reverse-skills-max/vendor-new/analyst-ai-pack/skills/extracting-and-classifying-strings/references/api-reference.md

API Reference: Extracting and Classifying Strings

Overview

scripts/analyst.py extracts ASCII and UTF-16LE strings at a minimum length and classifies them into investigative categories (urls, ips, paths, registry, commands, apis), flagging a sparse dump as a possible obfuscation signal. It reads bytes only and never executes the sample.

Dependencies

Package	Version	Purpose
(stdlib)	—	regex, JSON, file IO

Core functions

ascii_strings(data, min_len) / unicode_strings(data, min_len)

Extract printable ASCII and UTF-16LE runs respectively.

classify(strings)

Buckets strings into categories via per-category regexes.

run(path, min_len)

Returns counts, categorized strings, and an obfuscation hint.

Usage

python scripts/analyst.py strings sample.bin --min-len 5

Sources

• GNU binutils strings — https://www.gnu.org/software/binutils/
• FLOSS (FLARE Obfuscated String Solver) for stacked/encoded strings — https://github.com/mandiant/flare-floss
• UTF-16LE wide-string extraction (printable byte + 0x00), standard Windows-analysis practice