RZ_FIND(1)

NAME
rz-find - Find byte patterns in files

SYNOPSIS
rz-find [-hijmnrqvxzZ] [-a align] [-b size] [-f/t from/to] [- [e|s|w|S|I] str] [-x hex] file|dir [file|dir ...]

DESCRIPTION
This command is part of the Rizin project.

rz-find searches for specified byte patterns, strings, or hexpairs in the given files. Multiple files and/or directories can be specified as arguments. When a directory is provided, it is searched recursively.

When searching a single file, quiet mode is enabled by default (no filename headers). When searching multiple files or directories, each result is prefixed with the filename unless -q is specified.

The options are:

-a align
    Only accept aligned hits

-b size
    Set block size

-e regex
    Search for regex matches (can be used multiple times)

-E cmd
    Execute shell command for each file found.

-R cmd
    Execute Rizin command for each search hit.

-f from
    Start searching from address 'from'

-F file
    Read the contents of the file and use it as a keyword

-h  Show usage help message

-i  Identify filetype (magic signatures)

-j  Output in JSON format. Results are returned as a JSON array of objects.

-m  Magic search, file-type carver

-M str
    Set a binary mask to be applied on keywords

-n  Do not stop the search when a read error occurs. Continue to next block or file.

-s str
    Search for a specific string (can be used multiple times)

-w str
    Search for a specific wide string (can be used multiple times). Assumes str is UTF-8

-I str
    Search for an entry in import table

-S str
    Search for a symbol in symbol table

-t to
    Stop search at address 'to'

-q  Quiet mode - do not show headings (filenames) above matching contents (default for searching a single file)

-v  Show version information

-V  Verbose mode - show each file being scanned. When combined with -j, verbose output is written to stderr to preserve stdout for JSON results.

-x hex
    Search for an hexpair string (can be used multiple times)

-X  Show hexdump of search results

-z  Search for zero-terminated strings

-Z  Show string found on each search hit

MULTIPLE FILES AND DIRECTORIES
rz-find supports searching across multiple files and directories in a single invocation.

When multiple paths are provided:
•   Each file is searched in the order specified.
•   Directories are searched recursively (hidden files starting with '.' are skipped).
•   If any file cannot be opened or read, an error is printed but processing continues with remaining files.
•   The exit code reflects whether all files were processed successfully (0) or if any errors occurred (1).

EXIT STATUS

0   All files were processed successfully.

1   One or more files could not be opened or had read errors, or invalid arguments were provided.

EXAMPLES
Search for a string in a single file:

    rz-find -s "password" firmware.bin

Search for a hex pattern in multiple files:

    rz-find -x "cafebabe" file1.bin file2.bin file3.bin

Recursively search a directory for a string:

    rz-find -s "secret" /path/to/firmware/

Search multiple directories and files with JSON output:

    rz-find -j -s "config" dir1/ dir2/ standalone.bin

Search for zero-terminated strings in a binary with JSON output:

    rz-find -z -j firmware.bin

Verbose search showing files being scanned:

    rz-find -V -s "pattern" *.bin

Search with aligned hits (power of 2):

    rz-find -a 4 -x "00000000" memory.dump

SEE ALSO
rizin(1), rz-asm(1), rz-ax(1), rz-bin(1), rz-diff(1), rz-gg(1), rz-hash(1), rz-run(1)

AUTHORS
pancake <pancake@nopcode.org>

byteninjaa0