# 3.5.5 Strings

Strings are probably one of the most important entrypoints while starting to reverse engineer a program because they are usually referencing information about the functions actions ( asserts, debug or info messages, ...).

So it is important for radare to be able to print strings in multiple ways:

    ..p?..
     a : ascii                   (null)
     A : ascii printable         (null)
     z : ascii null terminated   (null)
     Z : wide ascii null end     (null)
     r : raw ascii               (null)

Commands 'pa' and 'pA' are pretty similar, but 'pA' protects your console from strange non-printable characters. These two commands are restricted to the block size, so you will have to manually adjust the block size to get a nicer format. If the analyzed strings are zero-terminated or wide-chars, use 'z' or 'Z'.

Most common strings will be just zero-terminated ones. Here's an example by using the debugger to continue the execution of the program until it executes the 'open' syscall. When we recover the control over the process, we get the arguments passed to the syscall, pointed by `%ebx`. Which is obviously a zero terminated string.

    [0x4A13B8C0]> !contsc open
    0x4a14fc24 syscall(5) open ( 0x4a151c91 0x00000000 0x00000000 ) = 0xffffffda
    [0x4A13B8C0]> !regs
      eax  0xffffffda    esi  0xffffffff    eip    0x4a14fc24
      ebx  0x4a151c91    edi  0x4a151be1    oeax   0x00000005
      ecx  0x00000000    esp  0xbfbedb1c    eflags 0x200246
      edx  0x00000000    ebp  0xbfbedbb0    cPaZstIdor0 (PZI)
    [0x4A13B8C0]>
    [0x4A13B8C0]> pz @ 0x4a151c91
    /etc/ld.so.cache

Finally, the 'pr' is used to raw print the bytes to stdout. These bytes can be redirected to a file by using the '>' character:

    [0x4A13B8C0]> pr 20K > file
    [0x4A13B8C0]> !!du -h file
    20K     file