Find Strings, located under the Tools menu, allows the user to find all of the text strings within a document or selection. While only strings containing ASCII characters are reported, Find Strings optionally locates ASCII strings stored as Unicode. Additionally, the user may restrict their search to only contain strings greater then a certain length or strings that end with a NULL character.

Parameters

Min Characters:

Defines the minimum number of characters (not bytes) required to be considered a string. Users may specify between 3 and 128 min characters. Strings are terminated at the first control character, carriage return, or linefeed.

Requires trailing Null

Restricts strings to those strings that end with a NULL (or zero) character.

ASCII, Uncode, Both:

Find Strings can report ASCII strings, ASCII strings stored as Unicode, or both ASCII and Unicode. The default is "Both", however selecting only ASCII or Unicode will quicken the search.

Apply On:

This operation can be performed on either the entire document or a selection within a document. This option is disabled (grayed) if no data was selected in the editor prior to starting the operation.

Find Results Window

Strings found by Hex Workshop are displayed under the "Find" tab of the "Results Window" as shown below:

Selecting one of the lines in the Find Results Window, scrolls the string into the hex editor’s window and selects the data. Right clicking on this window allows the user to clear the list (Clear), place the select line’s address onto the Window’s clipboard (Copy Address) , or copy all of the data to the Windows Clipboard (Copy All). If a search is still in progress, the user may also cancel the search by selecting "Cancel Find" from the right click context menu or pressing the "X" located in the upper right side of the Find Results Window.

Selecting "Copy All" from the right click context menu will format the data in tabbed text as shown below:

…

0x000159A0 0x00000010 FlushFileBuffers

0x00016040 0x0000000C RICHED32.DLL

0x00016064 0x0000000E CommonFilesDir

0x00016074 0x0000000F ProgramFilesDir

0x00016084 0x00000029 SOFTWARE\Microsoft\Windows\CurrentVersion

0x000160B8 0x0000000C %spftw%d.pkg

…

NOTE: The Find Results Window is limited to the first 128 bytes of each string.