rafind2 - advanced command-line byte pattern search in files
NAME
rafind2 — advanced command-line byte pattern search in files
SYNOPSIS
rafind2 [−mBXnzZhqv] [−a align] [−b size] [−f from] [−t to] [−[e|s|S] str] [−x hex] [−E] [−F file] [−i] [−j] [−L] [−M str] [−r] [−c] [−V s:num | s:num1,num2] -|file|dir ...
DESCRIPTION
A versatile utility for searching byte patterns in files, supporting alignment, offset ranges, string and hexadecimal queries, and customizable output formats.
The following options are available:
−a align
Only accept aligned hits
−b size
Set block size
−B
Use big endian instead of little endian (See -V)
−c
Disable colorful output (mainly for for -X)
−e regex
Search for regex matches (can be used multiple times)
−E
Perform a search using an esil expression
−f from
Start searching from address ’from’
−F file
Read the contents of the file and use it as keyword
−h
Show help message
−i
Identify filetype (r2 -nqcpm file)
−j
Output in JSON
−L
List all IO plugins (same as r2 for now)
−m
Magic search, file-type carver
−M str
Set a binary mask to be applied on keywords
−n
Do not stop on read errors
−r
Print using radare commands
−s str
Search for a string (more than one string can be passed)
−S str
Search for a wide string (more than one string can be passed)
−t to
Stop search at address ’to’
−q
Quiet mode: fewer output do not show headings or filenames
−v
Show version information
−V s:num | s:num1,num2
Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)
−x hex
Search for hexpair string (909090) (can be used multiple times)
−X
Show hexdump of search results
−z
Search for zero-terminated strings
−Z
Show string found on each search hit
ENVIRONMENT
rafind2 does not use any environment variables.
EXAMPLES
Search for a specific string in a file:
$ rafind2 -s "search_string" file.txt
Search for a hex pattern in all the files from directory:
$ rafind2 -x "909090" directory_path
Identify the file type:
$ rafind2 -i binary_file
Search for the little endian 123 stored in a 4-byte word:
$ rafind2 -V 4:123 file.bin
Search for a range of values (100-200) in a 4-byte word:
$ rafind2 -V 4:100,200 file.bin
Search for zero-terminated strings and show each string found:
$ rafind2 -zZ file.bin
Search using regex pattern:
$ rafind2 -e "password|passwd" file.txt
Show hexdump of search results:
$ rafind2 -X -s "hello" file.bin
SEE ALSO
radare2(1)
AUTHORS
pancake <[email protected]> Jul 10, 2025 RAFIND2(1)