XORSearch

Usage:  XORSearch [-siuhkpwWLxrS] [-l length] [-n [-+]length] [-f
search-file] [-e byte] [-d encodings] file [string|hex|rule]
XORSearch V1.11.4, search for a XOR, ROL, ROT, SHIFT or ADD encoded string in a
file
Use filename - to read from stdin
Use -x when the file to search is a hexdump
Use -s to save the XOR, ROL, ROT, SHIFT or ADD encoded file containing the
string
Use -l length to limit the number of printed characters (50 by default, 38 with
option -p)
Use -i to ignore the case when searching
Use -u to search for Unicode strings (limited support)
Use -r to reverse the file before searching
Use -f to provide a file with search strings
Use -n [-+]length to print neighbouring characters (before & after the found
keyword)
Use -h to search for hex strings
Use -k to decode with embedded keys
Use -S to print all strings
Use -p to search for PE-files
Use -w to search with wildcards
Use -W to search with embedded wildcards
Use -L to list embedded wildcards
Use -e to exclude a particular byte-value from encoding
Use -d to disable encoding(s) 1: XOR 2: ROL 3: ROT 4: SHIFT 5: ADD
Options -l and -n are mutually exclusive
Options -u and -h are mutually exclusive
Options -k and -e are mutually exclusive
Option -p is not compatible with options -i, -u, -h, -n and -r
When using -p, do not provide a search string or use -f
When using -W, do not provide a search string or use -f
Use option -L without arguments or other options

Source code put in the public domain by Didier Stevens, no Copyright
Use at your own risk
https://DidierStevens.com