find binary files in windows

Question

Is there any way to search for executable files in windows when it has been renamed? Say a .exe file has been renamed to a .txt or a .jpeg extension.

Answer 1

You can use the Unix file utility, which can tell you what a file is based on its contents. You will need either the Cygwin environment or a win32-port package like GnuWin32 or UnxUtils.

Here's how file works:

# previously, e.exe was renamed to e.jpg
$ file e.jpg
e.jpg: MS-DOS executable PE  for MS Windows (console) Intel 80386 32-bit

Obviously, you have to give file a filename (or list of filenames) as an argument(s). You could do this with find if you know roughly where the file should be, by using find and a folder name:

$ find <foldername> -type f -print0 | xargs -0 file

If you combine this with grep, you can strip out the non-executables:

$ find e-0.02718 -type f -print0 | xargs -0 file | grep executable
e-0.02718/e.jpg:          MS-DOS executable PE  for MS Windows (console) Intel 80386 32-bit
e-0.02718/e.linux:        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.0.0, dynamically linked (uses shared libs), stripped
e-0.02718/e.sun4u56:      ELF 32-bit MSB executable, SPARC, version 1 (SYSV), dynamically linked (uses shared libs), stripped
e-0.02718/EXAMPLES:       Bourne shell script text executable
e-0.02718/makefile:       script text executable for make -f

Cygwin and GnuWin32 both provide the file and find commands (via the file and findutils packages).

UnxUtils includes find, but I can't verify that the file command is included. The package does not appear to be maintained, so GnuWin32 is probably a better option.

Answer 2

If i understand you OK, no.

still you could search for the filename...

BTW: why would you possibly change the extension of a EXE to txt, jpeg or so? There is no advantage of it and will lead in a txt matter to a bunch of unusable chars and jpeg to a 'cannot open'.

(i would change your tags, use something like 'exe' or 'search'

Answer 3

Problem is we're trying to hunt a specific file that users on our network are always hiding. They could be so creative that they sometimes rename it a .jpeg or .txt and later rename it again to .exe. Sometimes it's under a zip file, possibility is limitless.

-edit- I can't seem to claim my question and can't edit it. How do you add comments on the answers?

Answer 4

I would just make a search using a specific enough portion within the targetted file (which is apparently known in that case) ; it might be very slow, depending on the amount of data to process, but theoretically no more than any solution which would specifically recognize EXE files according to their content. It may not work with Windows Explorer though, because searching inside files is possible only for a limited range of extensions (for example, I tried to locate a specific portion of dialogue in SRT subtitle files but couldn't find a match, yet there was indeed a file containing the relevant portion).