rz-find1

Find byte patterns in files

Usage

rz-find [-hijmnrqvxzZ] [-a align] [-b size] [-f/t from/to] [- [{e | s | w | S | I}] str] [-x hex] [{- | file | dir ..}]

This command is part of the Rizin project.

rz-find Searches for specified byte patterns, strings, or hexpairs in the given files.

The options are:

-a align: Only accept aligned hits
-b size: Set block size
-e regex: Search for regex matches (can be used multiple times)
-f from: Start searching from address 'from'
-F file: Read the contents of the file and use it as a keyword
-h: Show usage help message
-i: Identify filetype (rizin -nqcpm file)
-j: Output in JSON
-m: Magic search, file-type carver
-M str: Set a binary mask to be applied on keywords
-n: Do not stop the search when a read error occurs
-r: Print using rizin commands
-s str: Search for a specific string (can be used multiple times)
-w str: Search for a specific wide string (can be used multiple times). Assumes str is UTF-8
-I str: Search for an entry in import table
-S str: Search for a symbol in symbol table
-t to: Stop search at address 'to'
-q: Quiet mode - do not show headings (filenames) above matching contents (default for searching a single file)
-v: Show version information
-x hex: Search for an hexpair string (can be used multiple times)
-X: Show hexdump of search results
-z: Search for zero-terminated strings
-Z: Show string found on each search hit
-E command: Execute <command> for each file found.