RZ-GG(1)

💖 RZ-GG(1) 💖

okay bestie, gather round, because rz-gg is the Rizin frontend for RzEgg, and its whole thing is compiling programs into teeny tiny binaries for alllll the different architectures. like, it's giving "main character who makes shellcode" energy. 🦋

---

✨ SYNOPSIS ✨

rz-gg [-FOLsrxvhz] [-a arch] [-b bits] [-k os] [-f format] [-o file]
      [-i shellcode] [-I path] [-e encoder] [-B hexpairs] [-c k=v]
      [-C file] [-n dword] [-N dword] [-d off:dword] [-D off:qword]
      [-w off:hexpairs] [-p padding] [-P size] [-q fragment]
      file|f.asm|-

like yes she takes a file, or a f.asm, or a - for stdin, and then a whole little village of flags. we love a flexible queen. 💅

---

🌸 DESCRIPTION 🌸

so first thing: this command is part of the Rizin project. family business. 🫶

Programs generated by RzEgg are relocatable, which is the fancy way of saying you can yeet them into a running process or into an on-disk binary file. no cap, that's the whole vibe.

and THEN — since the rz-gg-cc merge — rz-gg can now generate shellcodes from C code. 😭 iconic. the final code can be linked with rz-bin, and it is relocatable, allowing injection into any remote process. this feature is conceptually based on shellforge4, but (and this is important bestie) it only supports Linux/OSX x86-32/64 platforms. so don't come for her about your weird platform, she said what she said.

---

🎀 DIRECTIVES 🎀

The rrz (rz-gg) configuration file accepts the following directives, described as key=value entries, and comments which are defined as lines starting with #. (yes, # is the comment girly. she's mysterious. she's above it all.)

• -a arch — Select architecture (x86, mips, arm). pick your fighter ✨
• -b bits — Set register size (32, 64, ..).
• -B hexpairs — Append hexpair bytes. just tacking them on the end, no thoughts, head empty.
• -c k=v — Set configure option for the shellcode encoder. The argument must be key=value — she's not flexible on this one, bestie, it's literally the whole format.
• -C file — Append contents of file.
• -d off:dword — Patch dword (4 bytes) at given offset.
• -D off:qword — Patch qword (8 bytes) at given offset.
• -e encoder — Use specific encoder. See -L. 👀
• -f format — Output format (raw, c, pe, elf, mach0, python, javascript). so many aesthetics to choose from.
• -F — Output native format (osx=mach0, linux=elf, ..). she'll match the local vibe automatically, queen behavior.
• -h — Show usage help message. when in doubt, ask her.
• -i shellcode — Include shellcode plugin, use options. See -L.
• -I path — Add include path.
• -k kernel — Operating system's kernel (linux, bsd, osx, w32).
• -L — List all plugins (shellcodes and encoders). the full menu, the whole buffet 🍓
• -n num32 — Append 32bit number (4 bytes).
• -N num64 — Append 64bit number (8 bytes).
• -o file — Output file to write result of compilation.
• -O — Use default output file (filename without extension or a.out). chaotic but she's got a system.
• -p padding — Add padding after compilation (padding=n10s32)
  • ntas : begin nop, trap, 'a', sequence
  • NTAS : same as above, but at the end
• -P size — Prepend debruijn sequence of given length.
• -q fragment — Debruijn pattern offset.
• -r — Show raw bytes instead of hexpairs.
• -s — Show assembler.
• -S string — Append a string.
• -v — Show version information.
• -w off:hex — Patch hexpairs at given offset.
• -x — Execute. yes ma'am, run it, no fear 💀
• -X hexpairs — Execute rop chain, using the stack provided.
• -z — Output in C string syntax.

---

🔥 EXAMPLE 🔥

so this is the part where she actually eats. watch. 👑

$ cat hi.r
/* hello world in RzEgg */
write@syscall(4); //x64 write@syscall(1);
exit@syscall(1); //x64 exit@syscall(60);

main@global(128) {
  .var0 = "hi!\n";
  write(1,.var0, 4);
  exit(0);
}
$ rz-gg -O -F hi.r
$ ./hi
hi!

# With C file :
$ cat hi.c
main() {
  write(1, "Hello\n", 6);
  exit(0);
}
$ rz-gg -O -F hi.c

$ ./hi
Hello

# Linked into a tiny binary. This is 165 bytes
$ wc -c < hi
  165

# The compiled shellcode has zeroes
$ rz-gg hi.c | tail -1
eb0748656c6c6f0a00bf01000000488d35edffffffba06000000b8010
000000f0531ffb83c0000000f0531c0c3

# Use a xor encoder with key 64 to bypass
$ rz-gg -e xor -c key=64 -B $(rz-gg hi.c | tail -1)
6a2d596a405be8ffffffffc15e4883c60d301e48ffc6e2f9ab4708252
c2c2c2f4a40ff4140404008cd75adbfbfbffa46404040f8414040404f45
71bff87c4040404f45718083

side note bestie: notice the shellcode has zeroes (that's the comment up there, it's a whole plot point), and the xor encoder with key=64 is the glow-up that bypasses them. -c key=64 and -B with the hexpairs from rz-gg hi.c | tail -1. that's the whole trick. iykyk. 💖

---

🌈 SEE ALSO 🌈

rizin(1), rz-hash(1), rz-find(1), rz-bin(1), rz-find(1), rz-diff(1), rz-asm(1),

(yes, rz-find(1) is listed twice. no, we are not editing the guest list. she said what she said. 🙈)

---

👑 AUTHORS 👑

• pancake <pancake@nopcode.org>
• byteninjaa0

---

and that's the whole page, bestie!! ✨ this version is from the manual RZ_GG(1), dated Jan 24, 2024. mwah, go compile something tiny and iconic. 🎀💅🦋💜