/usr/bin/stng

stng extracts and classifies strings from binaries with a focus on
security research. It highlights IOCs like IPs, URLs, shell commands,
and suspicious paths while filtering noise. XOR-encoded strings are
detected by default.

EXAMPLES:
    stng malware.elf                            # Full analysis with single-byte XOR detection
    stng -i malware.elf                         # Filter out raw scan noise
    stng --xor 0xAB malware.elf                 # Decode with custom hex XOR key
    stng --xor "secretkey" malware.elf          # Decode with string XOR key
    stng --xorscan malware.elf                  # Deep scan with multi-byte XOR (slow, requires r2/rizin)
    stng --no-xor malware.elf                   # Disable all XOR detection
    stng --debug malware.elf                    # Show debug logging
    stng --json malware.elf                     # JSON output for tooling


Usage: stng [OPTIONS] <TARGET>

Arguments:
  <TARGET>
          Target binary file to analyze

Options:
  -m, --min-length <MIN_LENGTH>
          Minimum string length to extract

          [default: 4]

      --json
          Output as JSON

      --simple
          Simple output (one string per line, no columns)

      --detect
          Show detected language and exit

      --flat
          Don't group by section (flat output)

      --unfiltered
          Show unfiltered results including garbage/noise

      --r2
          Use radare2 for extraction (auto-detected by default)

      --no-r2
          Disable radare2 even if installed

      --no-color
          Disable colored output

  -i, --interesting
          Filter out raw scan noise (keep structured, r2, and symbol data)

      --no-xor
          Disable XOR-encoded string detection

      --xor <XOR>
          Custom XOR key (hex bytes like "0xABCD" or plain string)

      --xor-lcg <SEED,MUL,MOD,MASK,OFFSET,LENGTH>
          Decode an analyst-identified LCG-XOR range: seed,multiplier,modulus,mask,offset,length (decimal or 0x-prefixed)

      --xor-min-length <XOR_MIN_LENGTH>
          Minimum length for XOR-decoded strings

          [default: 10]

      --xorscan
          Enable advanced XOR scanning with radare2/rizin (slow but finds multi-byte keys)

      --no-cache
          Disable radare2/rizin result caching

      --flush-cache
          Clear cached r2 results for this file before analysis

      --debug
          Enable debug logging

  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version