RAFIND2(1)

NAME
rafind2 - advanced command-line byte pattern search in files

SYNOPSIS
rafind2 [-mBXnzZhqv] [-a align] [-b size] [-f from] [-t to] [-[e|s|S] str] [-x hex] [-E] [-F file] [-g] [-i] [-I str] [-j] [-L] [-M str] [-R str] [-r] [-c] [-V s:num | s:num1,num2] -|file|dir ...

DESCRIPTION
A versatile utility for searching byte patterns in files, supporting alignment, offset ranges, string and hexadecimal queries, and customizable output formats.

The following options are available:

-a align
    Only accept aligned hits

-b size
    Set block size

-B  Use big endian instead of little endian (See -V)

-c  Disable colorful output (mainly for for -X)

-e regex
    Search for regex matches (can be used multiple times)

-E  Perform a search using an esil expression

-f from
    Start searching from address 'from'

-F file
    Read the contents of the file and use it as keyword

-g  Insert the replacement and resize the file (only with -R)

-h  Show help message

-i  Identify filetype (r2 -nqcpm file)

-I str
    Filter files by rbin info (arch/type/bits/...) before searching

-j  Output in JSON

-L  List all IO plugins (same as r2 for now)

-m  Magic search, file-type carver

-M str
    Set a binary mask to be applied on keywords

-R str
    Replace each hit with the given string (prefix with h: hex, w: wide, s: string)

-n  Do not stop on read errors

-r  Print using radare commands

-s str
    Search for a string (more than one string can be passed)

-S str
    Search for a wide string (more than one string can be passed)

-t to
    Stop search at address 'to'

-q  Quiet mode: fewer output do not show headings or filenames

-v  Show version information

-V s:num | s:num1,num2
    Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)

-x hex
    Search for hexpair string (909090) with optional nibble mask using dots (41.42) (can be used multiple times)

-X  Show hexdump of search results

-z  Search for zero-terminated strings

-Z  Show string found on each search hit

ENVIRONMENT

rafind2 does not use any environment variables.

EXAMPLES

Search for a specific string in a file:

    $ rafind2 -s "search_string" file.txt

Search for a hex pattern in all the files from directory:

    $ rafind2 -x "909090" directory_path

Search for hex pattern with nibble mask (dot masks single nibble):

    $ rafind2 -x "41.42" file.bin

Identify the file type:

    $ rafind2 -i binary_file

Search for the little endian 123 stored in a 4-byte word:

    $ rafind2 -V 4:123 file.bin

Search for a range of values (100-200) in a 4-byte word:

    $ rafind2 -V 4:100,200 file.bin

Search for zero-terminated strings and show each string found:

    $ rafind2 -zZ file.bin

Search using regex pattern:

    $ rafind2 -e "password|passwd" file.txt

Show hexdump of search results:

    $ rafind2 -X -s "hello" file.bin

Replace string hits in a file:

    $ rafind2 -s "old" -R "new" file.bin

SEE ALSO

radare2(1)

AUTHORS

pancake <pancake@nopcode.org>