rafind21

Usage

Overview

A versatile utility for searching byte patterns in files, supporting alignment, offset ranges, string and hexadecimal queries, and customizable output formats.

The following options are available:

-a align

Only accept aligned hits

-b size

Set block size

-B

Use big endian instead of little endian (See -V)

-c

Disable colorful output (mainly for for -X)

-e regex

Search for regex matches (can be used multiple times)

-E

Perform a search using an esil expression

-f from

Start searching from address 'from'

-F file

Read the contents of the file and use it as keyword

-g

Insert the replacement and resize the file (only with -R)

-h

Show help message

-i

Identify filetype (r2 -nqcpm file)

-I str

Filter files by rbin info (arch/type/bits/...) before searching

-j

Output in JSON

-L

List all IO plugins (same as r2 for now)

-m

Magic search, file-type carver

-M str

Set a binary mask to be applied on keywords

-R str

Replace each hit with the given string (prefix with h: hex, w: wide, s: string)

-n

Do not stop on read errors

-r

Print using radare commands

-s str

Search for a string (more than one string can be passed)

-S str

Search for a wide string (more than one string can be passed)

-t to

Stop search at address 'to'

-q

Quiet mode: fewer output do not show headings or filenames

-v

Show version information

-V s:num | s:num1,num2

Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)

-x hex

Search for hexpair string (909090) with optional nibble mask using dots (41.42) (can be used multiple times)

-X

Show hexdump of search results

-z

Search for zero-terminated strings

-Z

Show string found on each search hit

Environment

rafind2 does not use any environment variables.

Examples

Search for a specific string in a file:

$ rafind2 -s "search_string" file.txt

Search for a hex pattern in all the files from directory:

$ rafind2 -x "909090" directory_path

Search for hex pattern with nibble mask (dot masks single nibble):

$ rafind2 -x "41.42" file.bin

Identify the file type:

$ rafind2 -i binary_file

Search for the little endian 123 stored in a 4-byte word:

$ rafind2 -V 4:123 file.bin

Search for a range of values (100-200) in a 4-byte word:

$ rafind2 -V 4:100,200 file.bin

Search for zero-terminated strings and show each string found:

$ rafind2 -zZ file.bin

Search using regex pattern:

$ rafind2 -e "password|passwd" file.txt

Show hexdump of search results:

$ rafind2 -X -s "hello" file.bin

Replace string hits in a file:

$ rafind2 -s "old" -R "new" file.bin