Quick tip: Trim null-terminated strings

Recently, when reading string data from a binary file, I stumbled across the “problem” of trimming the terminating character from a null-terminated string. I started getting all creative about it, but it soon became quite a mess (code-wise), so I that down and had a re-think. This is how I ultimately ended up doing it.

Before I describe my solution, let’s create some code to visualize the problem:

[byte[]]$bytes = 0x50,0x00,0x72,0x00,0x6F,0x00,0x67,0x00,0x72,0x00,0x61,0x00,0x6D,0x00,0x6D,0x00,0x65,0x00,0x00,0x00
$unicodeString = [System.Text.Encoding]::Unicode.GetString($bytes)
"'$($unicodeString)'"

Running this code will give you the following result:
null_terminating_strings01

Notice that I have wrapped the output value of the variable unicodeString in quotation marks to see the full length of the string. You can clearly “see” the last null character being there.

Being a string object, we should be able to use the Trim-method:

"'$($unicodeString.Trim())'"

Result:
null_terminating_strings02

This clearly didn’t work though, and to understand why, we need to think about what a null-terminating string actually is. Well, that shouldn’t be too difficult, as the answer is in the name; it’s a string with a terminating null character. But then why don’t Trim work? The reason is that this particular null character is not the same as an empty string, or even $null. It’s the ASCII character NUL. It so happens that this is the first character in the ASCII-table, so we can easily modify our previous code to get the desired result:

"'$($unicodeString.Trim([char]0))'"

Result:
null_terminating_strings03

That’s more like it.

Hope this short post have been helpful.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s