166 lines
4.1 KiB
Groff
166 lines
4.1 KiB
Groff
.Dd January 24, 2024
|
|
.Dt RZ_FIND 1
|
|
.Os
|
|
.Sh NAME
|
|
.Nm rz-find
|
|
.Nd Find byte patterns in files
|
|
.Sh SYNOPSIS
|
|
.Nm rz-find
|
|
.Op Fl hijmnrqvxzZ
|
|
.Op Fl a Ar align
|
|
.Op Fl b Ar size
|
|
.Op Fl f/t Ar from/to
|
|
.Op Fl Ar [e|s|w|S|I] str
|
|
.Op Fl x Ar hex
|
|
.Ar file|dir
|
|
.Op Ar file|dir ...
|
|
.Sh DESCRIPTION
|
|
This command is part of the Rizin project.
|
|
.Pp
|
|
.Nm rz-find
|
|
searches for specified byte patterns, strings, or hexpairs in the given files.
|
|
Multiple files and/or directories can be specified as arguments.
|
|
When a directory is provided, it is searched recursively.
|
|
.Pp
|
|
When searching a single file,
|
|
quiet mode is enabled by default (no filename headers).
|
|
When searching multiple files or directories,
|
|
each result is prefixed with the filename
|
|
unless
|
|
.Fl q
|
|
is specified.
|
|
.Pp
|
|
The options are:
|
|
.Bl -tag -width Fl
|
|
.It Fl a Ar align
|
|
Only accept aligned hits
|
|
.It Fl b Ar size
|
|
Set block size
|
|
.It Fl e Ar regex
|
|
Search for regex matches (can be used multiple times)
|
|
.It Fl E Ar cmd
|
|
Execute shell command for each file found.
|
|
.It Fl R Ar cmd
|
|
Execute Rizin command for each search hit.
|
|
.It Fl f Ar from
|
|
Start searching from address 'from'
|
|
.It Fl F Ar file
|
|
Read the contents of the file and use it as a keyword
|
|
.It Fl h
|
|
Show usage help message
|
|
.It Fl i
|
|
Identify filetype (magic signatures)
|
|
.It Fl j
|
|
Output in JSON format.
|
|
Results are returned as a JSON array of objects.
|
|
.It Fl m
|
|
Magic search, file-type carver
|
|
.It Fl M Ar str
|
|
Set a binary mask to be applied on keywords
|
|
.It Fl n
|
|
Do not stop the search when a read error occurs.
|
|
Continue to next block or file.
|
|
.It Fl s Ar str
|
|
Search for a specific string (can be used multiple times)
|
|
.It Fl w Ar str
|
|
Search for a specific wide string (can be used multiple times).
|
|
Assumes str is UTF-8
|
|
.It Fl I Ar str
|
|
Search for an entry in import table
|
|
.It Fl S Ar str
|
|
Search for a symbol in symbol table
|
|
.It Fl t Ar to
|
|
Stop search at address 'to'
|
|
.It Fl q
|
|
Quiet mode - do not show headings (filenames) above matching contents
|
|
(default for searching a single file)
|
|
.It Fl v
|
|
Show version information
|
|
.It Fl V
|
|
Verbose mode - show each file being scanned.
|
|
When combined with
|
|
.Fl j ,
|
|
verbose output is written to stderr to preserve stdout for JSON results.
|
|
.It Fl x Ar hex
|
|
Search for an hexpair string (can be used multiple times)
|
|
.It Fl X
|
|
Show hexdump of search results
|
|
.It Fl z
|
|
Search for zero-terminated strings
|
|
.It Fl Z
|
|
Show string found on each search hit
|
|
.El
|
|
.Sh MULTIPLE FILES AND DIRECTORIES
|
|
.Nm rz-find
|
|
supports searching across multiple files and directories in a single invocation.
|
|
.Pp
|
|
When multiple paths are provided:
|
|
.Bl -bullet -compact
|
|
.It
|
|
Each file is searched in the order specified.
|
|
.It
|
|
Directories are searched recursively
|
|
(hidden files starting with '.' are skipped).
|
|
.It
|
|
If any file cannot be opened or read,
|
|
an error is printed but processing continues with remaining files.
|
|
.It
|
|
The exit code reflects whether all files were processed successfully (0)
|
|
or if any errors occurred (1).
|
|
.El
|
|
.Sh EXIT STATUS
|
|
.Bl -tag -width Ds
|
|
.It 0
|
|
All files were processed successfully.
|
|
.It 1
|
|
One or more files could not be opened or had read errors,
|
|
or invalid arguments were provided.
|
|
.El
|
|
.Sh EXAMPLES
|
|
Search for a string in a single file:
|
|
.Bd -literal -offset indent
|
|
rz-find -s "password" firmware.bin
|
|
.Ed
|
|
.Pp
|
|
Search for a hex pattern in multiple files:
|
|
.Bd -literal -offset indent
|
|
rz-find -x "cafebabe" file1.bin file2.bin file3.bin
|
|
.Ed
|
|
.Pp
|
|
Recursively search a directory for a string:
|
|
.Bd -literal -offset indent
|
|
rz-find -s "secret" /path/to/firmware/
|
|
.Ed
|
|
.Pp
|
|
Search multiple directories and files with JSON output:
|
|
.Bd -literal -offset indent
|
|
rz-find -j -s "config" dir1/ dir2/ standalone.bin
|
|
.Ed
|
|
.Pp
|
|
Search for zero-terminated strings in a binary with JSON output:
|
|
.Bd -literal -offset indent
|
|
rz-find -z -j firmware.bin
|
|
.Ed
|
|
.Pp
|
|
Verbose search showing files being scanned:
|
|
.Bd -literal -offset indent
|
|
rz-find -V -s "pattern" *.bin
|
|
.Ed
|
|
.Pp
|
|
Search with aligned hits (power of 2):
|
|
.Bd -literal -offset indent
|
|
rz-find -a 4 -x "00000000" memory.dump
|
|
.Ed
|
|
.Sh SEE ALSO
|
|
.Xr rizin 1 ,
|
|
.Xr rz-asm 1 ,
|
|
.Xr rz-ax 1 ,
|
|
.Xr rz-bin 1 ,
|
|
.Xr rz-diff 1 ,
|
|
.Xr rz-gg 1 ,
|
|
.Xr rz-hash 1 ,
|
|
.Xr rz-run 1
|
|
.Sh AUTHORS
|
|
.An pancake <pancake@nopcode.org>
|
|
.Pp
|
|
byteninjaa0
|