BSD Ports

textproc/stng 1.0.0 NetBSD

Language-aware string extraction for Go and Rust binaries

System
NetBSD
Repository
pkgsrc
Maintainer
[email protected]
Last update
Commit
8b2b35f445
License
apache-2.0
Categories
textproc
Package size
6696.8 KiB, 41528.9 KiB installed

Description

Language-aware string extraction for binary malware analysis. Extract indicators, hardcoded credentials, C2 addresses, and obfuscated strings from any binary.

Features

  • Garbage filtering: Filters out unusable garbage by default (but supports --unfiltered)
  • Language-aware extraction: Go/Rust {ptr, len}, DWARF stack strings
  • Binary network structures: Finds hardcoded IPs/ports in socket structures
  • XOR obfuscation: Single/multi-byte keys with entropy analysis, double-layer (encoding+XOR)
  • Encoding detection: Base64, Base32, Base85, hex, URL-encoding, Unicode escapes
  • IOC classification: IPs, URLs, shell commands, paths, credentials
  • Wide strings: UTF-16LE in Windows PE binaries
  • Format support: ELF, PE, Mach-O, raw binaries, overlays

Install

Binary package:

pkgin install stng

From pkgsrc:

cd /usr/pkgsrc/textproc/stng && make install clean

Dependencies

No port depends on this one.

Commit history 2

DateCommitCreditsLog message
8b2b35f445 wiz stng: add missing tool
2f56742e94 pin textproc/stng: update to 1.7.1
v1.7.1 Features New stng-owned string cache (in-memory + disk) so consumers share one copy instead of re-extracting. Strings now carry their source byte extent, fixing span math for UTF-16LE, base64, and stack strings. Fixes Stack-string junk (stack fills, register-save patterns) no longer bypasses the garbage filter. Fixed a quadratic slowdown in XOR scanning on large payloads (tens of seconds → fast, identical output). Performance 40% faster test suite bumped jemalloc to 0.7 trimmed per-string memory (dropped unused metadata fields). v.1.7.0 Added generic decoded-string extraction for text inputs. Added base64-over-UTF-16LE decoding. Improved Go PE inline string recovery. Reduced PE/network false-positive IPs. …