.Dd Jul 10, 2025
.Dt RAGG2 1
.Sh NAME
.Nm ragg2
.Nd Radare2 Frontend for r_egg; Compiles Programs into Tiny Binaries for x86 and ARM Architectures
.Sh SYNOPSIS
.Nm ragg2
.Op Fl FOLsrxhvz
.Op Fl a Ar arch
.Op Fl b Ar bits
.Op Fl k Ar os
.Op Fl o Ar file
.Op Fl i Ar sc
.Op Fl I Ar path
.Op Fl E Ar enc
.Op Fl B Ar hex
.Op Fl c Ar k=v
.Op Fl C Ar file
.Op Fl p Ar pad
.Op Fl q Ar off
.Op Fl S Ar string
.Op Fl f Ar fmt
.Op Fl nN Ar dword
.Op Fl dDw Ar off:hex
.Op Fl e Ar expr
.Sh DESCRIPTION
Frontend for r_egg, compiling assembly programs into minimal binaries for x86-32, x86-64, and ARM architectures.
.Pp
Built on top of r_asm and r_bin, it provides a library for generating small standalone binaries across supported platforms.
.Pp
Programs generated by r_egg are relocatable and can be injected in a running process or on-disk binary file.
.Pp
ragg2 can generate shellcodes from C code. The final code can be linked with rabin2 and it is relocatable, so it can be used to inject it on any remote process.
.Sh OPTIONS
.Bl -tag -width Fl
.It Fl a Ar arch
Select architecture (x86, mips, arm)
.It Fl b Ar bits
Register size (32, 64, ..)
.It Fl B Ar hexpairs
Append some hexpair bytes
.It Fl c Ar k=v
Set configuration options
.It Fl C Ar file
Append contents of file
.It Fl d Ar off:dword
Patch dword (4 bytes) at given offset
.It Fl D Ar off:qword
Patch qword (8 bytes) at given offset
.It Fl e Ar egg-expr
Take egg program from string instead of file
.It Fl E Ar encoder
Use specific encoder. See -L
.It Fl f Ar format
Output format (raw, c, pe, elf, mach0, python, javascript)
.It Fl F
Output native format (osx=mach0, linux=elf, ..)
.It Fl h
Show usage help message
.It Fl H Ar var
Display variable
.It Fl i Ar shellcode
Include shellcode plugin, uses options. See -L
.It Fl I Ar path
Add include path
.It Fl k Ar os
Operating system's kernel (linux,bsd,osx,w32)
.It Fl L
List all plugins (shellcodes and encoders)
.It Fl n Ar dword
Append 32bit number (4 bytes)
.It Fl N Ar dword
Append 64bit number (8 bytes)
.It Fl o Ar file
Output file
.It Fl O
Use default output file (filename without extension or a.out)
.It Fl p Ar padding
Add padding after compilation (padding=n10s32)
ntas : begin nop, trap, 'a', sequence
NTAS : same as above, but at the end
.It Fl P Ar size
Prepend debruijn pattern
.It Fl q Ar fragment
Debruijn pattern offset
.It Fl r
Show raw bytes instead of hexpairs
.It Fl s
Show assembler
.It Fl S Ar string
Append a string
.It Fl v
Show version information
.It Fl w Ar off:hex
Patch hexpairs at given offset
.It Fl x
Execute
.It Fl X Ar hexpairs
Execute rop chain, using the stack provided
.It Fl z
Output in C string syntax
.El
.Sh ENVIRONMENT
.Pp
.Bl -tag -width Fl
.It Ev R2_NOPLUGINS
Do not load any plugin
.It Ev R2_PLUGINS_ORDER
Plugin load order: i=internal, e=env, h=home, s=system; default=iehs; ? prints help
.El
.Sh EXAMPLES
.Pp
Using r_egg language:
.Pp
  $ cat hi.r
  /* hello world in r_egg */
  write@syscall(4); //x64 write@syscall(1);
  exit@syscall(1); //x64 exit@syscall(60);
  main@global(128) {
    .var0 = "hi!\\n";
    write(1,.var0, 4);
    exit(0);
  }
  $ ragg2 -O -F hi.r
  $ ./hi
  hi!
.Pp
Using C language:
.Pp
  $ cat hi.c
  main() {
    write(1, "Hello\\n", 6);
    exit(0);
  }
  $ ragg2 -O -F hi.c
  $ ./hi
  Hello
.Pp
Tiny binary output:
.Pp
  $ wc -c < hi
    165
.Pp
Compiled shellcode with zeroes:
.Pp
  $ ragg2 hi.c | tail -1
  eb0748656c6c6f0a00bf01000000488d35edffffffba06000000b8010
  000000f0531ffb83c0000000f0531c0c3
.Pp
Using XOR encoder with key 64:
.Pp
  $ ragg2 -e xor -c key=64 -B $(ragg2 hi.c | tail -1)
  6a2d596a405be8ffffffffc15e4883c60d301e48ffc6e2f9ab4708252
  c2c2f4a40ff4140404008cd75adbfbfbffa46404040f8414040404f45
  71bff87c4040404f45718083
.Sh SEE ALSO
.Pp
.Xr radare2(1)
.Sh AUTHORS
.Pp
Written by pancake <pancake@nopcode.org>.