Hi Mike,

Does malfind plugin + yara rule(s) work for your use case?

DS

On Apr 14, 2012, at 9:12 PM, Mike Lambert <dragonforen@hotmail.com> wrote:

I have read the command reference for the strings plugin and do not see an option to specify the string to look for in anything other than ascii.

Could strings be expanded to include hex values, perhaps in the form of \x55\x5e\xe2\xfd\x83\xc4 or something like that?
 
Thanks,
Mike Lambert
 

_______________________________________________
Vol-users mailing list
Vol-users@volatilityfoundation.org
http://lists.volatilityfoundation.org/mailman/listinfo/vol-users