rz-find - Man Page

This command is part of the Rizin project.

rz-find searches for specified byte patterns, strings, or hexpairs in the given files. Multiple files and/or directories can be specified as arguments. When a directory is provided, it is searched recursively.

When searching a single file, quiet mode is enabled by default (no filename headers). When searching multiple files or directories, each result is prefixed with the filename unless -q is specified.

The options are:

-a align

Only accept aligned hits

-b size

Set block size

-e regex

Search for regex matches (can be used multiple times)

-E cmd

Execute shell command for each file found.

-R cmd

Execute Rizin command for each search hit.

-f from

Start searching from address 'from'

-F file

Read the contents of the file and use it as a keyword

-h

Show usage help message

-i

Identify filetype (magic signatures)

-j

Output in JSON format. Results are returned as a JSON array of objects.

-m

Magic search, file-type carver

-M str

Set a binary mask to be applied on keywords

-n

Do not stop the search when a read error occurs. Continue to next block or file.

-s str

Search for a specific string (can be used multiple times)

-w str

Search for a specific wide string (can be used multiple times). Assumes str is UTF-8

-I str

Search for an entry in import table

-S str

Search for a symbol in symbol table

-t to

Stop search at address 'to'

-q

Quiet mode - do not show headings (filenames) above matching contents (default for searching a single file)

-v

Show version information

-V

Verbose mode - show each file being scanned. When combined with -j, verbose output is written to stderr to preserve stdout for JSON results.

-x hex

Search for an hexpair string (can be used multiple times)

-X

Show hexdump of search results

-z

Search for zero-terminated strings

-Z

Show string found on each search hit

rz-find supports searching across multiple files and directories in a single invocation.

When multiple paths are provided:

• Each file is searched in the order specified.

• Directories are searched recursively (hidden files starting with '.' are skipped).

• If any file cannot be opened or read, an error is printed but processing continues with remaining files.

• The exit code reflects whether all files were processed successfully (0) or if any errors occurred (1).

0

All files were processed successfully.

1

One or more files could not be opened or had read errors, or invalid arguments were provided.

Search for a string in a single file:

rz-find -s "password" firmware.bin

Search for a hex pattern in multiple files:

rz-find -x "cafebabe" file1.bin file2.bin file3.bin

Recursively search a directory for a string:

rz-find -s "secret" /path/to/firmware/

Search multiple directories and files with JSON output:

rz-find -j -s "config" dir1/ dir2/ standalone.bin

Search for zero-terminated strings in a binary with JSON output:

rz-find -z -j firmware.bin

Verbose search showing files being scanned:

rz-find -V -s "pattern" *.bin

Search with aligned hits (power of 2):

rz-find -a 4 -x "00000000" memory.dump

rizin(1), rz-asm(1), rz-ax(1), rz-bin(1), rz-diff(1), rz-gg(1), rz-hash(1), rz-run(1)

pancake <pancake@nopcode.org>

byteninjaa0

rizin(1), rz-asm(1), rz-ax(1), rz-bin(1), rz-diff(1), rz-gg(1), rz-hash(1), rz-run(1), rz-sign(1), rz-test(1).