NAME¶

rafind2 — advanced command-line byte pattern search in files

SYNOPSIS¶

DESCRIPTION¶

rafind2 is a versatile program designed to find byte patterns in files.

The following options are available:

-a align

Only accept aligned search results.

-b size

Define the block size for searching. Depending on the cpu cache, memory and storage different sizes may affect the performance.

-c

Disable colorful output, primarily useful for non-interactive or batch use-cases.

-e regex

Search for matches using regular expressions. Multiple expressions can be provided.

-f from

Specify the starting address for the search. (See -t)

-F file

Read keywords from the specified file for searching.

-h

Display the help message.

-i

Identify the filetype using similar techniques as the 'file' command.

-j

Output results in JSON format.

-L

List all available I/O plugins.

-m

Perform magic search to identify file types based on signatures.

-M mask

Apply a binary mask to the keywords before searching.

-n

Continue searching even if read errors occur.

-q

Quiet mode: suppress headings or filenames in the output.

-r

Print results using radare commands.

-s str

Search for the specified string(s) in the file(s).

-S str

Search for wide strings (Unicode) in the file(s).

-t to

Specify the ending address for the search. (See -f)

-v

Display the version of rafind2 and exit.

-V s:num

Search for the given value using little-endian notation (e.g., -V 4:123).

-x hex

Search for the specified hex pattern(s) in the file(s).

-X

Display the hexdump of search results.

-z

Search for zero-terminated strings.

-Z

Display strings found on each search hit.

EXAMPLES¶

Search for a specific string in a file:

$ rafind2 -s "search_string" file.txt

Search for a hex pattern in all the files from directory:

$ rafind2 -x "909090" directory_path

Identify the file type using the magic database:

$ rafind2 -i binary_file

Search for the little endian 123 stored in a 4 byte word inside a file:

$ rafind2 -V 4:123 file.bin

SEE ALSO¶

radare2(1)

WWW¶

https://www.radare.org/

AUTHORS¶

pancake <pancake@nopcode.org>