rafind2

    That’s how to use it, first we’ll search for “lib” inside the /bin/ls binary.

    1. $ rafind2 -s lib /bin/ls
    2. 0x5f9
    3. 0x675
    4. 0x679
    5. ...
    6. $

    Counting results:

    2.     r2 -ns $a -qc'x 32' $F ; done
    3. 0x000005f9  6c69 622f 6479 6c64 .. lib/dyld........
    4. 0x00000675  6c69 622f 6c69 6275 .. lib/libutil.dyli
    5. 0x00000679  6c69 6275 7469 6c2e .. libutil.dylib...
    6. 0x00000683  6c69 6200 000c 0000 .. lib......8......
    7. 0x000006a5  6c69 622f 6c69 626e .. lib/libncurses.5
    8. 0x000006a9  6c69 626e 6375 7273 .. libncurses.5.4.d
    9. 0x000006dd  6c69 622f 6c69 6253 .. lib/libSystem.B.
    10. 0x000006e1  6c69 6253 7973 7465 .. libSystem.B.dyli
    11. 0x000006ef  6c69 6200 0000 0000 .. lib......&......

    rafind2 can also be used as a replacement of file to identify the mimetype of a file using the internal magic database of radare2.

    1. $ rafind2 -z /bin/ls| grep http
    2. 0x000076e5 %http://www.apple.com/appleca/root.crl0\r
    3. 0x00007ae6 https://www.apple.com/appleca/0