rafind2(1)

NAME

rafind2 – advanced command-line byte pattern search in files

SYNOPSIS

DESCRIPTION

A versatile utility for searching byte patterns in files, supporting alignment, offset ranges, string and hexadecimal queries, and customizable output formats.

The following options are available:

-a align: Only accept aligned hits
-b size: Set block size
-B: Use big endian instead of little endian (See -V)
-c: Disable colorful output (mainly for for -X)
-e regex: Search for regex matches (can be used multiple times)
-E: Perform a search using an esil expression
-f from: Start searching from address 'from'
-F file: Read the contents of the file and use it as keyword
-g: Insert the replacement and resize the file (only with -R)
-h: Show help message
-i: Identify filetype (r2 -nqcpm file)
-I str: Filter files by rbin info (arch/type/bits/...) before searching
-j: Output in JSON
-L: List all IO plugins (same as r2 for now)
-m: Magic search, file-type carver
-M str: Set a binary mask to be applied on keywords
-R str: Replace each hit with the given string (prefix with h: hex, w: wide, s: string)
-n: Do not stop on read errors
-r: Print using radare commands
-s str: Search for a string (more than one string can be passed)
-S str: Search for a wide string (more than one string can be passed)
-t to: Stop search at address 'to'
-q: Quiet mode: fewer output do not show headings or filenames
-v: Show version information
-V s:num | s:num1,num2: Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)
-x hex: Search for hexpair string (909090) with optional nibble mask using dots (41.42) (can be used multiple times)
-X: Show hexdump of search results
-z: Search for zero-terminated strings
-Z: Show string found on each search hit

ENVIRONMENT

rafind2 does not use any environment variables.

EXAMPLES

Search for a specific string in a file:

$ rafind2 -s "search_string" file.txt

Search for a hex pattern in all the files from directory:

$ rafind2 -x "909090" directory_path

Search for hex pattern with nibble mask (dot masks single nibble):

$ rafind2 -x "41.42" file.bin

Identify the file type:

$ rafind2 -i binary_file

Search for the little endian 123 stored in a 4-byte word:

$ rafind2 -V 4:123 file.bin

Search for a range of values (100-200) in a 4-byte word:

$ rafind2 -V 4:100,200 file.bin

Search for zero-terminated strings and show each string found:

$ rafind2 -zZ file.bin

Search using regex pattern:

$ rafind2 -e "password|passwd" file.txt

Show hexdump of search results:

$ rafind2 -X -s "hello" file.bin

Replace string hits in a file:

$ rafind2 -s "old" -R "new" file.bin

AUTHORS

pancake <[email protected]>