Text Strings & Modifiers
What is it?
Text strings match readable content in a file. Modifiers refine them: nocase (case-insensitive), wide (UTF-16, common in Windows binaries), ascii, and fullword (whole-word only).
Why it matters
The right modifier is the difference between matching and missing: Windows strings are often wide (UTF-16), so an ascii-only string silently misses them; fullword avoids matching a substring inside a benign word.
Where you see it
`$a = "CreateRemoteThread" ascii wide` to catch both encodings; `$b = "cmd" fullword` so it matches cmd, not 'accommodate'.
What normal looks like
Meaningful strings with modifiers that match how they appear in the target file type.
What suspicious looks like
An ascii-only string that misses a wide (UTF-16) occurrence, or a common substring without fullword that matches inside ordinary words.
How analysts investigate
Consider the file type: Windows binaries often store strings as UTF-16 (add wide); avoid substring false hits with fullword; use nocase only when case truly varies.
Common beginner mistakes
- Forgetting 'wide' so the rule misses UTF-16 strings in Windows binaries.
- Matching a common substring without fullword, hitting benign words.
Match how the string really appears
$a = "CreateRemoteThread" ← misses UTF-16 copies
$a = "CreateRemoteThread" ascii wide ← matches both encodings
$b = "cmd" ← also hits 'accommodate'
$b = "cmd" fullword ← whole word only
modifiers decide match vs silent missQuick check
Your string matches nothing in a Windows .exe though you can see it in strings output. Likely fix?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.