Команда: hexfind
Find words and byte sequences in binary files on the command line

with the free Swiss File Knife for Windows, Mac OS X and Linux.
sfk hexfind [opts] -pat /pattern/ -dir anydir -file .ext1 [.ext2]

search text or binary data in text and binary files.
if multiple patterns are given then they are searched
independently (pattern1 OR pattern2).

this is a basic command to search only static data.
type sfk xhexfind to use wildcards and expressions.

subdirectories are included by default
   the sfk default for most commands is to process the given folders,
   as well as all subdirs within them. specify -nosub to disable this.

options
   -nosub        do not include files in subdirectories.
   -nobin[ary]   skip binary files.
   -case         case-sensitive text comparison. default is case-insensitive
                 comparison for all -text strings, but NOT for -bin blocks.
                 case-sensitive comparison is faster then case-insensitive.
                 for further details type: sfk help nocase
   -nocase       force case-insensitive comparison ALSO on -bin patterns.
   -text         starts a list of search patterns of the form /src/ or
                 /src/totext/ where / is the separator char, src the text
                 to search for, and totext a mask to reformat output.
                 any separator char can be used which is not part of the
                 search text, i.e. /foo/ or _foo_ both search "foo".
                 -text is not required if a single filename is given.
   -pat          the same as -text, starting a pattern list.
   -spat         same as -pat but also activates slash patterns like \t .
                 type "sfk help pat" for the list of possible patterns.
   -spats[trict] same as -spat, but stops with error on undefined
                 slash patterns like \m in C:\myproj. every slash
                 must then be escaped, e.g. using C:\\myproj.
   -bin[ary]     starts a list of binary replace patterns, specified
                 as hexcode like /0A0D/2020/
   -bylist x.txt read search patterns from a file x.txt, supporting
                 multiple lines per pattern. (add -full for more.)
   -bylinelist x read /from/to/ or just /from/ patterns from a file x
                 with one pattern per line. (add -full for more.)
                 -by(line)list does not support sfk variables.
                 to use variables in patterns create an sfk script
                 with patterns as parameters. "sfk script" for more.
   -arc          XE: include content of .zip .jar .tar etc. archives
                     as deep as possible, including nested archives.
                 XD: demo will read first 1000 bytes of each entry.
   -qarc         quick read top level archives but not nested ones.
   -firsthit     process only first found pattern match per file.
   -quiet        do not show progress infos.
   -stat         show statistics like hits per pattern and no. of files.
   -perf         show performance statistics.
   -full         print full help text telling about -bylist pat. files,
                 special character case sensitivity and nested or repeated
                 replace behaviour.

output options
   -wide         show 16 bytes per line in output.
   -lean         show  8 bytes per line in output.
   -context=n    show  n bytes of  context around results.
   -fullhead[er] print offset/length of hits both in decimal and hex.
   -maxdump=n    show up to n bytes only. n must be larger then context.
   -nodump       do not create a hexdump, list only matching files.
   -showle       highlight CR/LF line endings in hex dump output
   -context=n    with hexdump: show additional n bytes of context.
   -reldist      with hexdump: tell relative distances to previous hits.
   +tofile x     as last parameter (command chaining): write text as
                 displayed on terminal to a file x.
   -more[n]      pause output every 30 or n lines.

return codes for batch files
   0 = no matches, 1 = matches found, >1 = major error occurred.
   see also "sfk help opt" on how to influence error processing.

quoted multi line parameters are supported in scripts
   using full trim. type "sfk script" for details.

aliases
   sfk xhexfind is the same as xfind -hex
   to extract unmodified binary data you may use either
   sfk xfind -pure ... -tofile or sfk extract ... -tofile

office file support
   sfk ofind        search in .xml text file contents of
                    office files like .docx .xlsx .ods .odt.
   sfk help office  for more infos and options

see also
   --- open source commands ---
   sfk xfind     search  wildcard text in   plain text files
   sfk ofind     search  in office files    .docx .xlsx .ods
   sfk xfindbin  search  wildcard text in   text/binary files
   sfk xhexfind  search  in text/binary with hex dump output
   sfk extract   extract wildcard data from text/binary files
   sfk filter    filter  and edit text with simple wildcards
   sfk find      search  fixed    text in   text        files
   sfk findbin   search  fixed    text in   text/binary files
   sfk hexfind   search  fixed    text in        binary files
   sfk replace   replace fixed    text in   text/binary files
   --- freeware commands ---
   sfk view      GUI tool to search text as you type
   --- xe commercial commands ---
   sfk replace   replace fixed    text with high performance
   sfk xreplace  replace wildcard text in   text/binary files
   sfk help xe   about SFK XE and xreplace with SFK Expressions.

beware of Shell Command Characters.
   to find or replace text patterns containing spaces or special
   characters like <>|!&?* you must add quotes "" around parameters
   or the shell environment will destroy your command. for example,
   pattern /foo bar/other/ must be written like "/foo bar/other/"
   within a .bat or .cmd file the percent % must be escaped like %%
   even within quotes: sfk echo -spat "percent %% is a percent \x25"

web reference
   http://stahlworks.com/sfk-hexfind

common usage errors
   sfk hexfind in.txt "/foo\r\n/"
      will not find "foo" at line ends, but searches literal
      strings like "slash and r". add option -spat to enable
      slash patterns, converting \r\n to real CRLF codes,
      or use xhexfind where slash patterns are default.
   sfk hexfind mydir "/foo*bar/"
      will not find "foo" and "bar" with any characters
      inbetween, but searches a literal star "*".
      use xhexfind to enable search with wildcards.
   sfk rep in.txt "/foo[0.1000 bytes]bar/---/"
      will not replace up to 1000 bytes between "foo" and "bar",
      but replaces a literal string "foo" then "[1000 bytes]"
      then "bar". use xed or xreplace instead.

examples
   sfk hexfind -text "/foo/" "/bar/" -dir mydir -file .txt .hpp
      find words "foo" or "bar" case insensitive
      in all .txt or .hpp files in a folder mydir.
   sfk hexfind -binary /666f6f/ -dir mydir -file .exe +view
      find binary data with hex values 0x66, 0x6f, 0x6f
      in all .exe files of mydir and show result in dview.
Источник