RAGG2(1)

NAME
ragg2 - Radare2 Frontend for r_egg; Compiles Programs into Tiny Binaries for x86 and ARM Architectures

SYNOPSIS
ragg2 [-FOLsrxhvz] [-a arch] [-b bits] [-k os] [-o file] [-i sc] [-I path] [-E enc] [-B hex] [-c k=v] [-C file] [-p pad] [-q off] [-S string] [-f fmt] [-nN dword] [-dDw off:hex] [-e expr]

DESCRIPTION
Frontend for r_egg, compiling assembly programs into minimal binaries for x86-32, x86-64, and ARM architectures.

Built on top of r_asm and r_bin, it provides a library for generating small standalone binaries across supported platforms.

Programs generated by r_egg are relocatable and can be injected in a running process or on-disk binary file.

ragg2 can generate shellcodes from C code. The final code can be linked with rabin2 and it is relocatable, so it can be used to inject it on any remote process.

OPTIONS

-a arch
    Select architecture (x86, mips, arm)

-b bits
    Register size (32, 64, ..)

-B hexpairs
    Append some hexpair bytes

-c k=v
    Set configuration options

-C file
    Append contents of file

-d off:dword
    Patch dword (4 bytes) at given offset

-D off:qword
    Patch qword (8 bytes) at given offset

-e egg-expr
    Take egg program from string instead of file

-E encoder
    Use specific encoder. See -L

-f format
    Output format (raw, c, pe, elf, mach0, python, javascript)

-F  Output native format (osx=mach0, linux=elf, ..)

-h  Show usage help message

-H var
    Display variable

-i shellcode
    Include shellcode plugin, uses options. See -L

-I path
    Add include path

-k os
    Operating system's kernel (linux,bsd,osx,w32)

-L  List all plugins (shellcodes and encoders)

-n dword
    Append 32bit number (4 bytes)

-N dword
    Append 64bit number (8 bytes)

-o file
    Output file

-O  Use default output file (filename without extension or a.out)

-p padding
    Add padding after compilation (padding=n10s32) ntas : begin nop, trap, 'a', sequence NTAS : same as above, but at the end

-P size
    Prepend debruijn pattern

-q fragment
    Debruijn pattern offset

-r  Show raw bytes instead of hexpairs

-s  Show assembler

-S string
    Append a string

-v  Show version information

-w off:hex
    Patch hexpairs at given offset

-x  Execute

-X hexpairs
    Execute rop chain, using the stack provided

-z  Output in C string syntax

ENVIRONMENT

R2_NOPLUGINS
    Do not load any plugin

R2_PLUGINS_ORDER
    Plugin path order: e=env, h=home, s=system; ? prints help

EXAMPLES

Using r_egg language:

$ cat hi.r /* hello world in r_egg */ write@syscall(4); //x64 write@syscall(1); exit@syscall(1); //x64 exit@syscall(60); main@global(128) { .var0 = "hi!\n"; write(1,.var0, 4); exit(0); } $ ragg2 -O -F hi.r $ ./hi hi!

Using C language:

$ cat hi.c main() { write(1, "Hello\n", 6); exit(0); } $ ragg2 -O -F hi.c $ ./hi Hello

Tiny binary output:

$ wc -c < hi 165

Compiled shellcode with zeroes:

$ ragg2 hi.c | tail -1 eb0748656c6c6f0a00bf01000000488d35edffffffba06000000b8010 000000f0531ffb83c0000000f0531c0c3

Using XOR encoder with key 64:

$ ragg2 -e xor -c key=64 -B $(ragg2 hi.c | tail -1) 6a2d596a405be8ffffffffc15e4883c60d301e48ffc6e2f9ab4708252 c2c2f4a40ff4140404008cd75adbfbfbffa46404040f8414040404f45 71bff87c4040404f45718083

SEE ALSO

radare2(1)

AUTHORS

Written by pancake <pancake@nopcode.org>.