---
name: "rz-run"
section: "1"
platform: "linux"
package: "rizin"
version: "0.8.2-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/rz-run"
---

# rz-run(1)

rizin utility to run programs in custom environments

## NAME

**rz-run** – rizin utility to run programs in custom environments

## SYNOPSIS

**rz-run** \[\[directives\]\] \[\[script.rz\]\] \[\[--\] \[program\] \[args\]\]

## DESCRIPTION

This command is part of the Rizin project.

This program is used as a launcher for running programs with different environment, arguments, permissions, directories and overridden default filedescriptors.

- **-l**

  List all the supported profile options.

- **-t**

  Output a base template profile. Try rz-run -d \> profile.rz

- **-w**

  Show the terminal name and wait for a connection from another process. Try rz-run stdio=\<ttypath\> program=/bin/sh

The program just accepts a single argument which is the filename of the configuration file to run the program.

It is useful when you have to run a program using long arguments or pass long data to stdin or things like that usually required for exploiting crackmes :)

## DIRECTIVES

The rrz (rz-run) configuration file accepts the following directives, described as key=value entries and comments defined as lines starting with '#'.

- *arg\[0-511\]*

  Set value for argument N passed to the program

- *aslr*

  Enable or disable ASLR

- *bits*

  Set 32 or 64 bit (if the architecture supports it)

- *chdir*

  Change directory before executing the program

- *chroot*

  Run the program in chroot. requires some previous setup

- *core*

  Set no limit the core file size

- *connect*

  Connect stdin/stdout/stderr to a socket

- *pty*

  Use a pty for connection over socket (with connect/listen)

- *envfile*

  Set a file with lines like \`var=value\` to be used as env

- *fork*

  Used with the listen option, allow to spawn a different process for each connection. Ignored when debugging.

- *input*

  Set string to be passed to the program via stdin

- *libpath*

  Override path where the dynamic loader will look for shared libraries

- *listen*

  Bound stdin/stdout/stderr to a listening socket

- *maxstack*

  Set the maximum size for the stack

- *maxproc*

  Set the maximum number of processes

- *maxfd*

  Set the maximum number of file descriptors

- *nice*

  Set the niceness level of the process

- *preload*

  Preload a library (not supported on Windows, only linux,osx,bsd)

- *daemon*

  Set to false by default, otherwise it will run the program in background, detached from the terminal.

- *program*

  Path to program to be executed

- *pid*

  Set to true to print the PID of the process to stderr

- *pidfile*

  Print the PID of the process to the specified file

- *runlib*

  Path to the library to be executed

- *runlib.fcn*

  Function name to call from runlib library

- *rzpreload*

  Preload with librz, kill -USR1 to get an rizin shell or -USRZ to spawn a webserver in a thread

- *setenv*

  Set value for given environment variable

- *setegid*

  Set effective process group id

- *seteuid*

  Set effective process uid

- *setgid*

  Set process group id

- *setuid*

  Set process uid

- *sleep*

  Sleep for the given amount of seconds

- *stdio=value*

  Set io streams (stdin, stdout, stderr) to a value

- *stdio=!cmd*

  Redirect input/output to the process created by the specified command

- *stdin*

  Set stdin, stdout, and stderr streams to the specified value

- *stdout*

  Select file to replace stdout file descriptor

- *stderr*

  Select file to replace stderr file descriptor

- *system*

  Execute the given command

- *timeout*

  Set a timeout

- *timeoutsig*

  Signal to use when killing the child because the timeout happens

- *unsetenv*

  Unset one environment variable

## VALUE PREFIXES

Every value in this configuration file can contain a special

- *@filename*

  Slurp contents of file and put them inside the key

- *text*

  Escape characters useful for hex chars

- *'string'*

  Escape characters useful for hex chars

- *!cmd*

  Run command to store the output in the variable

- *:102030*

  Parse hexpair string and store it in the variable

- *:!cmd*

  Parse hexpair string from output of command and store it in the variable

- *%1234*

  Parses the input string and returns it as integer

## EXAMPLES

Sample rz-run script

  $ cat foo.rrz\
   \#!/usr/bin/rz-run\
   program=./pp400\
   arg0=10\
   stdin=foo.txt\
   chdir=/tmp\
   clearenv=true\
   setenv=EGG=eggsy\
   setenv=NOFUN=nogames\
   unsetenv=NOFUN\
   \# EGG will be the only env variable\
   \#chroot=.\
   ./foo.rrz

Connecting a program to a socket

**nc** **-l** **9999**

**rz-run** **program=/bin/ls** **connect=localhost:9999**

Debugging a program redirecting io to another terminal

  \## open a new terminal and type 'tty' to get\
   $ tty ; clear ; sleep 999999\
   /dev/ttyS010\
   \## in another terminal run rizin\
   $ rizin -r foo.rrz -d ls\
   $ cat foo.rrz\
   \#!/usr/bin/rz-run\
   stdio=/dev/ttys010\
   \## Or you can use -R to set a key=value\
   rizin -R stdio=/dev/ttys010 -d ls

You can also use the -- flag to specify program and arguments in a more natural way:

**rz-run** **timeout=2** *--* *sleep* *4*

Run a library function

**rz-run** **runlib=/lib/libc-2.25.so** **runlib.fcn=system** **arg1="ls** **/"**

## SEE ALSO

[rizin(1)](/rizin/1.md), [rz-hash(1)](/rz-hash/1.md), [rz-find(1)](/rz-find/1.md), [rz-bin(1)](/rz-bin/1.md), [rz-diff(1)](/rz-diff/1.md), [rz-gg(1)](/rz-gg/1.md), [rz-asm(1)](/rz-asm/1.md),

## AUTHORS

pancake \<pancake@nopcode.org\>

byteninjaa0