---
name: "rafind2"
section: "1"
platform: "linux"
package: "radare2"
version: "6.2.2-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/rafind2"
---

# rafind2(1)

advanced command-line byte pattern search in files

## NAME

**rafind2** – advanced command-line byte pattern search in files

## SYNOPSIS

**rafind2** \[**-mBXnzZhqv**\] \[**-a** *align*\] \[**-b** *size*\] \[**-f** *from*\] \[**-t** *to*\] \[**-\[e\|s\|S\]** *str*\] \[**-x** *hex*\] \[**-E**\] \[**-F** *file*\] \[**-g**\] \[**-i**\] \[**-I** *str*\] \[**-j**\] \[**-L**\] \[**-M** *str*\] \[**-R** *str*\] \[**-r**\] \[**-c**\] \[**-V** *s:num* \| *s:num1,num2*\] *-\|file\|dir* *...*

## DESCRIPTION

A versatile utility for searching byte patterns in files, supporting alignment, offset ranges, string and hexadecimal queries, and customizable output formats.

The following options are available:

- **-a** *align*

  Only accept aligned hits

- **-b** *size*

  Set block size

- **-B**

  Use big endian instead of little endian (See -V)

- **-c**

  Disable colorful output (mainly for for -X)

- **-e** *regex*

  Search for regex matches (can be used multiple times)

- **-E**

  Perform a search using an esil expression

- **-f** *from*

  Start searching from address 'from'

- **-F** *file*

  Read the contents of the file and use it as keyword

- **-g**

  Insert the replacement and resize the file (only with -R)

- **-h**

  Show help message

- **-i**

  Identify filetype (r2 -nqcpm file)

- **-I** *str*

  Filter files by rbin info (arch/type/bits/...) before searching

- **-j**

  Output in JSON

- **-L**

  List all IO plugins (same as r2 for now)

- **-m**

  Magic search, file-type carver

- **-M** *str*

  Set a binary mask to be applied on keywords

- **-R** *str*

  Replace each hit with the given string (prefix with h: hex, w: wide, s: string)

- **-n**

  Do not stop on read errors

- **-r**

  Print using radare commands

- **-s** *str*

  Search for a string (more than one string can be passed)

- **-S** *str*

  Search for a wide string (more than one string can be passed)

- **-t** *to*

  Stop search at address 'to'

- **-q**

  Quiet mode: fewer output do not show headings or filenames

- **-v**

  Show version information

- **-V** *s:num* \| *s:num1,num2*

  Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)

- **-x** *hex*

  Search for hexpair string (909090) with optional nibble mask using dots (41.42) (can be used multiple times)

- **-X**

  Show hexdump of search results

- **-z**

  Search for zero-terminated strings

- **-Z**

  Show string found on each search hit

## ENVIRONMENT

rafind2 does not use any environment variables.

## EXAMPLES

Search for a specific string in a file:

```
$ rafind2 -s "search_string" file.txt
```

Search for a hex pattern in all the files from directory:

```
$ rafind2 -x "909090" directory_path
```

Search for hex pattern with nibble mask (dot masks single nibble):

```
$ rafind2 -x "41.42" file.bin
```

Identify the file type:

```
$ rafind2 -i binary_file
```

Search for the little endian 123 stored in a 4-byte word:

```
$ rafind2 -V 4:123 file.bin
```

Search for a range of values (100-200) in a 4-byte word:

```
$ rafind2 -V 4:100,200 file.bin
```

Search for zero-terminated strings and show each string found:

```
$ rafind2 -zZ file.bin
```

Search using regex pattern:

```
$ rafind2 -e "password|passwd" file.txt
```

Show hexdump of search results:

```
$ rafind2 -X -s "hello" file.bin
```

Replace string hits in a file:

```
$ rafind2 -s "old" -R "new" file.bin
```

## SEE ALSO

[radare2(1)](/radare2/1.md)

## AUTHORS

pancake \<pancake@nopcode.org\>