# Memory Strings Extractor
Extract ASCII and UTF-16LE strings from a memory or process dump, then group URLs, IPs, emails, domains, file paths and registry keys locally.
## Run it
- **CLI:** `gizza tool memory-strings 'Paste a dump (raw text or a hex-encoded dump) — e.g. GET http://evil.example.com/a 203.0.113.5 C:\Windows\System32\cmd.exe HKLM\Software\Run bad@phish.net'`
- **Web:** https://gizza.ai/tools/memory-strings/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/memory-strings/tool.json
## Inputs
- `dump` — Memory / process dump _(field)_
- `input_format` — Input format _(field)_
- `encoding` — String encoding to recover _(field)_
- `min_length` — Minimum run length (like strings -n) _(field)_
- `categories` — Categories to report (comma-separated, or 'all') _(field)_
- `defang` — Defang the URLs, IPs, domains and emails in the output _(field)_
## Output
- Extracted strings (text)
## Query parameters
Open the tool pre-filled and auto-run via URL:
- `dump` — Memory / process dump
- `input_format` — Input format
- `encoding` — String encoding to recover
- `min_length` — Minimum run length (like strings -n)
- `categories` — Categories to report (comma-separated, or 'all')
- `defang` — Defang the URLs, IPs, domains and emails in the output
Example: `https://gizza.ai/tools/memory-strings/?dump=Paste%20a%20dump%20%28raw%20text%20or%20a%20hex-encoded%20dump%29%20%E2%80%94%20e.g.%20GET%20http%3A%2F%2Fevil.example.com%2Fa%20%20203.0.113.5%20%20C%3A%5CWindows%5CSystem32%5Ccmd.exe%20%20HKLM%5CSoftware%5CRun%20%20bad%40phish.net&input_format=text&encoding=both&min_length=4&categories=all&defang=true`
---
## About this tool
**Memory Strings Extractor** runs a `strings`-style pass over a memory or process
dump and then does the triage step for you: it recovers every printable run and
sorts the results into the artifact classes a DFIR or malware analyst looks at
first. Paste a dump as raw text, or as a hex-encoded dump (`48 65 6c 6c 6f`,
`0x48`, `48:65`, or contiguous hex) when you only have a hexdump to hand.
Two things happen locally in your browser:
1. **Extract** — printable runs of at least *min length* characters are pulled
out, treating non-printable bytes as delimiters, exactly like `strings -n`.
You can recover 7-bit **ASCII** runs, **UTF-16LE** (wide) runs — the common
encoding for text in Windows memory — or both.
2. **Categorize** — the recovered strings are grouped, de-duplicated, sorted and
counted into **URLs**, **IPv4** and **IPv6** addresses, **emails**, bare
**domains**, **file paths** (Windows drive, UNC and Unix) and Windows
**registry keys**.
Turn on **defang** to rewrite the URLs, IPs, domains and emails as
`hxxp[://]evil[.]com` so the result is safe to drop into a ticket or report, and
use **categories** to report just the buckets you care about (for example
`registry` or `url,ipv4`).
Everything runs in your browser with WebAssembly — the dump is never uploaded.
### Worked example
Paste this dump with **Categories = all**:
```
GET http://evil.example.com/a from 203.0.113.5 open C:\Windows\System32\cmd.exe key HKLM\Software\Microsoft\Windows\CurrentVersion\Run mail bad@phish.net host cdn.badsite.io
```
You get grouped output like:
```
URLs (1):
http://evil.example.com/a
IPv4 addresses (1):
203.0.113.5
Emails (1):
bad@phish.net
Domains (1):
cdn.badsite.io
File paths (1):
C:\Windows\System32\cmd.exe
Registry keys (1):
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
```
## FAQ
What is the difference between ASCII and UTF-16LE strings?
Classic `strings` finds **ASCII** runs — sequences of printable 7-bit bytes.
Windows stores much of its text as **UTF-16LE** (each character followed by a
`0x00` byte), so a plain ASCII scan misses it. Set **encoding** to `both`
(the default) to recover ASCII and wide runs, or pick one when you know the
source. This mirrors `strings -e l` for the wide path.
My dump is binary — how do I paste it?
Text fields can't carry raw non-printable bytes, so paste a **hex-encoded
dump** and set **Input format** to `hex`. The decoder accepts contiguous hex,
bytes separated by spaces, colons or commas, and optional `0x` prefixes — e.g.
`48 65 6c 6c 6f`, `48:65:6c`, or `0x48 0x65`. This keeps the null bytes that a
UTF-16LE scan needs, which pasting the raw text would strip.
Why do I see fewer or more strings when I change min length?
**Minimum run length** is the `strings -n` floor: runs shorter than it are
treated as noise and dropped. The default is `4`. Lower it (down to `1`) to
catch short tokens at the cost of more junk, or raise it to keep only longer,
more meaningful strings. The count in the header reflects how many runs survived
the floor.
Does this extract file hashes too?
No — hash extraction (MD5/SHA-1/SHA-256/…) is intentionally left to the separate
**IOC Extractor** tool so the two don't overlap. This tool focuses on the
`strings`-style recovery plus the memory-forensics categories (file paths and
registry keys) that a hash extractor doesn't cover. Run both if you need hashes
as well.
Is my dump uploaded anywhere?
No. The extraction and categorization run entirely in your browser via
WebAssembly. The dump you paste never leaves your machine — there is no server
call, no account and no logging.
## Related tools
- [Defang / Refang IOCs](https://gizza.ai/tools/ioc-defang/): Defang or refang IOCs in your browser: turn http://evil.com into hxxp[://]evil[.]com so URLs, IPs, domains and emails are safe to share. Free, private.
- [IOC Extractor](https://gizza.ai/tools/ioc-extract/): Extract IOCs from threat reports in your browser — IPs, URLs, domains, emails, MD5/SHA hashes — with defanged (hxxp, [.]) input support. Free, private, no sign-up.
- [LZNT1 Decompress](https://gizza.ai/tools/lznt1-decompress/): Decompress LZNT1 (Windows RtlCompressBuffer) blobs from hex or Base64 in your browser — registry hives, hiberfil, malware configs. Free, private, no sign-up.
- [AES cipher](https://gizza.ai/tools/aes-cipher/): Encrypt or decrypt text with AES in CBC, CTR, GCM or ECB mode and 128/192/256-bit keys, with hex/base64 I/O — in your browser. Nothing is uploaded.
- [AES Key Wrap](https://gizza.ai/tools/aes-key-wrap/): Wrap and unwrap cryptographic keys with AES Key Wrap (KW / RFC 3394, KWP / RFC 5649) using a 128/192/256-bit KEK — hex or base64, free and in-browser.