROM:00007212 00000007 C \\np}'/$\\\\                          \r\nROM:000072D9 00000005 C w%EeN                              \r\nROM:000072F4 00000007 C <:;fH\\vp                           \r\nROM:0000730C 00000005 C DW>!O                              \r\nROM:0000733E 00000005 C W_G#K                              \r\nROM:00024498 00000020 C \\r\\n [UART REGISTER R/W START] \\r\\n\r\nROM:000244B8 00000008 C [Write]                            \r\nROM:000244C0 00000007 C  Addr:                             \r\nROM:000244C8 00000007 C  Data:                             \r\nROM:000244D0 00000009 C  Done.\\r\\n                         \r\nROM:000244DC 00000007 C [Read]                             \r\nROM:0002E1E8 0000000F C 00000000000000                     \r\nROM:0002E1F8 00000009 C EXT0BB6Q                           \r\nROM:0002E204 00000011 C SAMSUNG SATA SSD                   \r\nROM:0002E21C 00000005 C DXM0                               \r\nROM:00031DC8 0000000C C sscl_malloc                        \r\nROM:00034085 00000005 C z\\x1Bw*{                           \r\nROM:000340A4 0000000A C FW_ASSERT                          \r\nROM:000340D4 0000000E C ARM_EXCEPTION                      \r\nROM:00038839 00000005 C G h\\n\\\"                            \r\nROM:00038877 00000006 C %!'.F                              \r\nROM:0003889D 00000007 C G hR!*F                            \r\nROM:000388A9 00000007 C G hU!2F                            \r\nROM:000388B5 00000005 C G h:F                              \r\nROM:000388D3 00000005 C h\\vi\\\\!                            \r\nROM:000388E4 00000008 C secu0.01                           \r\nROM:00038925 00000005 C ipGKJ                              \r\nROM:00038A54 00000005 C clas\\\\                             \r\nROM:00038A64 00000006 C secu]I                             \r\nROM:00038ACF 00000005 C hGH``                              \r\nROM:00038AE1 00000005 C `U!0h                              \r\nROM:00038B0F 00000005 C FDi(F                              \r\nROM:00038B55 00000005 C G&Hah                              \r\nROM:00038B83 00000005 C `U!8h                              \r\nROM:00038BA5 00000005 C FDi0F                              \r\nROM:00038C72 0000001A C  \\\"$&(*,.02468:<>@BDFHJLN          \r\nROM:00038D6F 00000005 C hJjYF                              \r\nROM:00038D8F 00000005 C \\\")F F                             \r\nROM:00038E0B 00000007 C \\\"SF!F8F                           \r\nROM:00038E25 00000005 C !+F2F                              \r\nROM:00038E3D 00000005 C FDi@F                              \r\nROM:00038E63 00000005 C \\\"SF!F                             \r\nROM:00038EB3 00000005 C $(F!F                              \r\nROM:00038EC6 00000005 C pGpG-                              \r\nROM:00038F72 00000008 C 0h9FBj0F                           \r\nROM:00039583 00000005 C FDi@F                              \r\n```"},"comment":{"url":"https://api.github.com/repos/radare/radare2/issues/comments/151589862","html_url":"https://github.com/radare/radare2/issues/3190#issuecomment-151589862","issue_url":"https://api.github.com/repos/radare/radare2/issues/3190","id":151589862,"user":{"login":"Manouchehri","id":7232674,"avatar_url":"https://avatars.githubusercontent.com/u/7232674?v=3","gravatar_id":"","url":"https://api.github.com/users/Manouchehri","html_url":"https://github.com/Manouchehri","followers_url":"https://api.github.com/users/Manouchehri/followers","following_url":"https://api.github.com/users/Manouchehri/following{/other_user}","gists_url":"https://api.github.com/users/Manouchehri/gists{/gist_id}","starred_url":"https://api.github.com/users/Manouchehri/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Manouchehri/subscriptions","organizations_url":"https://api.github.com/users/Manouchehri/orgs","repos_url":"https://api.github.com/users/Manouchehri/repos","events_url":"https://api.github.com/users/Manouchehri/events{/privacy}","received_events_url":"https://api.github.com/users/Manouchehri/received_events","type":"User","site_admin":false},"created_at":"2015-10-27T18:05:01Z","updated_at":"2015-10-27T18:05:01Z","body":"Looks like r2 is doing a better job of strings now, it's actually getting a few email addresses that IDA missed.\r\n\r\n### IDA\r\n\r\n#### 410 strings\r\n\r\nhttps://gist.github.com/Manouchehri/c0d5dbf60633c2409580\r\n\r\n### `RABIN2_STRPURGE=1 rabin2 -qzz`\r\n\r\n#### 203 strings\r\n\r\nhttps://gist.github.com/Manouchehri/05926fa3d55a13ad7389\r\n\r\n### `rabin2 -qzz`\r\n\r\n#### 12834 strings\r\n\r\nhttps://gist.github.com/Manouchehri/c0d5dbf60633c2409580\r\n\r\nThe only issue is that purging is getting rid of some real strings like [`<REGISTER>`](https://gist.github.com/Manouchehri/5f1813d70778436c1a04#file-ext0bb6q-bin-r2-strings-txt-L4729)."}}