78  Rz-find

rz-find is the command line frontend of the rz_search library. Which allows you to search for strings, sequences of bytes with binary masks, etc

$ rz-find -h
Usage: rz-find [-mXnzZhqv] [-a align] [-b sz] [-f/t from/to] [-[e|s|w|S|I] str] [-x hex] -|file|dir ..
 -a [align] Only accept aligned hits
 -b [size]  Set block size
 -e [regex] Search for regex matches (can be used multiple times)
 -f [from]  Start searching from address 'from'
 -F [file]  Read the contents of the file and use it as keyword
 -h         Show this help
 -i         Identify filetype (rizin -nqcpm file)
 -j         Output in JSON
 -m         Magic search, file-type carver
 -M [str]   Set a binary mask to be applied on keywords
 -n         Do not stop on read errors
 -r         Print using rizin commands
 -s [str]   Search for a specific string (can be used multiple times)
 -w [str]   Search for a specific wide string (can be used multiple times). Assumes str is UTF-8.
 -I [str]   Search for an entry in import table.
 -S [str]   Search for a symbol in symbol table.
 -t [to]    Stop search at address 'to'
 -q         Quiet - do not show headings (filenames) above matching contents (default for searching a single file)
 -v         Show version information
 -x [hex]   Search for hexpair string (909090) (can be used multiple times)
 -X         Show hexdump of search results
 -z         Search for zero-terminated strings
 -Z         Show string found on each search hit

That’s how to use it, first we’ll search for “lib” inside the /bin/ls binary.

$ rz-find -s lib /usr/bin/ls
0x319
0x11f3
0x13b7
0x1b5ea
0x1b792

Note that the output is pretty minimal, and shows the offsets where the string lib is found. We can then use this output to feed other tools.

Counting results:

$ rz-find -s lib /usr/bin/ls | wc -l
5

Displaying results with context:

$ export F=/usr/bin/ls
$ for a in `rz-find -s lib $F` ; do \
    rizin -ns $a -qc'x 32' $F ; done
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x00000319  6c69 6236 342f 6c64 2d6c 696e 7578 2d78  lib64/ld-linux-x
0x00000329  3836 2d36 342e 736f 2e32 0000 0000 0004  86-64.so.2......
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x000011f3  6c69 6263 5f73 7461 7274 5f6d 6169 6e00  libc_start_main.
0x00001203  6973 7770 7269 6e74 0073 6967 7072 6f63  iswprint.sigproc
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x000013b7  6c69 6263 2e73 6f2e 3600 474c 4942 435f  libc.so.6.GLIBC_
0x000013c7  4142 495f 4454 5f52 454c 5200 474c 4942  ABI_DT_RELR.GLIB
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x0001b5ea  6c69 6273 2f00 5554 462d 3800 e280 9900  libs/.UTF-8.....
0x0001b5fa  a1af 0022 00a1 0765 00e2 8098 0060 0073  ..."...e.....`.s
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x0001b792  6c69 622f 7873 7472 746f 6c2e 6300 4153  lib/xstrtol.c.AS
0x0001b7a2  4349 4900 0000 6361 6e6e 6f74 2064 6574  CII...cannot det

rz-find can also be used as a replacement of file to identify the mimetype of a file using the internal magic database of Rizin.

$  rz-find -i /usr/bin/ls
0x00000000 1 ELF 64-bit LSB shared object, x86-64, version 1

Also works as a strings replacement, similar to what you do with rz-bin -z, but without caring about parsing headers and obeying binary sections.

$ rz-find -z /usr/bin/ls | grep http
# https://wiki.xiph.org/MIME_Types_and_File_Extensions
# https://wiki.xiph.org/MIME_Types_and_File_Extensions
https://www.gnu.org/gethelp/
https://www.gnu.org/software/coreutils/
Report any translation bugs to <https://translationproject.org/team/>
https://gnu.org/licenses/gpl.html