RZ-RUN(1)

💖 RZ-RUN(1) 💖

okay bestie, gather round, because this is the rz-run manual page from section 1 of the manual, and it's literally the little launcher goblin that makes your programs run in whatever weird lil environment you dream up. it's giving "personal assistant for processes" and honestly? iconic. ✨

---

✨ NAME ✨

rz-run — rizin utility to run programs in custom environments 🎀

---

🌸 SYNOPSIS 🌸

rz-run [[directives]] [[script.rz]] [[--] [program] [args]]

---

💅 DESCRIPTION 💅

okay so first thing you need to know: this command is part of the Rizin project. 🫶

This program is used as a launcher for running programs with different environment, arguments, permissions, directories and overridden default filedescriptors. no cap, that's the whole job description.

• -l — List all the supported profile options. window shopping, but for profiles 🛍️
• -t — Output a base template profile. Try rz-run -d > profile.rz — it's a starter pack, we love a template 👑
• -w — Show the terminal name and wait for a connection from another process. Try rz-run stdio=<ttypath> program=/bin/sh — it just sits there, patiently waiting for its bestie to show up 🦋

The program just accepts a single argument which is the filename of the configuration file to run the program. one arg. that's it. minimalism, periodt.

It is useful when you have to run a program using long arguments or pass long data to stdin or things like that usually required for exploiting crackmes :) — yes bestie, this is the crackme exploitation support group and you're welcome here 💀

---

🌈 DIRECTIVES 🌈

The rrz (rz-run) configuration file accepts the following directives, described as key=value entries and comments defined as lines starting with #. so basically it's a vibe file and every line is a little instruction. slay.

• arg[0-511] — Set value for argument N passed to the program 🍓
• aslr — Enable or disable ASLR
• bits — Set 32 or 64 bit (if the architecture supports it)
• chdir — Change directory before executing the program
• chroot — Run the program in chroot. requires some previous setup ⚠️ (it needs the whole setup done first, don't skip ahead bestie)
• core — Set no limit the core file size
• connect — Connect stdin/stdout/stderr to a socket
• pty — Use a pty for connection over socket (with connect/listen)
• envfile — Set a file with lines like var=value to be used as env
• fork — Used with the listen option, allow to spawn a different process for each connection. Ignored when debugging.
• input — Set string to be passed to the program via stdin
• libpath — Override path where the dynamic loader will look for shared libraries
• listen — Bound stdin/stdout/stderr to a listening socket
• maxstack — Set the maximum size for the stack
• maxproc — Set the maximum number of processes
• maxfd — Set the maximum number of file descriptors
• nice — Set the niceness level of the process (be nice! or don't, that's the setting 💅)
• preload — Preload a library (not supported on Windows, only linux,osx,bsd)
• daemon — Set to false by default, otherwise it will run the program in background, detached from the terminal. main character energy, leaving the terminal behind 🚪
• program — Path to program to be executed
• pid — Set to true to print the PID of the process to stderr
• pidfile — Print the PID of the process to the specified file
• runlib — Path to the library to be executed
• runlib.fcn — Function name to call from runlib library
• rzpreload — Preload with librz, kill -USR1 to get an rizin shell or -USRZ to spawn a webserver in a thread
• setenv — Set value for given environment variable
• setegid — Set effective process group id
• seteuid — Set effective process uid
• setgid — Set process group id
• setuid — Set process uid
• sleep — Sleep for the given amount of seconds 😴
• stdio=value — Set io streams (stdin, stdout, stderr) to a value
• stdio=!cmd — Redirect input/output to the process created by the specified command
• stdin — Set stdin, stdout, and stderr streams to the specified value
• stdout — Select file to replace stdout file descriptor
• stderr — Select file to replace stderr file descriptor
• system — Execute the given command
• timeout — Set a timeout ⏰
• timeoutsig — Signal to use when killing the child because the timeout happens
• unsetenv — Unset one environment variable

---

🧚 VALUE PREFIXES 🧚

Every value in this configuration file can contain a special prefix, and these are the little magic spells you can put in front of a value. iykyk ✨

• @filename — Slurp contents of file and put them inside the key
• text — Escape characters useful for hex chars
• 'string' — Escape characters useful for hex chars
• !cmd — Run command to store the output in the variable
• :102030 — Parse hexpair string and store it in the variable
• :!cmd — Parse hexpair string from output of command and store it in the variable
• %1234 — Parses the input string and returns it as integer

---

🔥 EXAMPLES 🔥

Sample rz-run script 🎀

$ cat foo.rrz
#!/usr/bin/rz-run
program=./pp400
arg0=10
stdin=foo.txt
chdir=/tmp
clearenv=true
setenv=EGG=eggsy
setenv=NOFUN=nogames
unsetenv=NOFUN
# EGG will be the only env variable
#chroot=.
./foo.rrz

Connecting a program to a socket 🌐

nc -l 9999

rz-run program=/bin/ls connect=localhost:9999

Debugging a program redirecting io to another terminal 🖥️

## open a new terminal and type 'tty' to get
$ tty ; clear ; sleep 999999
/dev/ttyS010
## in another terminal run rizin
$ rizin -r foo.rrz -d ls
$ cat foo.rrz
#!/usr/bin/rz-run
stdio=/dev/ttys010
## Or you can use -R to set a key=value
rizin -R stdio=/dev/ttys010 -d ls

You can also use the -- flag to specify program and arguments in a more natural way:

rz-run timeout=2 -- sleep 4

Run a library function 🧠

rz-run runlib=/lib/libc-2.25.so runlib.fcn=system arg1="ls /"

---

👑 SEE ALSO 👑

rizin(1), rz-hash(1), rz-find(1), rz-bin(1), rz-diff(1), rz-gg(1), rz-asm(1),

go read the whole friend group, they're all icons 💜

---

💖 AUTHORS 💖

pancake <pancake@nopcode.org>

byteninjaa0

---

and that's the whole page bestie!! this was the rz-run page from the Rizin project, dated Jan 24, 2024, and yes it really is called RZ_RUN(1) down at the bottom. no notes. slay. 💅✨🌸