rarun2 - radare2 utility to run programs in exotic environments
NAME
rarun2 — radare2 utility to run programs in exotic environments
SYNOPSIS
rarun2 [−vt] [directives ...] [script.rr2] [Fl- program args ...]
DESCRIPTION
A launcher for executing programs with custom environments, arguments, permissions, working directories, and redirected file descriptors.
Supports inline directive arguments, script files, or program specifications after the ’--’ separator.
Ideal for simplifying complex command lines, preparing specialized environments, and automating testing or exploitation scenarios.
OPTIONS
−v
Show version
−t
Show terminal name
−−
Use remaining arguments as program and program arguments
DIRECTIVES
The rr2 (rarun2) configuration file accepts the following directives, described as key=value entries and comments defined as lines starting with ’#’.
program=
Path to program to be executed
arg0=..argN=
Set values for arguments passed to the program
aslr=
Enable or disable ASLR (yes|no)
bits=
Set 32 or 64 bit (if the architecture supports it)
chdir=
Change directory before executing the program
chroot=
Run the program in chroot (requires some previous setup)
clearenv=
Unset the whole environment (true|false)
connect=
Connect stdin/stdout/stderr to a socket (host:port)
core=
Set no limit to the core file size (true|false)
daemon=
Run in background, detached from terminal (default: false)
envfile=
Set a file with lines like ’var=value’ to be used as env
execve=
Use execve instead of posix_spawn (osx tricks)
fork=
Allow spawning different process for each connection with ’listen’
input=
Set string to be passed to the program via stdin
libpath=
Override path where the dynamic loader looks for shared libraries
listen=
Bind stdin/stdout/stderr to a listening socket (port)
maxfd=
Set the maximum number of file descriptors
maxproc=
Set the maximum number of processes
maxstack=
Set the maximum size for the stack
nice=
Set the niceness level of the process
pid=
Set process pid
pidfile=
Write pid to a file
preload=
Preload a library (not supported on Windows, only linux,osx,bsd)
pty=
Use a pty for connection over socket (true|false)
r2preload=
Preload with libr2, kill -USR1 for r2 shell, -USR2 for webserver
r2preweb=
Run webserver in a thread at start with r2preload
runlib=
Path to the library to be executed
runlib.fcn=
Function name to call from runlib library
setegid=
Set effective process group id
seteuid=
Set effective process uid
setenv=
Set value for given environment variable (NAME=VALUE)
setgid=
Set process group id
setuid=
Set process uid
sleep=
Sleep for the given amount of seconds before execution
stderrout=
Redirect stderr file descriptor to stdout (true|false)
stdio=
Select file or terminal for stdout/stderr/stdin
stdin=
Select file to read data from stdin
stdout=
Select file to replace stdout file descriptor
stderr=
Select file to replace stderr file descriptor
system=
Execute the given command
timeout=
Set a timeout in seconds
timeoutsig=
Signal to use when killing child on timeout (SIGTERM)
times=
Print runtime in milliseconds to stderr (true|false)
unsetenv=
Unset one environment variable
VALUE PREFIXES
Every value in this configuration file can contain a special prefix:
@filename
Slurp contents of file and put them inside the key
text
Escape characters useful for hex chars
’string’
Escape characters useful for hex chars
!cmd
Run command to store the output in the variable
:102030
Parse hexpair string and store it in the variable
:!cmd
Parse hexpair string from output of command and store it in the variable
%1234
Parses the input string and returns it as integer
@300@ABCD
300 characters filled with ABCD pattern
ENVIRONMENT
RARUN2_ARGS
Useful to run "rarun2" but parse arguments from environment var
EXAMPLES
Sample rarun2 script:
$ cat foo.rr2
#!/usr/bin/rarun2
program=./pp400
arg0=10
stdin=foo.txt
chdir=/tmp
clearenv=true
setenv=EGG=eggsy
setenv=NOFUN=nogames
unsetenv=NOFUN
# EGG will be the only env variable
#chroot=.
$ ./foo.rr2
Connecting a program to a socket:
$ nc -l 9999
$ rarun2 program=/bin/ls connect=localhost:9999
Debugging a program redirecting IO to another terminal:
## open a new
terminal and type ’tty’ to get
$ tty ; clear ; sleep 999999
/dev/ttyS010
## in another terminal run r2
$ r2 -r foo.rr2 -d ls
$ cat foo.rr2
#!/usr/bin/rarun2
stdio=/dev/ttys010
## Or you can use -R to set a key=value
r2 -R stdio=/dev/ttys010 -d ls
You can also use the -- flag to specify program and arguments:
$ rarun2 timeout=2 -- sleep 4
Run a library function:
$ rarun2 runlib=/lib/libc-2.25.so runlib.fcn=system arg1="ls /"
SEE ALSO
radare2(1)
AUTHORS
Written by pancake <[email protected]> Jul 10, 2025 RARUN2(1)