# SPDX-FileCopyrightText: 2024 RizinOrg <info@rizin.re>
# SPDX-License-Identifier: LGPL-3.0-only
---
name: cmd_search
commands:
  - name: "/+"
    summary: Construct the string with chunks.
    cname: cmd_search_str_chunk
    modes:
      - RZ_OUTPUT_MODE_STANDARD
      - RZ_OUTPUT_MODE_JSON
      - RZ_OUTPUT_MODE_QUIET
      - RZ_OUTPUT_MODE_TABLE
    args:
      - name: "/bin/sh"
        type: RZ_CMD_ARG_TYPE_STRING
  - name: "/a"
    summary: Assemble the instruction and search its bytes.
    subcommands:
    - name: "/a"
      summary: Assemble the instruction and search its bytes.
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      cname: cmd_search_assemble
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: asm-text
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/a1"
      summary: "Find valid assembly generated by changing only the nth byte"
      cname: cmd_search_assemble_1
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args:
        - name: "number"
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/aI"
      summary: "Search for infinite loop instructions (jmp $$)"
      cname: cmd_search_assemble_I
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args: []
    - name: "/aa"
      summary: "Linearly find aproximated assembly (case insensitive strstr)"
      cname: cmd_search_assemble_a
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args:
        - name: "asm-text"
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/ac"
      summary: "Same as /aa, but case-sensitive"
      cname: cmd_search_assemble_c
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args:
        - name: "asm-text"
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/ad"
      summary: "Match ins1 followed by ins2 in linear disasm"
      cname: cmd_search_assemble_d
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args:
        - name: "mnem;mov"
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/ad/"
      summary: "Search for regex instruction 'ins1' followed by regex 'ins2'"
      cname: cmd_search_assemble_d_slash
      args:
        - name: "ins1;ins2"
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/ad/a"
      summary: "Search for every byte instruction that matches regexp 'instr'"
      cname: cmd_search_assemble_d_slasha
      args:
        - name: "instr"
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/ae"
      summary: "Search for esil expressions matching substring"
      cname: cmd_search_assemble_e
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args:
        - name: "esil"
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/af"
      summary: "Search for instruction of specific family (afl=list"
      subcommands:
      - name: "/af"
        summary: "Search for instruction of specific family (afl=list"
        cname: cmd_search_assemble_f
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
        args:
          - name: "family"
            type: RZ_CMD_ARG_TYPE_STRING
      - name: "/afl"
        summary: "Search for instruction of specific family. List mode."
        cname: cmd_search_assemble_fl
        args:
          - name: "family"
            type: RZ_CMD_ARG_TYPE_STRING
    - name: "/ai"
      summary: "Find all the instructions using that immediate (in range)"
      cname: cmd_search_assemble_i
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args:
        - name: "0x300"
          type: RZ_CMD_ARG_TYPE_STRING
        - name: "0x500"
          optional: true
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/al"
      summary: "Same as aoml, list all opcodes"
      cname: cmd_search_assemble_l
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args: []
    - name: "/am"
      summary: "Search for specific instructions of specific mnemonic"
      cname: cmd_search_assemble_m
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args:
        - name: "opcode"
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/ao"
      summary: "Search for instruction 'instr' (in all offsets)"
      cname: cmd_search_assemble_o
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args:
        - name: "instr"
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/as"
      summary: "Search for syscalls (See /at swi and /af priv)"
      subcommands:
      - name: "/as"
        summary: "Search for syscalls (See /at swi and /af priv)"
        cname: cmd_search_assemble_s
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
        args:
          - name: "type"
            optional: true
            type: RZ_CMD_ARG_TYPE_STRING
      - name: "/asl"
        summary: "Search for syscalls (See /at swi and /af priv). List mode."
        cname: cmd_search_assemble_sl
        args:
          - name: "type"
            optional: true
            type: RZ_CMD_ARG_TYPE_STRING
    - name: "/at"
      summary: "Search for instructions of given type"
      subcommands:
      - name: "/at"
        summary: "Search for instructions of given type"
        cname: cmd_search_assemble_t
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
        args:
          - name: "type"
            optional: true
            type: RZ_CMD_ARG_TYPE_STRING
      - name: "/atl"
        summary: "Search for instructions of given type. List mode."
        cname: cmd_search_assemble_tl
        args:
          - name: "type"
            optional: true
            type: RZ_CMD_ARG_TYPE_STRING
  - name: "/c"
    summary: Cryptographic material search.
    subcommands:
    - name: "/ch"
      summary: Search for blocks that have the same hash.
      cname: cmd_search_hash_block
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: algo
          type: RZ_CMD_ARG_TYPE_STRING
        - name: hash
          type: RZ_CMD_ARG_TYPE_STRING
        - name: "block_size"
          type: RZ_CMD_ARG_TYPE_NUM
          default_value: "256"
      details:
        - name: Usage example
          entries:
            - text: "/ch"
              arg_str: " md5 0bc8f8c426b74ffaedac8330a7464014 512"
              comment: "MD5 hash search within blocks of 512 bytes."
        - name: Tip
          entries:
            - text: ""
              comment: "The command 'Lh' gives you a list of supported hash plugins."
            - text: ""
              comment: "Use /ce and /cef for entropy search."
    - name: "/ce"
      summary: "Search for blocks above an entropy level."
      cname: cmd_search_hash_entropy
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: min_entropy
          type: RZ_CMD_ARG_TYPE_NUM
        - name: max_entropy
          type: RZ_CMD_ARG_TYPE_NUM
          default_value: "8.0"
        - name: "block_size"
          type: RZ_CMD_ARG_TYPE_NUM
          default_value: "256"
      details:
        - name: Usage example
          entries:
            - text: "/ce"
              arg_str: " 2.5 7.4 512"
              comment: "Find 512 byte long blocks with an entropy between 2.5 and 7.4 (inclusive min & max)."
    - name: "/cef"
      summary: "Search for blocks above an fractional entropy level."
      cname: cmd_search_hash_entropy_fractional
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: min_entropy
          type: RZ_CMD_ARG_TYPE_NUM
        - name: max_entropy
          type: RZ_CMD_ARG_TYPE_NUM
          default_value: "1.0"
        - name: "block_size"
          type: RZ_CMD_ARG_TYPE_NUM
          default_value: "256"
      details:
        - name: Usage example
          entries:
            - text: "/cef"
              arg_str: " 0.3 0.8 512"
              comment: "Find 512 byte long blocks with a fractional entropy between 0.3 and 0.8 (inclusive min & max)."
    - name: "/cm"
      summary: Search cryptographic material.
      cname: cmd_search_cryptographic_material
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: type
          type: RZ_CMD_ARG_TYPE_CHOICES
          default_value: "all"
          choices:
            - "all"
            - "aes128"
            - "aes192"
            - "aes256"
            - "sm4be"
            - "sm4le"
            - "rsa"
            - "ecc"
            - "safecurves"
            - "x509"
      details:
        - name: Types
          entries:
            - text: aes128
              comment: "Searches for expanded AES 128 keys."
            - text: aes192
              comment: "Searches for expanded AES 192 keys."
            - text: aes256
              comment: "Searches for expanded AES 256 keys."
            - text: sm4be
              comment: "Searches for expanded SM4 keys (big-endian)."
            - text: sm4le
              comment: "Searches for expanded SM4 keys (little-endian)."
            - text: rsa
              comment: "Searches for DER/BER encoded RSA keys (see RFC 3447)."
            - text: ecc
              comment: "Searches for DER/BER encoded ECC keys (see RFC 5915)."
            - text: safecurves
              comment: "Searches for DER/BER encoded SafeCurves keys (see RFC 8410)."
            - text: x509
              comment: "Searches for DER/BER encoded X.509 certificates."
  - name: "/C"
    summary: Search, List, Query for COP Gadgets
    subcommands:
      - name: "/C"
        cname: cmd_info_cop_gadget
        summary: List COP Gadgets
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_QUIET
          - RZ_OUTPUT_MODE_TABLE
        args:
          - name: filter-by-string
            type: RZ_CMD_ARG_TYPE_STRING
            optional: true
      - name: "/C-"
        cname: cmd_clear_cop_gadget_cache
        summary: Clear COP gadget cache
        args: []
      - name: "/C/"
        cname: cmd_search_cop_gadget
        summary: List COP Gadgets [regular expression]
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_QUIET
          - RZ_OUTPUT_MODE_TABLE
        args:
          - name: filter-by-regex
            type: RZ_CMD_ARG_TYPE_STRING
            optional: true
      - name: "/Ck"
        cname: cmd_query_cop_gadget
        summary: Query COP Gadgets by providing constraints
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_QUIET
          - RZ_OUTPUT_MODE_TABLE
        args_str: " <key>[=<val>] [<key>[=<val>] ...]]"
        args:
          - name: key=value
            type: RZ_CMD_ARG_TYPE_STRING
            optional: false
        details:
          - name: Constraint types
            entries:
              - text: "reg=const"
                comment: "Find gadgets that set a register to a constant value"
              - text: "reg=reg"
                comment: "Find gadgets that copy one register to another"
              - text: "reg=reg OP const"
                comment: "Find gadgets with register and constant arithmetic"
              - text: "reg=reg OP reg"
                comment: "Find gadgets with register-register operations"
          - name: Supported operations
            entries:
              - text: "+ - * / %"
                comment: "Arithmetic operations (add, sub, mul, div, mod)"
              - text: "& | ^"
                comment: "Bitwise operations (AND, OR, XOR)"
              - text: "<< >>"
                comment: "Shift operations (left, right)"
          - name: Compound operators
            entries:
              - text: "reg++ or reg--"
                comment: "Increment or decrement register"
              - text: "reg+=val, reg-=val"
                comment: "Compound assignment operators"
          - name: Usage example
            entries:
              - text: "Find gadgets setting rax to 0"
                comment: "/Ck rax=0"
              - text: "Find gadgets copying rbx to rax"
                comment: "/Ck rax=rbx"
              - text: "Find gadgets with rax = rbx + 8"
                comment: "/Ck rax=rbx+8"
              - text: "Find gadgets with multiple constraints"
                comment: "/Ck rax=0,rbx=rcx"
      - name: "/Cg"
        cname: cmd_detail_cop_gadget
        summary: Gadget detail info
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_LONG
        args:
          - name: Gadget address
            type: RZ_CMD_ARG_TYPE_STRING
            optional: true
      - name: "/Cs"
        cname: cmd_cop_search_stack
        summary: Search cop gadgets given stack changes
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
        args:
          - name: Stack changes
            type: RZ_CMD_ARG_TYPE_STRING
            optional: false
        details:
          - name: Usage example
            entries:
              - text: "Search COP gadgets with less than 0x200 stack changes"
                comment: "/Cs \"<0x200\""
              - text: "Search COP gadgets with 0x100 stack changes"
                comment: "/Cs =0x100"
      - name: "/Cl"
        cname: cmd_cop_gadget_search_size
        summary: Search cop gadgets given gadget size
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
        args:
          - name: Gadget size
            type: RZ_CMD_ARG_TYPE_STRING
            optional: false
        details:
          - name: Usage example
            entries:
              - text: "Search COP gadgets with the size less than 0x20"
                comment: "/Cl \"<0x20\""
              - text: "Search COP gadgets with the size 0x10"
                comment: "/Cl =0x10"
  - name: "/d"
    summary: Search for a deltified sequence of bytes.
    cname: cmd_search_deltified
    modes:
      - RZ_OUTPUT_MODE_STANDARD
      - RZ_OUTPUT_MODE_JSON
      - RZ_OUTPUT_MODE_QUIET
      - RZ_OUTPUT_MODE_TABLE
    args:
      - name: "101112"
        type: RZ_CMD_ARG_TYPE_STRING
  - name: "/F"
    summary: Search the content of a file.
    cname: cmd_search_file
    type: RZ_CMD_DESC_TYPE_ARGV_STATE
    modes:
      - RZ_OUTPUT_MODE_STANDARD
      - RZ_OUTPUT_MODE_JSON
      - RZ_OUTPUT_MODE_QUIET
      - RZ_OUTPUT_MODE_TABLE
    args:
      - name: "file"
        type: RZ_CMD_ARG_TYPE_STRING
      - name: "offset"
        optional: true
        type: RZ_CMD_ARG_TYPE_STRING
      - name: "size"
        optional: true
        type: RZ_CMD_ARG_TYPE_STRING
    details:
      - name: Arguments
        entries:
          - text: "<file>"
            comment: "The file containing the data to search."
          - text: "<offset>"
            comment: "Offset into <file> to read the search data from."
          - text: "<size>"
            comment: "Number of bytes to read from the <file>."
  - name: "/J"
    summary: Search, List, Query for JOP Gadgets
    subcommands:
      - name: "/J"
        cname: cmd_info_jop_gadget
        summary: List JOP Gadgets
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_QUIET
          - RZ_OUTPUT_MODE_TABLE
        args:
          - name: filter-by-string
            type: RZ_CMD_ARG_TYPE_STRING
            optional: true
      - name: "/J-"
        cname: cmd_clear_jop_gadget_cache
        summary: Clear JOP gadget cache
        args: []
      - name: "/J/"
        cname: cmd_search_jop_gadget
        summary: List JOP Gadgets [regular expression]
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_QUIET
          - RZ_OUTPUT_MODE_TABLE
        args:
          - name: filter-by-regex
            type: RZ_CMD_ARG_TYPE_STRING
            optional: true
      - name: "/Jk"
        cname: cmd_query_jop_gadget
        summary: Query JOP Gadgets by providing constraints
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_QUIET
          - RZ_OUTPUT_MODE_TABLE
        args_str: " <key>[=<val>] [<key>[=<val>] ...]]"
        args:
          - name: key=value
            type: RZ_CMD_ARG_TYPE_STRING
            optional: false
        details:
          - name: Constraint types
            entries:
              - text: "reg=const"
                comment: "Find gadgets that set a register to a constant value"
              - text: "reg=reg"
                comment: "Find gadgets that copy one register to another"
              - text: "reg=reg OP const"
                comment: "Find gadgets with register and constant arithmetic"
              - text: "reg=reg OP reg"
                comment: "Find gadgets with register-register operations"
          - name: Supported operations
            entries:
              - text: "+ - * / %"
                comment: "Arithmetic operations (add, sub, mul, div, mod)"
              - text: "& | ^"
                comment: "Bitwise operations (AND, OR, XOR)"
              - text: "<< >>"
                comment: "Shift operations (left, right)"
          - name: Compound operators
            entries:
              - text: "reg++ or reg--"
                comment: "Increment or decrement register"
              - text: "reg+=val, reg-=val"
                comment: "Compound assignment operators"
          - name: Usage example
            entries:
              - text: "Find gadgets setting rax to 0"
                comment: "/Jk rax=0"
              - text: "Find gadgets copying rbx to rax"
                comment: "/Jk rax=rbx"
              - text: "Find gadgets with rax = rbx + 8"
                comment: "/Jk rax=rbx+8"
              - text: "Find gadgets with multiple constraints"
                comment: "/Jk rax=0,rbx=rcx"
      - name: "/Jg"
        cname: cmd_detail_jop_gadget
        summary: Gadget detail info
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_LONG
        args:
          - name: Gadget address
            type: RZ_CMD_ARG_TYPE_STRING
            optional: true
      - name: "/Js"
        cname: cmd_jop_search_stack
        summary: Search jop gadgets given stack changes
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
        args:
          - name: Stack changes
            type: RZ_CMD_ARG_TYPE_STRING
            optional: false
        details:
          - name: Usage example
            entries:
              - text: "Search JOP gadgets with less than 0x200 stack changes"
                comment: "/Js \"<0x200\""
              - text: "Search JOP gadgets with 0x100 stack changes"
                comment: "/Js =0x100"
      - name: "/Jl"
        cname: cmd_jop_gadget_search_size
        summary: Search JOP gadgets given gadget size
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
        args:
          - name: Gadget size
            type: RZ_CMD_ARG_TYPE_STRING
            optional: false
        details:
          - name: Usage example
            entries:
              - text: "Search JOP gadgets with the size less than 0x20"
                comment: "/Jl \"<0x20\""
              - text: "Search JOP gadgets with the size 0x10"
                comment: "/Jl =0x10"

  - name: "/o"
    summary: Show offset of n instructions backward.
    cname: cmd_search_insn_offset_backwards
    modes:
      - RZ_OUTPUT_MODE_STANDARD
      - RZ_OUTPUT_MODE_JSON
    args:
      - name: "n"
        optional: true
        type: RZ_CMD_ARG_TYPE_STRING
  - name: "/O"
    summary: Same as /o, but with a different fallback if analysis cannot be used.
    cname: cmd_search_insn_offset_backwards_fallback
    modes:
      - RZ_OUTPUT_MODE_STANDARD
      - RZ_OUTPUT_MODE_JSON
    args:
      - name: "n"
        optional: true
        type: RZ_CMD_ARG_TYPE_STRING
  - name: "/p"
    summary: Search for pattern of given size.
    cname: cmd_search_pattern
    type: RZ_CMD_DESC_TYPE_ARGV_STATE
    modes:
      - RZ_OUTPUT_MODE_STANDARD
      - RZ_OUTPUT_MODE_JSON
      - RZ_OUTPUT_MODE_QUIET
      - RZ_OUTPUT_MODE_TABLE
    args:
      - name: "patternsize"
        type: RZ_CMD_ARG_TYPE_STRING
  - name: "/P"
    summary: Search similar blocks.
    cname: cmd_search_blocks
    type: RZ_CMD_DESC_TYPE_ARGV_STATE
    modes:
      - RZ_OUTPUT_MODE_STANDARD
      - RZ_OUTPUT_MODE_JSON
      - RZ_OUTPUT_MODE_QUIET
      - RZ_OUTPUT_MODE_TABLE
    args:
      - name: "patternsize"
        type: RZ_CMD_ARG_TYPE_NUM

  - name: "/g"
    summary: Search for all graph paths A to B.
    subcommands:
    - name: "/g"
      summary: Search for all graph paths A to B (does not follow calls).
      cname: cmd_search_graph_path
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args:
        - name: from
          type: RZ_CMD_ARG_TYPE_RZNUM
        - name: to
          type: RZ_CMD_ARG_TYPE_RZNUM
    - name: "/gg"
      summary: Search for all graph paths A to B (follows calls, see `search.count` and `analysis.depth`).
      cname: cmd_search_graph_path_follow_calls
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
      args:
        - name: from
          type: RZ_CMD_ARG_TYPE_RZNUM
        - name: to
          type: RZ_CMD_ARG_TYPE_RZNUM
  - name: "/m"
    summary: Magic constants search.
    subcommands:
    - name: "/m"
      summary: Magic constants search.
      cname: cmd_search_magic_const
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: magic-file
          optional: true
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/mb"
      summary: Search recognized RzBin headers.
      cname: cmd_search_magic_bin_headers
      args: []

  - name: "/r"
    summary: Reference search.
    subcommands:
    - name: "/r"
      summary: Reference search.
      cname: cmd_search_reference
      args:
        - name: address
          type: RZ_CMD_ARG_TYPE_STRING
    - name: "/ra"
      summary: Search all references.
      cname: cmd_search_reference_all
      args: []
    - name: "/rc"
      summary: Search call references.
      cname: cmd_search_reference_call
      args: []
    - name: "/rr"
      summary: Search read references.
      cname: cmd_search_reference_read
      args: []
    - name: "/rw"
      summary: Search write references.
      cname: cmd_search_reference_write
      args: []
    - name: "/rx"
      summary: Search execute references.
      cname: cmd_search_reference_execute
      args: []

  - name: "/R"
    summary: Search, List, Query for ROP Gadgets
    subcommands:
      - name: "/R"
        cname: cmd_info_rop_gadget
        summary: List ROP Gadgets
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_QUIET
          - RZ_OUTPUT_MODE_TABLE
        args:
          - name: filter-by-string
            type: RZ_CMD_ARG_TYPE_STRING
            optional: true
      - name: "/R-"
        cname: cmd_clear_rop_gadget_cache
        summary: Clear ROP gadget cache
        args: []
      - name: "/R/"
        cname: cmd_search_rop_gadget
        summary: List ROP Gadgets [regular expression]
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_QUIET
          - RZ_OUTPUT_MODE_TABLE
        args:
          - name: filter-by-regex
            type: RZ_CMD_ARG_TYPE_STRING
            optional: true
      - name: "/Rk"
        cname: cmd_query_rop_gadget
        summary: Query ROP Gadgets by providing constraints
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_QUIET
          - RZ_OUTPUT_MODE_TABLE
        args_str: " <key>[=<val>] [<key>[=<val>] ...]]"
        args:
          - name: key=value
            type: RZ_CMD_ARG_TYPE_STRING
            optional: false
        details:
          - name: Constraint types
            entries:
              - text: "reg=const"
                comment: "Find gadgets that set a register to a constant value"
              - text: "reg=reg"
                comment: "Find gadgets that copy one register to another"
              - text: "reg=reg OP const"
                comment: "Find gadgets with register and constant arithmetic"
              - text: "reg=reg OP reg"
                comment: "Find gadgets with register-register operations"
          - name: Supported operations
            entries:
              - text: "+ - * / %"
                comment: "Arithmetic operations (add, sub, mul, div, mod)"
              - text: "& | ^"
                comment: "Bitwise operations (AND, OR, XOR)"
              - text: "<< >>"
                comment: "Shift operations (left, right)"
          - name: Compound operators
            entries:
              - text: "reg++ or reg--"
                comment: "Increment or decrement register"
              - text: "reg+=val, reg-=val"
                comment: "Compound assignment operators"
          - name: Usage example
            entries:
              - text: "Find gadgets setting rax to 0"
                comment: "/Rk rax=0"
              - text: "Find gadgets copying rbx to rax"
                comment: "/Rk rax=rbx"
              - text: "Find gadgets with rax = rbx + 8"
                comment: "/Rk rax=rbx+8"
              - text: "Find gadgets with multiple constraints"
                comment: "/Rk rax=0,rbx=rcx"
      - name: "/Rg"
        cname: cmd_detail_rop_gadget
        summary: Gadget detail info
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
          - RZ_OUTPUT_MODE_LONG
        args:
          - name: Gadget address
            type: RZ_CMD_ARG_TYPE_STRING
            optional: true
      - name: "/Rs"
        cname: cmd_rop_search_stack
        summary: Search rop gadgets given stack changes
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
        args:
          - name: Stack changes
            type: RZ_CMD_ARG_TYPE_STRING
            optional: false
        details:
          - name: Usage example
            entries:
              - text: "Search ROP gadgets with less than 0x200 stack changes"
                comment: "/Rs \"<0x200\""
              - text: "Search ROP gadgets with 0x100 stack changes"
                comment: "/Rs =0x100"
      - name: "/Rl"
        cname: cmd_rop_gadget_search_size
        summary: Search rop gadgets given gadget size
        type: RZ_CMD_DESC_TYPE_ARGV_STATE
        modes:
          - RZ_OUTPUT_MODE_STANDARD
          - RZ_OUTPUT_MODE_JSON
        args:
          - name: Gadget size
            type: RZ_CMD_ARG_TYPE_STRING
            optional: false
        details:
          - name: Usage example
            entries:
              - text: "Search ROP gadgets with the size less than 0x20"
                comment: "/Rl \"<0x20\""
              - text: "Search ROP gadgets with the size 0x10"
                comment: "/Rl =0x10"
  - name: "/v"
    summary: Value search.
    subcommands:
    - name: "/v"
      summary: Value search.
      cname: cmd_search_value
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: bytes
          type: RZ_CMD_ARG_TYPE_CHOICES
          choices:
            - "1"
            - "2le"
            - "4le"
            - "8le"
            - "2be"
            - "4be"
            - "8be"
            - "2a"
            - "4a"
            - "8a"
        - name: range
          type: RZ_CMD_ARG_TYPE_STRING
          flags: RZ_CMD_ARG_FLAG_ARRAY
      details:
        - name: Arguments
          entries:
            - text: "bytes"
              comment: "Value byte width and endianess."
            - text: "range"
              comment: "One or multiple ranges of values.
                Can be single values or range descriptions. Must be wrapped in '\"'."
        - name: Usage example
          entries:
            - text: "/v"
              arg_str: " 4be 512"
              comment: "Search 512 represented in 4 bytes big endian order."
            - text: "/v"
              arg_str: " 8le \"[0x80000000,0x80001000]\""
              comment: "Search values in the closed range '[0x80000000,0x80001000]'
                represented in 8 bytes little endian order."
            - text: "/v"
              arg_str: " 2a \"(0x1000,0xff0)\""
              comment: "Search values in the open range '(0x1000,0xff0)' represented
                in 2 bytes order of cfg.bigendian."
            - text: "/v"
              arg_str: " 1 \"[0x20,0x10)\", 0x55, \"[0xf0,0xff]\""
              comment: "Search values in the right open range '[0x20,0x10)', value '0x55'
                and closed range values '[0xf0,0xff]' represented in 1 byte."
    - name: "/v1"
      summary: Value search - Alias for /v 1 <value>.
      cname: cmd_search_value_alias_v1
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: value
          type: RZ_CMD_ARG_TYPE_NUM
    - name: "/v2"
      summary: Value search - Alias for /v 2a <value>.
      cname: cmd_search_value_alias_v2
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: value
          type: RZ_CMD_ARG_TYPE_NUM
    - name: "/v4"
      summary: Value search - Alias for /v 4a <value>.
      cname: cmd_search_value_alias_v4
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: value
          type: RZ_CMD_ARG_TYPE_NUM
    - name: "/v8"
      summary: Value search - Alias for /v 8a <value>.
      cname: cmd_search_value_alias_v8
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: value
          type: RZ_CMD_ARG_TYPE_NUM
    - name: "/V1"
      summary: Value search - Alias for /v 1 [<min_value>,<max_value>].
      cname: cmd_search_value_alias_v1_range
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: min_value
          type: RZ_CMD_ARG_TYPE_NUM
        - name: max_value
          type: RZ_CMD_ARG_TYPE_NUM
    - name: "/V2"
      summary: Value search - Alias for /v 2a [<min_value>,<max_value>].
      cname: cmd_search_value_alias_v2_range
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: min_value
          type: RZ_CMD_ARG_TYPE_NUM
        - name: max_value
          type: RZ_CMD_ARG_TYPE_NUM
    - name: "/V4"
      summary: Value search - Alias for /v 4a [<min_value>,<max_value>].
      cname: cmd_search_value_alias_v4_range
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: min_value
          type: RZ_CMD_ARG_TYPE_NUM
        - name: max_value
          type: RZ_CMD_ARG_TYPE_NUM
    - name: "/V8"
      summary: Value search - Alias for /v 8a [<min_value>,<max_value>].
      cname: cmd_search_value_alias_v8_range
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: min_value
          type: RZ_CMD_ARG_TYPE_NUM
        - name: max_value
          type: RZ_CMD_ARG_TYPE_NUM

  - name: "/x"
    summary: Raw hexadecimal search.
    subcommands:
    - name: "/x"
      summary: Raw hexadecimal search.
      cname: cmd_search_hex
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: pattern
          type: RZ_CMD_ARG_TYPE_STRING
      details:
        - name: Usage example
          entries:
            - text: "Hexadecimal search for the exact bytes 'ffcc33'."
              comment: "/x ffcc33"
            - text: "Hexadecimal search for the byte pattern 'ff..33.0.'. The '.' is a wildcard for 4bits."
              comment: "/x ff..33.0"
            - text: "Hexadecimal search of the bytes with mask. Pattern: '<resulting bytes>:<mask>'"
              comment: "/x ffd0:ff43"
            - text: "Hexadecimal search with an odd number of nibbles."
              comment: "'aabbc' is equivalent to '.aabbc'"
    - name: "/xr"
      summary: Regex bytes search.
      cname: cmd_search_hex_regex
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: regex_pattern
          type: RZ_CMD_ARG_TYPE_STRING
      details:
        - name: Usage examples
          entries:
            - text: " Bytes are prefixed with a 'x'. Search exact match '\\x99\\x0a'."
              comment: "/xr x99x0a"
            - text: "Search 2-8 NUL bytes, then '\\x99' and '\\x0a'"
              comment: "/xr x00{2,8}x99x0a"
            - text: "A '.' matches one byte. Search matches: '\\x72\\xNN\\x00'. '\\xNN' can appear 0-1 times."
              comment: "/xr x72.?x00"
            - text: "Using simple ASCII is allowed. Search matches: '\\x61\\x41'"
              comment: "/xr aA"
  - name: "/z"
    summary: String search.
    details:
    - name: "Encodings"
      entries:
        - text: "ascii"
          comment: "ASCII encoding"
        - text: "8bit"
          comment: "8bit encoding. Alias: ASCII"
        - text: "mutf8"
          comment: "mutf8 encoding"
        - text: "utf8"
          comment: "UTF-8 encoding"
        - text: "utf16le"
          comment: "UTF-16 little endian encoding"
        - text: "utf32le"
          comment: "UTF-32 little endian encoding"
        - text: "utf16be"
          comment: "UTF-16 big endian encoding"
        - text: "utf32be"
          comment: "UTF-32 big endian encoding"
        - text: "ibm037"
          comment: "ibm037 encoding. Alias: cp037, ebcdic-cp-us, ebcdic-cp-ca, ebcdic-cp-wt, ebcdic-cp-nl, csIBM037"
        - text: "ibm290"
          comment: "ibm290 encoding. Alias: cp290, EBCDIC-JP-kana, csIBM290"
        - text: "ebcdices"
          comment: "EBCDIC-ES encoding. Alias: csEBCDICES"
        - text: "ebcdicuk"
          comment: "EBCDIC-UK encoding. Alias: csEBCDICUK"
        - text: "ebcdicus"
          comment: "EBCDIC-US encoding. Alias: csEBCDICUS"
    - name: "Regex Flags"
      entries:
        - text: "l"
          comment: "Default. Literal string comparison. Ignores all meta-characters."
        - text: "i"
          comment: "Caseless (equivalent: PCRE2_CASELESS)"
        - text: "r"
          comment: "Regular expression."
        - text: "e"
          comment: "Extended regular expression."
        - text: "m"
          comment: "Multiline regular expression (equivalent flag: PCRE2_MULTILINE)"
        - text: "d"
          comment: "Dot matches any one character, without exception (equivalent flag: PCRE2_DOTALL)"
    - name: "Examples"
      entries:
        - text: "/z"
          arg_str: " (ABC*)"
          comment: "Search the exact string \"(ABC*)\"."
        - text: "/z"
          arg_str: " (ABC*)D li"
          comment: "Search the exact string \"(ABC*)D\" but case insensitive."
        - text: "/z"
          arg_str: " \\\\d\\\\sC*\\\\w ri"
          comment: "Search the regular expression \"\\d\\sC*\\w\" but case insensitive."
        - text: "/z"
          arg_str: " \"и.{3}м\" ei @e:search.prefix=cyrillic"
          comment: "Search the extended regular expression \"и.{3}м\" but case insensitive. 
            Search hit flags will be prefixed with 'cyrillic'."
        - text: "/z"
          arg_str: " \"(*LF).+\" r ascii"
          comment: "Search any ASCII string where line feed is a newline."
    subcommands:
    - name: "/z"
      summary: String search.
      cname: cmd_search_string_sensitive
      type: RZ_CMD_DESC_TYPE_ARGV_STATE
      modes:
        - RZ_OUTPUT_MODE_STANDARD
        - RZ_OUTPUT_MODE_JSON
        - RZ_OUTPUT_MODE_QUIET
        - RZ_OUTPUT_MODE_TABLE
      args:
        - name: pattern
          type: RZ_CMD_ARG_TYPE_STRING
        - name: regex_flags
          type: RZ_CMD_ARG_TYPE_STRING
          default_value: "l"
        - name: encoding
          type: RZ_CMD_ARG_TYPE_CHOICES
          default_value: "settings"
          choices:
            - "ascii"
            - "8bit"
            - "mutf8"
            - "utf8"
            - "utf16le"
            - "utf32le"
            - "utf16be"
            - "utf32be"
            - "ibm037"
            - "ibm290"
            - "ebcdices"
            - "ebcdicuk"
            - "ebcdicus"
            - "guess"
