1RAGG2(1)                  BSD General Commands Manual                 RAGG2(1)
2

NAME

4     ragg2 — radare2 frontend for r_egg, compile programs into tiny binaries
5     for x86-32/64 and arm.
6

SYNOPSIS

8     ragg2 [-a arch] [-b bits] [-k kernel] [-f format] [-o file]
9           [-i shellcode] [-I path] [-e encoder] [-B hexpairs] [-c k=v]
10           [-C file] [-n num32] [-N num64] [-d off:dword] [-D off:qword]
11           [-w off:hexpair] [-p padding] [-P pattern] [-q fragment]
12           [-FOLsrxvhz]
13

DESCRIPTION

15     ragg2 is a frontend for r_egg, compile programs into tiny binaries for
16     x86-32/64 and arm.
17
18     This tool is experimental and it is a rewrite of the old rarc2 and
19     rarc2-tool programs as a library and integrated with r_asm and r_bin.
20
21     Programs generated by r_egg are relocatable and can be injected in a run‐
22     ning process or on-disk binary file.
23
24     Since the ragg2-cc merge, ragg2 can now generate shellcodes from C code.
25     The final code can be linked with rabin2 and it is relocatable, so it can
26     be used to inject it on any remote process. This feature is conceptually
27     based on shellforge4, but only linux/osx x86-32/64 platforms are sup‐
28     ported.
29

DIRECTIVES

31     The rr2 (ragg2) configuration file accepts the following directives,
32     described as key=value entries and comments defined as lines starting
33     with '#'.
34
35     -a arch     set architecture x86, arm
36
37     -b bits     32 or 64
38
39     -k kernel   windows, linux or osx
40
41     -f format   output format (raw, c, pe, elf, mach0, python, javascript)
42
43     -o file     output file to write result of compilation
44
45     -i shellcode
46                 specify shellcode name to be used (see -L)
47
48     -e encoder  specify encoder name to be used (see -L)
49
50     -B hexpair  specify shellcode as hexpairs
51
52     -c k=v      set configure option for the shellcode encoder. The argument
53                 must be key=value.
54
55     -C file     include contents of file
56
57     -d off:dword
58                 Patch final buffer with given dword at specified offset
59
60     -D off:qword
61                 Patch final buffer with given qword at specified offset
62
63     -w off:hexpairs
64                 Patch final buffer with given hexpairs at specified offset
65
66     -n num32    Append a 32bit number in little endian
67
68     -N num64    Append a 64bit number in little endian
69
70     -p padding  Specify generic paddings with a format string. Use lowercase
71                 letters to prefix, and uppercase to suffix, keychars are. 'n'
72                 for nop, 't' for trap, 'a' for sequence and 's' for zero.
73
74     -P size     Prepend debruijn sequence of given length.
75
76     -q fragment
77                 Output offset of debruijn sequence fragment.
78
79     -F          autodetect native file format (osx=mach0, linux=elf, ..)
80
81     -O          use default output file (filename without extension or a.out)
82
83     -I path     add include path
84
85     -s          show assembler code
86
87     -S          append a string
88
89     -r          show raw bytes instead of hexpairs
90
91     -x          execute (just-in-time)
92
93     -X          execute rop chain
94
95     -L          list all plugins (shellcodes and encoders)
96
97     -h          show this help
98
99     -z          output in C string syntax
100
101     -v          show version
102

EXAMPLE

104       $ cat hi.r
105       /* hello world in r_egg */
106       write@syscall(4); //x64 write@syscall(1);
107       exit@syscall(1); //x64 exit@syscall(60);
108
109       main@global(128) {
110         .var0 = "hi!\n";
111         write(1,.var0, 4);
112         exit(0);
113       }
114       $ ragg2 -O -F hi.r
115       $ ./hi
116       hi!
117
118       # With C file :
119       $ cat hi.c
120       main() {
121         write(1, "Hello\n", 6);
122         exit(0);
123       }
124       $ ragg2 -O -F hi.c
125
126       $ ./hi
127       Hello
128
129       # Linked into a tiny binary. This is 165 bytes
130       $ wc -c < hi
131         165
132
133       # The compiled shellcode has zeroes
134       $ ragg2 hi.c | tail -1
135       eb0748656c6c6f0a00bf01000000488d35edffffffba06000000b8010
136       000000f0531ffb83c0000000f0531c0c3
137
138       # Use a xor encoder with key 64 to bypass
139       $ ragg2 -e xor -c key=64 -B $(ragg2 hi.c | tail -1)
140       6a2d596a405be8ffffffffc15e4883c60d301e48ffc6e2f9ab4708252
141       c2c2f4a40ff4140404008cd75adbfbfbffa46404040f8414040404f45
142       71bff87c4040404f45718083
143

SEE ALSO

145     radare2(1), rahash2(1), rafind2(1), rabin2(1), rafind2(1), radiff2(1),
146     rasm2(1),
147

AUTHORS

149     Written by pancake <pancake@nopcode.org>.
150
151                                 Sep 30, 2014
Impressum