1RAGG2(1)                  BSD General Commands Manual                 RAGG2(1)
2

NAME

4     ragg2 — radare2 frontend for r_egg, compile programs into tiny binaries
5     for x86-32/64 and arm.
6

SYNOPSIS

8     ragg2 [-a arch] [-b bits] [-k kernel] [-f format] [-o file]
9           [-i shellcode] [-I path] [-e encoder] [-B hexpairs] [-c k=v]
10           [-C file] [-n num32] [-N num64] [-d off:dword] [-D off:qword]
11           [-w off:hexpair] [-p padding] [-P pattern] [-q fragment]
12           [-FOLsrxvhz]
13

DESCRIPTION

15     ragg2 is a frontend for r_egg, compile programs into tiny binaries for
16     x86-32/64 and arm.
17
18     This tool is experimental and it is a rewrite of the old rarc2 and
19     rarc2-tool programs as a library and integrated with r_asm and r_bin.
20
21     Programs generated by r_egg are relocatable and can be injected in a run‐
22     ning process or on-disk binary file.
23
24     Since the ragg2-cc merge, ragg2 can now generate shellcodes from C code.
25     The final code can be linked with rabin2 and it is relocatable, so it can
26     be used to inject it on any remote process. This feature is conceptually
27     based on shellforge4, but only linux/osx x86-32/64 platforms are sup‐
28     ported.
29

DIRECTIVES

31     The rr2 (ragg2) configuration file accepts the following directives,
32     described as key=value entries and comments defined as lines starting
33     with '#'.
34
35     -a arch     set architecture x86, arm
36
37     -b bits     32 or 64
38
39     -k kernel   windows, linux or osx
40
41     -f format   output format (raw, c, pe, elf, mach0, python, javascript)
42
43     -o file     output file to write result of compilation
44
45     -i shellcode
46                 specify shellcode name to be used (see -L)
47
48     -e encoder  specify encoder name to be used (see -L)
49
50     -B hexpair  specify shellcode as hexpairs
51
52     -c k=v      set configure option for the shellcode encoder. The argument
53                 must be key=value.
54
55     -C file     include contents of file
56
57     -d off:dword
58                 Patch final buffer with given dword at specified offset
59
60     -D off:qword
61                 Patch final buffer with given qword at specified offset
62
63     -w off:hexpairs
64                 Patch final buffer with given hexpairs at specified offset
65
66     -n num32    Append a 32bit number in little endian
67
68     -N num64    Append a 64bit number in little endian
69
70     -p padding  Specify generic paddings with a format string. Use lowercase
71                 letters to prefix, and uppercase to suffix, keychars are. 'n'
72                 for nop, 't' for trap, 'a' for sequence and 's' for zero.
73
74     -P size     Prepend debruijn sequence of given length.
75
76     -q fragment
77                 Output offset of debruijn sequence fragment.
78
79     -F          autodetect native file format (osx=mach0, linux=elf, ..)
80
81     -O          use default output file (filename without extension or a.out)
82
83     -I path     add include path
84
85     -s          show assembler code
86
87     -S          append a string
88
89     -r          show raw bytes instead of hexpairs
90
91     -x          execute (just-in-time)
92
93     -L          list all plugins (shellcodes and encoders)
94
95     -h          show this help
96
97     -z          output in C string syntax
98
99     -v          show version
100

EXAMPLE

102       $ cat hi.r
103       /* hello world in r_egg */
104       write@syscall(4); //x64 write@syscall(1);
105       exit@syscall(1); //x64 exit@syscall(60);
106
107       main@global(128) {
108         .var0 = "hi!\n";
109         write(1,.var0, 4);
110         exit(0);
111       }
112       $ ragg2 -O -F hi.r
113       $ ./hi
114       hi!
115
116       # With C file :
117       $ cat hi.c
118       main() {
119         write(1, "Hello\n", 6);
120         exit(0);
121       }
122       $ ragg2 -O -F hi.c
123
124       $ ./hi
125       Hello
126
127       # Linked into a tiny binary. This is 165 bytes
128       $ wc -c < hi
129         165
130
131       # The compiled shellcode has zeroes
132       $ ragg2 hi.c | tail -1
133       eb0748656c6c6f0a00bf01000000488d35edffffffba06000000b8010
134       000000f0531ffb83c0000000f0531c0c3
135
136       # Use a xor encoder with key 64 to bypass
137       $ ragg2 -e xor -c key=64 -B $(ragg2 hi.c | tail -1)
138       6a2d596a405be8ffffffffc15e4883c60d301e48ffc6e2f9ab4708252
139       c2c2f4a40ff4140404008cd75adbfbfbffa46404040f8414040404f45
140       71bff87c4040404f45718083
141

SEE ALSO

143     radare2(1), rahash2(1), rafind2(1), rabin2(1), rafind2(1), radiff2(1),
144     rasm2(1),
145

AUTHORS

147     Written by pancake <pancake@nopcode.org>.
148
149                                 Sep 30, 2014
Impressum