RAFIND2(1)

NAME
rafind2 - advanced command-line byte pattern search in files

SYNOPSIS
rafind2 [-mBXnzZhqv] [-a align] [-b size] [-f from] [-t to] [-[e|s|S] str] [-x hex] [-E] [-F file] [-i] [-j] [-L] [-M str] [-r] [-c] [-V s:num | s:num1,num2] -|file|dir ...

DESCRIPTION
A versatile utility for searching byte patterns in files, supporting alignment, offset ranges, string and hexadecimal queries, and customizable output formats.

The following options are available:

-a align
    Only accept aligned hits

-b size
    Set block size

-B  Use big endian instead of little endian (See -V)

-c  Disable colorful output (mainly for for -X)

-e regex
    Search for regex matches (can be used multiple times)

-E  Perform a search using an esil expression

-f from
    Start searching from address 'from'

-F file
    Read the contents of the file and use it as keyword

-h  Show help message

-i  Identify filetype (r2 -nqcpm file)

-j  Output in JSON

-L  List all IO plugins (same as r2 for now)

-m  Magic search, file-type carver

-M str
    Set a binary mask to be applied on keywords

-n  Do not stop on read errors

-r  Print using radare commands

-s str
    Search for a string (more than one string can be passed)

-S str
    Search for a wide string (more than one string can be passed)

-t to
    Stop search at address 'to'

-q  Quiet mode: fewer output do not show headings or filenames

-v  Show version information

-V s:num | s:num1,num2
    Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)

-x hex
    Search for hexpair string (909090) (can be used multiple times)

-X  Show hexdump of search results

-z  Search for zero-terminated strings

-Z  Show string found on each search hit

ENVIRONMENT

rafind2 does not use any environment variables.

EXAMPLES

Search for a specific string in a file:

    $ rafind2 -s "search_string" file.txt

Search for a hex pattern in all the files from directory:

    $ rafind2 -x "909090" directory_path

Identify the file type:

    $ rafind2 -i binary_file

Search for the little endian 123 stored in a 4-byte word:

    $ rafind2 -V 4:123 file.bin

Search for a range of values (100-200) in a 4-byte word:

    $ rafind2 -V 4:100,200 file.bin

Search for zero-terminated strings and show each string found:

    $ rafind2 -zZ file.bin

Search using regex pattern:

    $ rafind2 -e "password|passwd" file.txt

Show hexdump of search results:

    $ rafind2 -X -s "hello" file.bin

SEE ALSO

radare2(1)

AUTHORS

pancake <pancake@nopcode.org>