The base64_substring tool is designed to assist malware analysts in searching through base64-encoded samples by generating comprehensive search patterns. The tool enumerates all possible base64 encodings for a given search term, accounting for different alignment positions and padding scenarios that can occur when text is encoded within larger data structures. It automatically generates YARA rules that check for these various encoding possibilities, enabling analysts to detect specific strings or patterns within base64-encoded malware samples regardless of their position or alignment within the encoded data. The tool addresses the challenge of searching for known strings in base64-encoded content where the encoding can vary depending on the surrounding data and byte alignment.