# stackstrings

> **Tool `tools/pe/stackstrings.py`** (program, Windows PE). Find text that the code builds on the stack a few bytes at a time, which a list of strings in the file does not show.

Run it with `./gameframe run stackstrings ARGS` or `python3 tools/pe/stackstrings.py`. [Source on GitHub](https://github.com/tanepiper/game-frame/blob/main/tools/pe/stackstrings.py).

## Its own help

This is the help text in the tool itself, as `./gameframe tool stackstrings` prints it.

```text
Find text that the code builds on the stack a few bytes at a time, which a list of strings
in the file does not show.

Usage: stackstrings.py BINARY [--min N] [--json]
       stackstrings.py RAW --raw --bits 16|32|64 --base ADDR [--min N]

A compiler that initialises a local `char name[] = "SAVE0.DAT"` often writes it with a row of
`mov` instructions holding the bytes as immediate values: `mov dword [ebp-0x10], 0x45564153`.
The text then appears in no string list and in no Ghidra string table. Some protections and
some games also build file names, keys and messages this way on purpose. This tool
disassembles the executable sections (capstone) and joins the immediate values that are
stored to neighbouring stack offsets into text, ordered by offset.

Each result gives the address of the first store, the stack offset and the text. Open the
function at that address: the text is a local variable, and the code that uses it is close by.
`--min` sets the shortest text reported (default 4). Windows PE files are read with their
sections. Any other code (a DOS program's load image, a memory dump) can be given with --raw,
its CPU mode and its base address. Needs capstone (.venv).
```

## Named by

Skills: [re-inventory](/skills/re-inventory).