NAME¶

rarun2 — radare2 utility to run programs in exotic environments

SYNOPSIS¶

DESCRIPTION¶

A launcher for executing programs with custom environments, arguments, permissions, working directories, and redirected file descriptors.

Supports inline directive arguments, script files, or program specifications after the '--' separator.

Ideal for simplifying complex command lines, preparing specialized environments, and automating testing or exploitation scenarios.

OPTIONS¶

-v

Show version

-t

Show terminal name

--

Use remaining arguments as program and program arguments

DIRECTIVES¶

The rr2 (rarun2) configuration file accepts the following directives, described as key=value entries and comments defined as lines starting with '#'.

program=

Path to program to be executed

arg0=..argN=

Set values for arguments passed to the program

aslr=

Enable or disable ASLR (yes|no)

bits=

Set 32 or 64 bit (if the architecture supports it)

chdir=

Change directory before executing the program

chroot=

Run the program in chroot (requires some previous setup)

clearenv=

Unset the whole environment (true|false)

connect=

Connect stdin/stdout/stderr to a socket (host:port)

core=

Set no limit to the core file size (true|false)

daemon=

Run in background, detached from terminal (default: false)

envfile=

Set a file with lines like 'var=value' to be used as env

execve=

Use execve instead of posix_spawn (osx tricks)

fork=

Allow spawning different process for each connection with 'listen'

input=

Set string to be passed to the program via stdin

libpath=

Override path where the dynamic loader looks for shared libraries

listen=

Bind stdin/stdout/stderr to a listening socket (port)

maxfd=

Set the maximum number of file descriptors

maxproc=

Set the maximum number of processes

maxstack=

Set the maximum size for the stack

nice=

Set the niceness level of the process

pid=

Set process pid

pidfile=

Write pid to a file

preload=

Preload a library (not supported on Windows, only linux,osx,bsd)

pty=

Use a pty for connection over socket (true|false)

r2preload=

Preload with libr2, kill -USR1 for r2 shell, -USR2 for webserver

r2preweb=

Run webserver in a thread at start with r2preload

runlib=

Path to the library to be executed

runlib.fcn=

Function name to call from runlib library

setegid=

Set effective process group id

seteuid=

Set effective process uid

setenv=

Set value for given environment variable (NAME=VALUE)

setgid=

Set process group id

setuid=

Set process uid

sleep=

Sleep for the given amount of seconds before execution

stderrout=

Redirect stderr file descriptor to stdout (true|false)

stdio=

Select file or terminal for stdout/stderr/stdin

stdin=

Select file to read data from stdin

stdout=

Select file to replace stdout file descriptor

stderr=

Select file to replace stderr file descriptor

system=

Execute the given command

timeout=

Set a timeout in seconds

timeoutsig=

Signal to use when killing child on timeout (SIGTERM)

times=

Print runtime in milliseconds to stderr (true|false)

unsetenv=

Unset one environment variable

VALUE PREFIXES¶

Every value in this configuration file can contain a special prefix:

@filename

Slurp contents of file and put them inside the key

text

Escape characters useful for hex chars

'string'

Escape characters useful for hex chars

!cmd

Run command to store the output in the variable

:102030

Parse hexpair string and store it in the variable

:!cmd

Parse hexpair string from output of command and store it in the variable

%1234

Parses the input string and returns it as integer

@300@ABCD

300 characters filled with ABCD pattern

ENVIRONMENT¶

RARUN2_ARGS

Useful to run "rarun2" but parse arguments from environment var

EXAMPLES¶

Sample rarun2 script:

$ cat foo.rr2
#!/usr/bin/rarun2
program=./pp400
arg0=10
stdin=foo.txt
chdir=/tmp
clearenv=true
setenv=EGG=eggsy
setenv=NOFUN=nogames
unsetenv=NOFUN
# EGG will be the only env variable
#chroot=.
$ ./foo.rr2

Connecting a program to a socket:

$ nc -l 9999
$ rarun2 program=/bin/ls connect=localhost:9999

Debugging a program redirecting IO to another terminal:

## open a new terminal and type 'tty' to get
$ tty ; clear ; sleep 999999
/dev/ttyS010
## in another terminal run r2
$ r2 -r foo.rr2 -d ls
$ cat foo.rr2
#!/usr/bin/rarun2
stdio=/dev/ttys010
## Or you can use -R to set a key=value
r2 -R stdio=/dev/ttys010 -d ls

You can also use the -- flag to specify program and arguments:

$ rarun2 timeout=2 -- sleep 4

Run a library function:

$ rarun2 runlib=/lib/libc-2.25.so runlib.fcn=system arg1="ls /"

SEE ALSO¶

radare2(1)

AUTHORS¶

Written by pancake <pancake@nopcode.org>