---
name: "rarun2"
section: "1"
platform: "linux"
package: "radare2"
version: "6.2.2-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/rarun2"
---

# rarun2(1)

radare2 utility to run programs in exotic environments

## NAME

**rarun2** – radare2 utility to run programs in exotic environments

## SYNOPSIS

**rarun2** \[**-vt**\] \[*directives* *...*\] \[*script.rr2*\] \[Fl- *program* *args* *...*\]

## DESCRIPTION

A launcher for executing programs with custom environments, arguments, permissions, working directories, and redirected file descriptors.

Supports inline directive arguments, script files, or program specifications after the '--' separator.

Ideal for simplifying complex command lines, preparing specialized environments, and automating testing or exploitation scenarios.

## OPTIONS

- **-v**

  Show version

- **-t**

  Show terminal name

- **--**

  Use remaining arguments as program and program arguments

## DIRECTIVES

The rr2 (rarun2) configuration file accepts the following directives, described as key=value entries and comments defined as lines starting with '#'.

- *program=*

  Path to program to be executed

- *arg0=..argN=*

  Set values for arguments passed to the program

- *aslr=*

  Enable or disable ASLR (yes\|no)

- *bits=*

  Set 32 or 64 bit (if the architecture supports it)

- *chdir=*

  Change directory before executing the program

- *chroot=*

  Run the program in chroot (requires some previous setup)

- *clearenv=*

  Unset the whole environment (true\|false)

- *connect=*

  Connect stdin/stdout/stderr to a socket (host:port)

- *core=*

  Set no limit to the core file size (true\|false)

- *daemon=*

  Run in background, detached from terminal (default: false)

- *envfile=*

  Set a file with lines like 'var=value' to be used as env

- *execve=*

  Use execve instead of posix\_spawn (osx tricks)

- *fork=*

  Allow spawning different process for each connection with 'listen'

- *input=*

  Set string to be passed to the program via stdin

- *libpath=*

  Override path where the dynamic loader looks for shared libraries

- *listen=*

  Bind stdin/stdout/stderr to a listening socket (port)

- *maxfd=*

  Set the maximum number of file descriptors

- *maxproc=*

  Set the maximum number of processes

- *maxstack=*

  Set the maximum size for the stack

- *nice=*

  Set the niceness level of the process

- *pid=*

  Set process pid

- *pidfile=*

  Write pid to a file

- *preload=*

  Preload a library (not supported on Windows, only linux,osx,bsd)

- *pty=*

  Use a pty for connection over socket (true\|false)

- *r2preload=*

  Preload with libr2, kill -USR1 for r2 shell, -USR2 for webserver

- *r2preweb=*

  Run webserver in a thread at start with r2preload

- *runlib=*

  Path to the library to be executed

- *runlib.fcn=*

  Function name to call from runlib library

- *setegid=*

  Set effective process group id

- *seteuid=*

  Set effective process uid

- *setenv=*

  Set value for given environment variable (NAME=VALUE)

- *setgid=*

  Set process group id

- *setuid=*

  Set process uid

- *sleep=*

  Sleep for the given amount of seconds before execution

- *stderrout=*

  Redirect stderr file descriptor to stdout (true\|false)

- *stdio=*

  Select file or terminal for stdout/stderr/stdin

- *stdin=*

  Select file to read data from stdin

- *stdout=*

  Select file to replace stdout file descriptor

- *stderr=*

  Select file to replace stderr file descriptor

- *system=*

  Execute the given command

- *timeout=*

  Set a timeout in seconds

- *timeoutsig=*

  Signal to use when killing child on timeout (SIGTERM)

- *times=*

  Print runtime in milliseconds to stderr (true\|false)

- *unsetenv=*

  Unset one environment variable

## VALUE PREFIXES

Every value in this configuration file can contain a special prefix:

- *@filename*

  Slurp contents of file and put them inside the key

- *text*

  Escape characters useful for hex chars

- *'string'*

  Escape characters useful for hex chars

- *!cmd*

  Run command to store the output in the variable

- *:102030*

  Parse hexpair string and store it in the variable

- *:!cmd*

  Parse hexpair string from output of command and store it in the variable

- *%1234*

  Parses the input string and returns it as integer

- *@300@ABCD*

  300 characters filled with ABCD pattern

## ENVIRONMENT

- RARUN2\_ARGS

  Useful to run "rarun2" but parse arguments from environment var

## EXAMPLES

Sample rarun2 script:

  $ cat foo.rr2\
   \#!/usr/bin/rarun2\
   program=./pp400\
   arg0=10\
   stdin=foo.txt\
   chdir=/tmp\
   clearenv=true\
   setenv=EGG=eggsy\
   setenv=NOFUN=nogames\
   unsetenv=NOFUN\
   \# EGG will be the only env variable\
   \#chroot=.\
   $ ./foo.rr2

Connecting a program to a socket:

  $ nc -l 9999\
   $ rarun2 program=/bin/ls connect=localhost:9999

Debugging a program redirecting IO to another terminal:

  \## open a new terminal and type 'tty' to get\
   $ tty ; clear ; sleep 999999\
   /dev/ttyS010\
   \## in another terminal run r2\
   $ r2 -r foo.rr2 -d ls\
   $ cat foo.rr2\
   \#!/usr/bin/rarun2\
   stdio=/dev/ttys010\
   \## Or you can use -R to set a key=value\
   r2 -R stdio=/dev/ttys010 -d ls

You can also use the -- flag to specify program and arguments:

  $ rarun2 timeout=2 -- sleep 4

Run a library function:

  $ rarun2 runlib=/lib/libc-2.25.so runlib.fcn=system arg1="ls /"

## SEE ALSO

[radare2(1)](/radare2/1.md)

## AUTHORS

Written by pancake \<pancake@nopcode.org\>