Find words and byte sequences in binary files on the command line with the free Swiss File Knife for Windows, Mac OS X and Linux.
sfk hexfind [opts] -pat /pattern/ -dir anydir -file .ext1 [.ext2]
search text or binary data in text and binary files.
if multiple patterns are given then they are searched
independently (pattern1 OR pattern2).
this is a basic command to search only static data.
type sfk xhexfind to use wildcards and expressions.
subdirectories are included by default
the sfk default for most commands is to process the given folders,
as well as all subdirs within them. specify -nosub to disable this.
options
-nosub do not include files in subdirectories.
-nobin[ary] skip binary files.
-case case-sensitive text comparison. default is case-insensitive
comparison for all -text strings, but NOT for -bin blocks.
case-sensitive comparison is faster then case-insensitive.
for further details type: sfk help nocase
-nocase force case-insensitive comparison ALSO on -bin patterns.
-text starts a list of search patterns of the form /src/ or
/src/totext/ where / is the separator char, src the text
to search for, and totext a mask to reformat output.
any separator char can be used which is not part of the
search text, i.e. /foo/ or _foo_ both search "foo".
-text is not required if a single filename is given.
-pat the same as -text, starting a pattern list.
-spat same as -pat but also activates slash patterns like \t .
type "sfk help pat" for the list of possible patterns.
-spats[trict] same as -spat, but stops with error on undefined
slash patterns like \m in C:\myproj. every slash
must then be escaped, e.g. using C:\\myproj.
-bin[ary] starts a list of binary replace patterns, specified
as hexcode like /0A0D/2020/
-bylist x.txt read search patterns from a file x.txt, supporting
multiple lines per pattern. (add -full for more.)
-bylinelist x read /from/to/ or just /from/ patterns from a file x
with one pattern per line. (add -full for more.)
-by(line)list does not support sfk variables.
to use variables in patterns create an sfk script
with patterns as parameters. "sfk script" for more.
-arc XE: include content of .zip .jar .tar etc. archives
as deep as possible, including nested archives.
XD: demo will read first 1000 bytes of each entry.
-qarc quick read top level archives but not nested ones.
-firsthit process only first found pattern match per file.
-quiet do not show progress infos.
-stat show statistics like hits per pattern and no. of files.
-perf show performance statistics.
-full print full help text telling about -bylist pat. files,
special character case sensitivity and nested or repeated
replace behaviour.
output options
-wide show 16 bytes per line in output.
-lean show 8 bytes per line in output.
-context=n show n bytes of context around results.
-fullhead[er] print offset/length of hits both in decimal and hex.
-maxdump=n show up to n bytes only. n must be larger then context.
-nodump do not create a hexdump, list only matching files.
-showle highlight CR/LF line endings in hex dump output
-context=n with hexdump: show additional n bytes of context.
-reldist with hexdump: tell relative distances to previous hits.
+tofile x as last parameter (command chaining): write text as
displayed on terminal to a file x.
-more[n] pause output every 30 or n lines.
return codes for batch files
0 = no matches, 1 = matches found, >1 = major error occurred.
see also "sfk help opt" on how to influence error processing.
quoted multi line parameters are supported in scripts
using full trim. type "sfk script" for details.
aliasessfk xhexfind is the same as xfind -hex
to extract unmodified binary data you may use either
sfk xfind -pure ... -tofile or sfk extract ... -tofileoffice file supportsfk ofind search in .xml text file contents of
office files like .docx .xlsx .ods .odt.
sfk help office for more infos and options
see also--- open source commands ---sfk xfind search wildcard text in plain text files
sfk ofind search in office files .docx .xlsx .ods
sfk xfindbin search wildcard text in text/binary files
sfk xhexfind search in text/binary with hex dump output
sfk extract extract wildcard data from text/binary files
sfk filter filter and edit text with simple wildcards
sfk find search fixed text in text files
sfk findbin search fixed text in text/binary files
sfk hexfind search fixed text in binary files
sfk replace replace fixed text in text/binary files
--- freeware commands ---sfk view GUI tool to search text as you type
--- xe commercial commands ---sfk replace replace fixed text with high performance
sfk xreplace replace wildcard text in text/binary files
sfk help xe about SFK XE and xreplace with SFK Expressions.
beware of Shell Command Characters.
to find or replace text patterns containing spaces or special
characters like <>|!&?* you must add quotes "" around parameters
or the shell environment will destroy your command. for example,
pattern /foo bar/other/ must be written like "/foo bar/other/"
within a .bat or .cmd file the percent % must be escaped like %%
even within quotes: sfk echo -spat "percent %% is a percent \x25"web referencehttp://stahlworks.com/sfk-hexfindcommon usage errorssfk hexfind in.txt "/foo\r\n/"
will not find "foo" at line ends, but searches literal
strings like "slash and r". add option -spat to enable
slash patterns, converting \r\n to real CRLF codes,
or use xhexfind where slash patterns are default.
sfk hexfind mydir "/foo*bar/"
will not find "foo" and "bar" with any characters
inbetween, but searches a literal star "*".
use xhexfind to enable search with wildcards.
sfk rep in.txt "/foo[0.1000 bytes]bar/---/"
will not replace up to 1000 bytes between "foo" and "bar",
but replaces a literal string "foo" then "[1000 bytes]"
then "bar". use xed or xreplace instead.
examplessfk hexfind -text "/foo/" "/bar/" -dir mydir -file .txt .hpp
find words "foo" or "bar" case insensitive
in all .txt or .hpp files in a folder mydir.
sfk hexfind -binary /666f6f/ -dir mydir -file .exe +view
find binary data with hex values 0x66, 0x6f, 0x6f
in all .exe files of mydir and show result in dview.