RAFIND2(1)

NAME
rafind2 - advanced command-line byte pattern search in files

SYNOPSIS
rafind2 [-a align] [-b size] [-c] [-e regex] [-f from] [-F file] [-h] [-i] [-j] [-L] [-m] [-M mask] [-n] [-q] [-r] [-s str] [-S str] [-t to] [-v] [-V s:num] [-x hex] [-X] [-z] [-Z] file|dir ..

DESCRIPTION
rafind2 is a versatile program designed to find byte patterns in files.

The following options are available:

-a align
    Only accept aligned search results.

-b size
    Define the block size for searching. Depending on the cpu cache, memory and storage different sizes may affect the performance.

-c  Disable colorful output, primarily useful for non-interactive or batch use-cases.

-e regex
    Search for matches using regular expressions. Multiple expressions can be provided.

-f from
    Specify the starting address for the search. (See -t)

-F file
    Read keywords from the specified file for searching.

-h  Display the help message.

-i  Identify the filetype using similar techniques as the 'file' command.

-j  Output results in JSON format.

-L  List all available I/O plugins.

-m  Perform magic search to identify file types based on signatures.

-M mask
    Apply a binary mask to the keywords before searching.

-n  Continue searching even if read errors occur.

-q  Quiet mode: suppress headings or filenames in the output.

-r  Print results using radare commands.

-s str
    Search for the specified string(s) in the file(s).

-S str
    Search for wide strings (Unicode) in the file(s).

-t to
    Specify the ending address for the search. (See -f)

-v  Display the version of rafind2 and exit.

-V s:num
    Search for the given value using little-endian notation (e.g., -V 4:123).

-x hex
    Search for the specified hex pattern(s) in the file(s).

-X  Display the hexdump of search results.

-z  Search for zero-terminated strings.

-Z  Display strings found on each search hit.

EXAMPLES

Search for a specific string in a file:

    $ rafind2 -s "search_string" file.txt

Search for a hex pattern in all the files from directory:

    $ rafind2 -x "909090" directory_path

Identify the file type using the magic database:

    $ rafind2 -i binary_file

Search for the little endian 123 stored in a 4 byte word inside a file:

    $ rafind2 -V 4:123 file.bin

SEE ALSO

radare2(1)

WWW

https://www.radare.org/

AUTHORS

pancake <pancake@nopcode.org>