RAFIND2(1)

💖 rafind2 — bestie's guide to hunting bytes (RAFIND2(1)) 💖

okay so you found the manual for rafind2, and honestly? this little tool is a whole main character. it's an advanced command-line byte pattern search in files, and it does NOT miss. we're in section 1 of the manual, she's iconic, let's go 🎀

---

✨ NAME ✨

rafind2 — advanced command-line byte pattern search in files 🦋

---

🌸 SYNOPSIS 🌸

rafind2 [-mBXnzZhqv] [-a align] [-b size] [-f from] [-t to]
        [-[e|s|S] str] [-x hex] [-E] [-F file] [-g] [-i] [-I str] [-j]
        [-L] [-M str] [-R str] [-r] [-c] [-V s:num | s:num1,num2]
        -|file|dir ...

yes, that's a lot of flags. yes, you're gonna learn all of them. periods only, bestie. 💅

---

💜 DESCRIPTION 💜

A versatile utility for searching byte patterns in files, supporting alignment, offset ranges, string and hexadecimal queries, and customizable output formats. it's giving swiss army knife but make it bytes 😤✨

The following options are available: 👇

---

✨ OPTIONS ✨

• -a align — Only accept aligned hits. if it ain't lined up, it ain't invited 🙅‍♀️
• -b size — Set block size. choose how much you're chewing at a time 🍓
• -B — Use big endian instead of little endian (See -V). big-endian girlies rise 🌈
• -c — Disable colorful output (mainly for for -X). yes, "for for". we keep it exactly as written, no cap 💀 also: no color today, we're being minimal
• -e regex — Search for regex matches (can be used multiple times). stack 'em, the more the merrier 🧚
• -E — Perform a search using an esil expression. esil arc, iykyk 👑
• -f from — Start searching from address from. we begin HERE and nowhere earlier ⭐
• -F file — Read the contents of the file and use it as keyword. let the file speak for itself, periodt 💖
• -g — Insert the replacement and resize the file (only with -R). careful bestie, this one actually TOUCHES your file 😭 respect it!!!
• -h — Show help message. lost? hello? she's here 🫶
• -i — Identify filetype (r2 -nqcpm file). detective mode 🔍
• -I str — Filter files by rbin info (arch/type/bits/...) before searching. vibe check on the metadata first 💅
• -j — Output in JSON. for when a machine is reading, not your eyes 🤖
• -L — List all IO plugins (same as r2 for now). window shopping, but plugins 🛍️
• -m — Magic search, file-type carver. very mysterious of her 🔮
• -M str — Set a binary mask to be applied on keywords. shape the keyword, don't change it 🌸
• -R str — Replace each hit with the given string (prefix with h: hex, w: wide, s: string). glow-up your bytes ✨
• -n — Do not stop on read errors. nothing can kill her momentum 🔥
• -r — Print using radare commands. output that r2 can literally eat 🍽️
• -s str — Search for a string (more than one string can be passed). the classic. the blueprint 💖
• -S str — Search for a wide string (more than one string can be passed). extra wide, extra slay 🌈
• -t to — Stop search at address to. we end HERE, no further ⛔
• -q — Quiet mode: fewer output do not show headings or filenames. she's being quiet, okay? shhh 🙈
• -v — Show version information. who is she? 🎀
• -V s:num | s:num1,num2 — Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200). numbers, but with range and endian drama 👑
• -x hex — Search for hexpair string (909090) with optional nibble mask using dots (41.42) (can be used multiple times). raw hex hunting 🌸
• -X — Show hexdump of search results. the receipts, rendered pretty 💅
• -z — Search for zero-terminated strings. the classic C-string look ✨
• -Z — Show string found on each search hit. every hit gets a lil speech bubble 💬

---

🌈 ENVIRONMENT 🌈

rafind2 does not use any environment variables. literally zero. she is self-sufficient, she needs NO external validation 💅✨

---

💖 EXAMPLES 💖

Search for a specific string in a file:

$ rafind2 -s "search_string" file.txt

Search for a hex pattern in all the files from directory:

$ rafind2 -x "909090" directory_path

Search for hex pattern with nibble mask (dot masks single nibble):

$ rafind2 -x "41.42" file.bin

Identify the file type:

$ rafind2 -i binary_file

Search for the little endian 123 stored in a 4-byte word:

$ rafind2 -V 4:123 file.bin

Search for a range of values (100-200) in a 4-byte word:

$ rafind2 -V 4:100,200 file.bin

Search for zero-terminated strings and show each string found:

$ rafind2 -zZ file.bin

Search using regex pattern:

$ rafind2 -e "password|passwd" file.txt

Show hexdump of search results:

$ rafind2 -X -s "hello" file.bin

Replace string hits in a file:

$ rafind2 -s "old" -R "new" file.bin

---

🦋 SEE ALSO 🦋

radare2(1) — her big sibling, go say hi 🫶

---

👑 AUTHORS 👑

pancake <pancake@nopcode.org>

---

and that's the whole page, bestie 💖 RAFIND2(1) — from section 1 of the manual, dated Feb 4, 2026. go search some bytes, you absolute superstar ⭐