ragg2 - Radare2 Frontend for r_egg; Compiles Programs into Tiny Binaries for x86 and ARM Architectures

---

NAME

ragg2 — Radare2 Frontend for r_egg; Compiles Programs into Tiny Binaries for x86 and ARM Architectures

SYNOPSIS

ragg2 [−FOLsrxhvz] [−a arch] [−b bits] [−k os] [−o file] [−i sc] [−I path] [−E enc] [−B hex] [−c k=v] [−C file] [−p pad] [−q off] [−S string] [−f fmt] [−nN dword] [−dDw off:hex] [−e expr]

DESCRIPTION

Frontend for r_egg, compiling assembly programs into minimal binaries for x86-32, x86-64, and ARM architectures.

Built on top of r_asm and r_bin, it provides a library for generating small standalone binaries across supported platforms.

Programs generated by r_egg are relocatable and can be injected in a running process or on-disk binary file.

ragg2 can generate shellcodes from C code. The final code can be linked with rabin2 and it is relocatable, so it can be used to inject it on any remote process.

OPTIONS
−a arch

Select architecture (x86, mips, arm)

−b bits

Register size (32, 64, ..)

−B hexpairs

Append some hexpair bytes

−c k=v

Set configuration options

−C file

Append contents of file

−d off:dword

Patch dword (4 bytes) at given offset

−D off:qword

Patch qword (8 bytes) at given offset

−e egg-expr

Take egg program from string instead of file

−E encoder

Use specific encoder. See -L

−f format

Output format (raw, c, pe, elf, mach0, python, javascript)

−F

Output native format (osx=mach0, linux=elf, ..)

−h

Show usage help message

−H var

Display variable

−i shellcode

Include shellcode plugin, uses options. See -L

−I path

Add include path

−k os

Operating system’s kernel (linux,bsd,osx,w32)

−L

List all plugins (shellcodes and encoders)

−n dword

Append 32bit number (4 bytes)

−N dword

Append 64bit number (8 bytes)

−o file

Output file

−O

Use default output file (filename without extension or a.out)

−p padding

Add padding after compilation (padding=n10s32) ntas : begin nop, trap, ’a’, sequence NTAS : same as above, but at the end

−P size

Prepend debruijn pattern

−q fragment

Debruijn pattern offset

−r

Show raw bytes instead of hexpairs

−s

Show assembler

−S string

Append a string

−v

Show version information

−w off:hex

Patch hexpairs at given offset

−x

Execute

−X hexpairs

Execute rop chain, using the stack provided

−z

Output in C string syntax

ENVIRONMENT
R2_NOPLUGINS

Do not load any plugin

EXAMPLES

Using r_egg language:

$ cat hi.r
/* hello world in r_egg */
write@syscall(4); //x64 write@syscall(1);
exit@syscall(1); //x64 exit@syscall(60);
main@global(128) {
.var0 = "hi!\n";
write(1,.var0, 4);
exit(0);
}
$ ragg2 -O -F hi.r
$ ./hi
hi!

Using C language:

$ cat hi.c
main() {
write(1, "Hello\n", 6);
exit(0);
}
$ ragg2 -O -F hi.c
$ ./hi
Hello

Tiny binary output:

$ wc -c < hi
165

Compiled shellcode with zeroes:

$ ragg2 hi.c | tail -1
eb0748656c6c6f0a00bf01000000488d35edffffffba06000000b8010
000000f0531ffb83c0000000f0531c0c3

Using XOR encoder with key 64:

$ ragg2 -e xor -c key=64 -B $(ragg2 hi.c | tail -1)
6a2d596a405be8ffffffffc15e4883c60d301e48ffc6e2f9ab4708252
c2c2f4a40ff4140404008cd75adbfbfbffa46404040f8414040404f45
71bff87c4040404f45718083

SEE ALSO

radare2(1)

AUTHORS

Written by pancake <[email protected]>. Jul 10, 2025 RAGG2(1)

---