RZ\_FIND(1) General Commands Manual RZ\_FIND(1)

# [NAME](#NAME)

`rz-find` — Find byte patterns in files

# [SYNOPSIS](#SYNOPSIS)

`rz-find` \[`-hijmnrqvxzZ`] \[`-a` `align`] \[`-b` `size`] \[`-f/t` `from/to`] \[`-[e|s|w|S|I] str`] \[`-x` `hex`] `file|dir` \[`file|dir ...`]

# [DESCRIPTION](#DESCRIPTION)

This command is part of the Rizin project.

`rz-find` searches for specified byte patterns, strings, or hexpairs in the given files. Multiple files and/or directories can be specified as arguments. When a directory is provided, it is searched recursively.

When searching a single file, quiet mode is enabled by default (no filename headers). When searching multiple files or directories, each result is prefixed with the filename unless `-q` is specified.

The options are:

[`-a`](#a) `align`

Only accept aligned hits

[`-b`](#b) `size`

Set block size

[`-e`](#e) `regex`

Search for regex matches (can be used multiple times)

[`-E`](#E) `cmd`

Execute shell command for each file found.

[`-R`](#R) `cmd`

Execute Rizin command for each search hit.

[`-f`](#f) `from`

Start searching from address 'from'

[`-F`](#F) `file`

Read the contents of the file and use it as a keyword

[`-h`](#h)

Show usage help message

[`-i`](#i)

Identify filetype (magic signatures)

[`-j`](#j)

Output in JSON format. Results are returned as a JSON array of objects.

[`-m`](#m)

Magic search, file-type carver

[`-M`](#M) `str`

Set a binary mask to be applied on keywords

[`-n`](#n)

Do not stop the search when a read error occurs. Continue to next block or file.

[`-s`](#s) `str`

Search for a specific string (can be used multiple times)

[`-w`](#w) `str`

Search for a specific wide string (can be used multiple times). Assumes str is UTF-8

[`-I`](#I) `str`

Search for an entry in import table

[`-S`](#S) `str`

Search for a symbol in symbol table

[`-t`](#t) `to`

Stop search at address 'to'

[`-q`](#q)

Quiet mode - do not show headings (filenames) above matching contents (default for searching a single file)

[`-v`](#v)

Show version information

[`-V`](#V)

Verbose mode - show each file being scanned. When combined with `-j`, verbose output is written to stderr to preserve stdout for JSON results.

[`-x`](#x) `hex`

Search for an hexpair string (can be used multiple times)

[`-X`](#X)

Show hexdump of search results

[`-z`](#z)

Search for zero-terminated strings

[`-Z`](#Z)

Show string found on each search hit

# [MULTIPLE FILES AND DIRECTORIES](#MULTIPLE_FILES_AND_DIRECTORIES)

`rz-find` supports searching across multiple files and directories in a single invocation.

When multiple paths are provided:

- Each file is searched in the order specified.
- Directories are searched recursively (hidden files starting with '.' are skipped).
- If any file cannot be opened or read, an error is printed but processing continues with remaining files.
- The exit code reflects whether all files were processed successfully (0) or if any errors [occurred (1)](/man/os/rizin/occurred.1).

# [EXIT STATUS](#EXIT_STATUS)

0

All files were processed successfully.

1

One or more files could not be opened or had read errors, or invalid arguments were provided.

# [EXAMPLES](#EXAMPLES)

Search for a string in a single file:

```
rz-find -s "password" firmware.bin
```

Search for a hex pattern in multiple files:

```
rz-find -x "cafebabe" file1.bin file2.bin file3.bin
```

Recursively search a directory for a string:

```
rz-find -s "secret" /path/to/firmware/
```

Search multiple directories and files with JSON output:

```
rz-find -j -s "config" dir1/ dir2/ standalone.bin
```

Search for zero-terminated strings in a binary with JSON output:

```
rz-find -z -j firmware.bin
```

Verbose search showing files being scanned:

```
rz-find -V -s "pattern" *.bin
```

Search with aligned hits (power of 2):

```
rz-find -a 4 -x "00000000" memory.dump
```

# [SEE ALSO](#SEE_ALSO)

[rizin(1)](/man/os/rizin/rizin.1), [rz-asm(1)](/man/os/rizin/rz-asm.1), [rz-ax(1)](/man/os/rizin/rz-ax.1), [rz-bin(1)](/man/os/rizin/rz-bin.1), [rz-diff(1)](/man/os/rizin/rz-diff.1), [rz-gg(1)](/man/os/rizin/rz-gg.1), [rz-hash(1)](/man/os/rizin/rz-hash.1), [rz-run(1)](/man/os/rizin/rz-run.1)

# [AUTHORS](#AUTHORS)

pancake <pancake@nopcode.org>

byteninjaa0

January 24, 2024 Linux 4.19.0-gvisor

---

Document: rz-find(1) from rizin 0.9.1-r2 (Chainguard OS)
Source: https://github.com/rizinorg/rizin