153 lines
4.1 KiB
Groff
153 lines
4.1 KiB
Groff
.Dd Sep 30, 2014
|
|
.Dt RZ_GG 1
|
|
.Sh NAME
|
|
.Nm rz-gg
|
|
.Nd rizin frontend for r_egg, compile programs into tiny binaries for x86-32/64 and arm.
|
|
.Sh SYNOPSIS
|
|
.Nm rz-gg
|
|
.Op Fl a Ar arch
|
|
.Op Fl b Ar bits
|
|
.Op Fl k Ar kernel
|
|
.Op Fl f Ar format
|
|
.Op Fl o Ar file
|
|
.Op Fl i Ar shellcode
|
|
.Op Fl I Ar path
|
|
.Op Fl e Ar encoder
|
|
.Op Fl B Ar hexpairs
|
|
.Op Fl c Ar k=v
|
|
.Op Fl C Ar file
|
|
.Op Fl n Ar num32
|
|
.Op Fl N Ar num64
|
|
.Op Fl d Ar off:dword
|
|
.Op Fl D Ar off:qword
|
|
.Op Fl w Ar off:hexpair
|
|
.Op Fl p Ar padding
|
|
.Op Fl P Ar pattern
|
|
.Op Fl q Ar fragment
|
|
.Op Fl FOLsrxvhz
|
|
.Sh DESCRIPTION
|
|
rz-gg is a frontend for r_egg, compile programs into tiny binaries for x86-32/64 and arm.
|
|
.Pp
|
|
This tool is experimental and it is a rewrite of the old rarc2 and rarc2-tool programs as a library and integrated with r_asm and r_bin.
|
|
.Pp
|
|
Programs generated by r_egg are relocatable and can be injected in a running process or on-disk binary file.
|
|
.Pp
|
|
Since the rz-gg-cc merge, rz-gg can now generate shellcodes from C code. The final code can be linked with rz-bin and it is relocatable, so it can be used to inject it on any remote process. This feature is conceptually based on shellforge4, but only linux/osx x86-32/64 platforms are supported.
|
|
.Sh DIRECTIVES
|
|
.Pp
|
|
The rrz (rz-gg) configuration file accepts the following directives, described as key=value entries and comments defined as lines starting with '#'.
|
|
.Bl -tag -width Fl
|
|
.It Fl a Ar arch
|
|
set architecture x86, arm
|
|
.It Fl b Ar bits
|
|
32 or 64
|
|
.It Fl k Ar kernel
|
|
windows, linux or osx
|
|
.It Fl f Ar format
|
|
output format (raw, c, pe, elf, mach0, python, javascript)
|
|
.It Fl o Ar file
|
|
output file to write result of compilation
|
|
.It Fl i Ar shellcode
|
|
specify shellcode name to be used (see \-L)
|
|
.It Fl e Ar encoder
|
|
specify encoder name to be used (see \-L)
|
|
.It Fl B Ar hexpair
|
|
specify shellcode as hexpairs
|
|
.It Fl c Ar k=v
|
|
set configure option for the shellcode encoder. The argument must be key=value.
|
|
.It Fl C Ar file
|
|
include contents of file
|
|
.It Fl d Ar off:dword
|
|
Patch final buffer with given dword at specified offset
|
|
.It Fl D Ar off:qword
|
|
Patch final buffer with given qword at specified offset
|
|
.It Fl w Ar off:hexpairs
|
|
Patch final buffer with given hexpairs at specified offset
|
|
.It Fl n Ar num32
|
|
Append a 32bit number in little endian
|
|
.It Fl N Ar num64
|
|
Append a 64bit number in little endian
|
|
.It Fl p Ar padding
|
|
Specify generic paddings with a format string. Use lowercase letters to prefix, and uppercase to suffix, keychars are. 'n' for nop, 't' for trap, 'a' for sequence and 's' for zero.
|
|
.It Fl P Ar size
|
|
Prepend debruijn sequence of given length.
|
|
.It Fl q Ar fragment
|
|
Output offset of debruijn sequence fragment.
|
|
.It Fl F
|
|
autodetect native file format (osx=mach0, linux=elf, ..)
|
|
.It Fl O
|
|
use default output file (filename without extension or a.out)
|
|
.It Fl I Ar path
|
|
add include path
|
|
.It Fl s
|
|
show assembler code
|
|
.It Fl S
|
|
append a string
|
|
.It Fl r
|
|
show raw bytes instead of hexpairs
|
|
.It Fl x
|
|
execute (just-in-time)
|
|
.It Fl X
|
|
execute rop chain
|
|
.It Fl L
|
|
list all plugins (shellcodes and encoders)
|
|
.It Fl h
|
|
show this help
|
|
.It Fl z
|
|
output in C string syntax
|
|
.It Fl v
|
|
show version
|
|
.El
|
|
.Sh EXAMPLE
|
|
.Pp
|
|
$ cat hi.r
|
|
/* hello world in r_egg */
|
|
write@syscall(4); //x64 write@syscall(1);
|
|
exit@syscall(1); //x64 exit@syscall(60);
|
|
.Pp
|
|
main@global(128) {
|
|
.var0 = "hi!\\n";
|
|
write(1,.var0, 4);
|
|
exit(0);
|
|
}
|
|
$ rz-gg \-O \-F hi.r
|
|
$ ./hi
|
|
hi!
|
|
.Pp
|
|
# With C file :
|
|
$ cat hi.c
|
|
main() {
|
|
write(1, "Hello\\n", 6);
|
|
exit(0);
|
|
}
|
|
$ rz-gg -O -F hi.c
|
|
.Pp
|
|
$ ./hi
|
|
Hello
|
|
.Pp
|
|
# Linked into a tiny binary. This is 165 bytes
|
|
$ wc \-c < hi
|
|
165
|
|
.Pp
|
|
# The compiled shellcode has zeroes
|
|
$ rz-gg hi.c | tail -1
|
|
eb0748656c6c6f0a00bf01000000488d35edffffffba06000000b8010
|
|
000000f0531ffb83c0000000f0531c0c3
|
|
.Pp
|
|
# Use a xor encoder with key 64 to bypass
|
|
$ rz-gg \-e xor \-c key=64 \-B $(rz-gg hi.c | tail -1)
|
|
6a2d596a405be8ffffffffc15e4883c60d301e48ffc6e2f9ab4708252
|
|
c2c2f4a40ff4140404008cd75adbfbfbffa46404040f8414040404f45
|
|
71bff87c4040404f45718083
|
|
.Sh SEE ALSO
|
|
.Pp
|
|
.Xr rizin(1) ,
|
|
.Xr rz-hash(1) ,
|
|
.Xr rz-find(1) ,
|
|
.Xr rz-bin(1) ,
|
|
.Xr rz-find(1) ,
|
|
.Xr rz-diff(1) ,
|
|
.Xr rz-asm(1) ,
|
|
.Sh AUTHORS
|
|
.Pp
|
|
Written by pancake <pancake@nopcode.org>.
|