NAME
ragg2 – Radare2 Frontend for r_egg; Compiles Programs into Tiny Binaries for x86 and ARM Architectures
SYNOPSIS
ragg2 [-FOLsrxhvz] [-a arch] [-b bits] [-k os] [-o file] [-i sc] [-I path] [-E enc] [-B hex] [-c k=v] [-C file] [-p pad] [-q off] [-S string] [-f fmt] [-nN dword] [-dDw off:hex] [-e expr]
DESCRIPTION
Frontend for r_egg, compiling assembly programs into minimal binaries for x86-32, x86-64, and ARM architectures.
Built on top of r_asm and r_bin, it provides a library for generating small standalone binaries across supported platforms.
Programs generated by r_egg are relocatable and can be injected in a running process or on-disk binary file.
ragg2 can generate shellcodes from C code. The final code can be linked with rabin2 and it is relocatable, so it can be used to inject it on any remote process.
OPTIONS
- -a arch
-
Select architecture (x86, mips, arm)
- -b bits
-
Register size (32, 64, ..)
- -B hexpairs
-
Append some hexpair bytes
- -c k=v
-
Set configuration options
- -C file
-
Append contents of file
- -d off:dword
-
Patch dword (4 bytes) at given offset
- -D off:qword
-
Patch qword (8 bytes) at given offset
- -e egg-expr
-
Take egg program from string instead of file
- -E encoder
-
Use specific encoder. See -L
- -f format
-
Output format (raw, c, pe, elf, mach0, python, javascript)
- -F
-
Output native format (osx=mach0, linux=elf, ..)
- -h
-
Show usage help message
- -H var
-
Display variable
- -i shellcode
-
Include shellcode plugin, uses options. See -L
- -I path
-
Add include path
- -k os
-
Operating system's kernel (linux,bsd,osx,w32)
- -L
-
List all plugins (shellcodes and encoders)
- -n dword
-
Append 32bit number (4 bytes)
- -N dword
-
Append 64bit number (8 bytes)
- -o file
-
Output file
- -O
-
Use default output file (filename without extension or a.out)
- -p padding
-
Add padding after compilation (padding=n10s32) ntas : begin nop, trap, 'a', sequence NTAS : same as above, but at the end
- -P size
-
Prepend debruijn pattern
- -q fragment
-
Debruijn pattern offset
- -r
-
Show raw bytes instead of hexpairs
- -s
-
Show assembler
- -S string
-
Append a string
- -v
-
Show version information
- -w off:hex
-
Patch hexpairs at given offset
- -x
-
Execute
- -X hexpairs
-
Execute rop chain, using the stack provided
- -z
-
Output in C string syntax
ENVIRONMENT
- R2_NOPLUGINS
-
Do not load any plugin
- R2_PLUGINS_ORDER
-
Plugin load order: i=internal, e=env, h=home, s=system; default=iehs; ? prints help
EXAMPLES
Using r_egg language:
$ cat hi.r
/* hello world in r_egg */
write@syscall(4); //x64 write@syscall(1);
exit@syscall(1); //x64 exit@syscall(60);
main@global(128) {
.var0 = "hi!\n";
write(1,.var0, 4);
exit(0);
}
$ ragg2 -O -F hi.r
$ ./hi
hi!
Using C language:
$ cat hi.c
main() {
write(1, "Hello\n", 6);
exit(0);
}
$ ragg2 -O -F hi.c
$ ./hi
Hello
Tiny binary output:
$ wc -c < hi
165
Compiled shellcode with zeroes:
$ ragg2 hi.c | tail -1
eb0748656c6c6f0a00bf01000000488d35edffffffba06000000b8010
000000f0531ffb83c0000000f0531c0c3
Using XOR encoder with key 64:
$ ragg2 -e xor -c key=64 -B $(ragg2 hi.c | tail -1)
6a2d596a405be8ffffffffc15e4883c60d301e48ffc6e2f9ab4708252
c2c2f4a40ff4140404008cd75adbfbfbffa46404040f8414040404f45
71bff87c4040404f45718083
SEE ALSO
AUTHORS
Written by pancake <[email protected]>.