ragg21

Usage

Overview

Frontend for r_egg, compiling assembly programs into minimal binaries for x86-32, x86-64, and ARM architectures.

Built on top of r_asm and r_bin, it provides a library for generating small standalone binaries across supported platforms.

Programs generated by r_egg are relocatable and can be injected in a running process or on-disk binary file.

ragg2 can generate shellcodes from C code. The final code can be linked with rabin2 and it is relocatable, so it can be used to inject it on any remote process.

Options

-a arch

Select architecture (x86, mips, arm)

-b bits

Register size (32, 64, ..)

-B hexpairs

Append some hexpair bytes

-c k=v

Set configuration options

-C file

Append contents of file

-d off:dword

Patch dword (4 bytes) at given offset

-D off:qword

Patch qword (8 bytes) at given offset

-e egg-expr

Take egg program from string instead of file

-E encoder

Use specific encoder. See -L

-f format

Output format (raw, c, pe, elf, mach0, python, javascript)

-F

Output native format (osx=mach0, linux=elf, ..)

-h

Show usage help message

-H var

Display variable

-i shellcode

Include shellcode plugin, uses options. See -L

-I path

Add include path

-k os

Operating system's kernel (linux,bsd,osx,w32)

-L

List all plugins (shellcodes and encoders)

-n dword

Append 32bit number (4 bytes)

-N dword

Append 64bit number (8 bytes)

-o file

Output file

-O

Use default output file (filename without extension or a.out)

-p padding

Add padding after compilation (padding=n10s32) ntas : begin nop, trap, 'a', sequence NTAS : same as above, but at the end

-P size

Prepend debruijn pattern

-q fragment

Debruijn pattern offset

-r

Show raw bytes instead of hexpairs

-s

Show assembler

-S string

Append a string

-v

Show version information

-w off:hex

Patch hexpairs at given offset

-x

Execute

-X hexpairs

Execute rop chain, using the stack provided

-z

Output in C string syntax

Environment

R2_NOPLUGINS

Do not load any plugin

R2_PLUGINS_ORDER

Plugin load order: i=internal, e=env, h=home, s=system; default=iehs; ? prints help

Examples

Using r_egg language:

$ cat hi.r
/* hello world in r_egg */
write@syscall(4); //x64 write@syscall(1);
exit@syscall(1); //x64 exit@syscall(60);
main@global(128) {
.var0 = "hi!\n";
write(1,.var0, 4);
exit(0);
}
$ ragg2 -O -F hi.r
$ ./hi
hi!

Using C language:

$ cat hi.c
main() {
write(1, "Hello\n", 6);
exit(0);
}
$ ragg2 -O -F hi.c
$ ./hi
Hello

Tiny binary output:

$ wc -c < hi
165

Compiled shellcode with zeroes:

$ ragg2 hi.c | tail -1
eb0748656c6c6f0a00bf01000000488d35edffffffba06000000b8010
000000f0531ffb83c0000000f0531c0c3

Using XOR encoder with key 64:

$ ragg2 -e xor -c key=64 -B $(ragg2 hi.c | tail -1)
6a2d596a405be8ffffffffc15e4883c60d301e48ffc6e2f9ab4708252
c2c2f4a40ff4140404008cd75adbfbfbffa46404040f8414040404f45
71bff87c4040404f45718083