.Dd Feb 4, 2026 .Dt RAFIND2 1 .Sh NAME .Nm rafind2 .Nd advanced command-line byte pattern search in files .Sh SYNOPSIS .Nm rafind2 .Op Fl mBXnzZhqv .Op Fl a Ar align .Op Fl b Ar size .Op Fl f Ar from .Op Fl t Ar to .Op Fl [e|s|S] Ar str .Op Fl x Ar hex .Op Fl E .Op Fl F Ar file .Op Fl g .Op Fl i .Op Fl I Ar str .Op Fl j .Op Fl L .Op Fl M Ar str .Op Fl R Ar str .Op Fl r .Op Fl c .Op Fl V Ar s:num | s:num1,num2 .Ar -|file|dir ... .Sh DESCRIPTION A versatile utility for searching byte patterns in files, supporting alignment, offset ranges, string and hexadecimal queries, and customizable output formats. .Pp The following options are available: .Bl -tag -width Fl .It Fl a Ar align Only accept aligned hits .It Fl b Ar size Set block size .It Fl B Use big endian instead of little endian (See -V) .It Fl c Disable colorful output (mainly for for -X) .It Fl e Ar regex Search for regex matches (can be used multiple times) .It Fl E Perform a search using an esil expression .It Fl f Ar from Start searching from address 'from' .It Fl F Ar file Read the contents of the file and use it as keyword .It Fl g Insert the replacement and resize the file (only with -R) .It Fl h Show help message .It Fl i Identify filetype (r2 -nqcpm file) .It Fl I Ar str Filter files by rbin info (arch/type/bits/...) before searching .It Fl j Output in JSON .It Fl L List all IO plugins (same as r2 for now) .It Fl m Magic search, file-type carver .It Fl M Ar str Set a binary mask to be applied on keywords .It Fl R Ar str Replace each hit with the given string (prefix with h: hex, w: wide, s: string) .It Fl n Do not stop on read errors .It Fl r Print using radare commands .It Fl s Ar str Search for a string (more than one string can be passed) .It Fl S Ar str Search for a wide string (more than one string can be passed) .It Fl t Ar to Stop search at address 'to' .It Fl q Quiet mode: fewer output do not show headings or filenames .It Fl v Show version information .It Fl V Ar s:num | s:num1,num2 Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200) .It Fl x Ar hex Search for hexpair string (909090) with optional nibble mask using dots (41.42) (can be used multiple times) .It Fl X Show hexdump of search results .It Fl z Search for zero-terminated strings .It Fl Z Show string found on each search hit .El .Sh ENVIRONMENT .Pp rafind2 does not use any environment variables. .Sh EXAMPLES .Pp Search for a specific string in a file: .Bd -literal -offset indent $ rafind2 -s "search_string" file.txt .Ed .Pp Search for a hex pattern in all the files from directory: .Bd -literal -offset indent $ rafind2 -x "909090" directory_path .Ed .Pp Search for hex pattern with nibble mask (dot masks single nibble): .Bd -literal -offset indent $ rafind2 -x "41.42" file.bin .Ed .Pp Identify the file type: .Bd -literal -offset indent $ rafind2 -i binary_file .Ed .Pp Search for the little endian 123 stored in a 4-byte word: .Bd -literal -offset indent $ rafind2 -V 4:123 file.bin .Ed .Pp Search for a range of values (100-200) in a 4-byte word: .Bd -literal -offset indent $ rafind2 -V 4:100,200 file.bin .Ed .Pp Search for zero-terminated strings and show each string found: .Bd -literal -offset indent $ rafind2 -zZ file.bin .Ed .Pp Search using regex pattern: .Bd -literal -offset indent $ rafind2 -e "password|passwd" file.txt .Ed .Pp Show hexdump of search results: .Bd -literal -offset indent $ rafind2 -X -s "hello" file.bin .Ed .Pp Replace string hits in a file: .Bd -literal -offset indent $ rafind2 -s "old" -R "new" file.bin .Ed .Sh SEE ALSO .Pp .Xr radare2 1 .Sh AUTHORS .Pp pancake