RZ-FIND(1)

💖 NAME 💖

rz-find — Find byte patterns in files. Bestie, this is the whole RZ_FIND(1) manual, and it is literally here to help you find byte patterns in files. No cap.

✨ SYNOPSIS ✨

rz-find [-hijmnrqvxzZ] [-a align] [-b size] [-f/t from/to]
        [-[e|s|w|S|I] str] [-x hex] [-|file|dir ..]

🌸 DESCRIPTION 🌸

Okay so first thing: this command is part of the Rizin project — periodt. rz-find searches for the specified byte patterns, strings, or hexpairs in the given files. It's giving "where are those bytes hiding" main character energy, and we love that for you 💅

💅 The options are:

• -a align — Only accept aligned hits. Alignment girlies, this one is for you ✨
• -b size — Set block size. Pick your block size, bestie 🎀
• -e regex — Search for regex matches (can be used multiple times). Regex stans stay winning 😭
• -f from — Start searching from address 'from'. Yes, from that address exactly.
• -F file — Read the contents of the file and use it as a keyword. Iconic behavior, ngl.
• -h — Show usage help message. The classic "help me bestie" button 🫶
• -i — Identify filetype (rizin -nqcpm file). Literally a filetype vibe check 💅
• -j — Output in JSON. For the structured-data girlies ✨
• -m — Magic search, file-type carver. Spooky little file-type carver behavior 🔥
• -M str — Set a binary mask to be applied on keywords. Mask on, mask off, you know how it is 🎀
• -n — Do not stop the search when a read error occurs. Keep going, bestie, even when reading gets messy 😭
• -r — Print using rizin commands. Rizin-command-core fr fr.
• -s str — Search for a specific string (can be used multiple times). Stack those strings, queen 👑
• -w str — Search for a specific wide string (can be used multiple times). Assumes str is UTF-8. Wide-string moment, no cap.
• -I str — Search for an entry in import table. Import table sleuthing, iykyk 🦋
• -S str — Search for a symbol in symbol table. Symbol table girlies rise 🌸
• -t to — Stop search at address 'to'. That's the cutoff, bestie.
• -q — Quiet mode - do not show headings (filenames) above matching contents (default for searching a single file). Shhh, it's giving stealth mode 🙈
• -v — Show version information. Version check, because we stay informed ⭐
• -x hex — Search for an hexpair string (can be used multiple times). Hexpair hunting, let's go 🔥
• -X — Show hexdump of search results. Hexdump reveal, iconic 💜
• -z — Search for zero-terminated strings. Zero-terminated string search, periodt.
• -Z — Show string found on each search hit. Every hit gets its string moment ✨
• -E command — Execute <command> for each file found. Do the thing for every file you find, bestie.

🫶 SEE ALSO 🫶

Go check out these other icons when you're done: rizin(1), rz-hash(1), rz-bin(1), rz-diff(1), rz-asm(1), rz-gg(1), rz-run(1), rz-ax(1). They're all in the group chat too 🫶

🎀 AUTHORS 🎀

This page was brought to you by:

• pancake <pancake@nopcode.org>
• byteninjaa0

And that's the whole RZ_FIND(1) manual, dated Jan 24, 2024 — now go find those bytes, bestie 💅🦋✨