RAFIND2(1) General Commands Manual RAFIND2(1)

rafind2 — advanced command-line byte pattern search in files

rafind2 [-a align] [-b size] [-c] [-e regex] [-f from] [-F file] [-h] [-i] [-j] [-L] [-m] [-M mask] [-n] [-q] [-r] [-s str] [-S str] [-t to] [-v] [-V s:num | s:num1,num2] [-x hex] [-X] [-z] [-Z] file|dir ..

rafind2 is a versatile program designed to find byte patterns in files.

The following options are available:

align
Only accept aligned search results.
size
Define the block size for searching. Depending on the cpu cache, memory and storage different sizes may affect the performance.
Disable colorful output, primarily useful for non-interactive or batch use-cases.
regex
Search for matches using regular expressions. Multiple expressions can be provided.
from
Specify the starting address for the search. (See -t)
file
Read keywords from the specified file for searching.
Display the help message.
Identify the filetype using similar techniques as the 'file' command.
Output results in JSON format.
List all available I/O plugins.
Perform magic search to identify file types based on signatures.
mask
Apply a binary mask to the keywords before searching.
Continue searching even if read errors occur.
Quiet mode: suppress headings or filenames in the output.
Print results using radare commands.
str
Search for the specified string(s) in the file(s).
str
Search for wide strings (Unicode) in the file(s).
to
Specify the ending address for the search. (See -f)
Display the version of rafind2 and exit.
s:num | s:num1,num2
Search for the given value using little-endian notation. A single value can be specified (e.g., -V 4:123) or a range of values can be searched by providing two values separated by a comma (e.g., -V 4:100,200).
hex
Search for the specified hex pattern(s) in the file(s).
Display the hexdump of search results.
Search for zero-terminated strings.
Display strings found on each search hit.

Search for a specific string in a file:

$ rafind2 -s "search_string" file.txt

Search for a hex pattern in all the files from directory:

$ rafind2 -x "909090" directory_path

Identify the file type using the magic database:

$ rafind2 -i binary_file

Search for the little endian 123 stored in a 4 byte word inside a file:

$ rafind2 -V 4:123 file.bin

radare2(1)

https://www.radare.org/

pancake <pancake@nopcode.org>

March 16, 2024