R_EGG(3)

💖 NAME 💖

r_egg — the radare2 egg shellcode generation library. yes bestie, that's really what it's called. 🥚✨

---

✨ SYNOPSIS ✨

#include <r_egg.h>

---

🦋 DESCRIPTION 🦋

okay so the r_egg library gives radare2 the power to generate shellcode, which is genuinely iconic. you write shellcode in a high-level language, and it compiles that down to machine code. it supports multiple architectures and hands you a whole framework for creating, compiling, and executing shellcode. main character energy fr fr. 💅

the core structure is REgg, and it's the one holding everything together: source code, compiled binary, assembler, syscall information, and language parsing. she does it all. 👑

---

🌱 INITIALIZATION 🌱

this section is all about creating, initializing and freeing an REgg context, plus the little helpers that (re)configure the embedded language parser and the state used while compiling. setup era. 🎀

• REgg *r_egg_new(void) — creates a brand new egg context with default settings. fresh out the box. ✨
• void r_egg_free(REgg *egg) — frees all the resources tied to the egg context. everything. gone. 🫶
• void r_egg_reset(REgg *egg) — resets the egg context state so you can reuse it for a whole new compilation. recycling queen. 🌈
• char *r_egg_tostring(REgg *egg) — returns a textual representation of the egg internal state (for debugging). iykyk. 🔍
• void r_egg_lang_init(REgg *egg) — initializes the embedded language parser state (egg->lang).
• void r_egg_lang_free(REgg *egg) — frees the resources that the embedded language parser allocated.
• bool r_egg_setup(REgg *egg, const char *arch, int bits, int endian, const char *os) — configures the egg context for the architecture, bitness, endianness and operating system you picked. arch, bits, endian, os — all four, no skipping. 💫

---

📥 LOADING CODE 📥

these are the functions that load egg source from strings or files, append fragments, and manage include paths plus ancillary source used during compilation. feeding the egg. 🍓

• void r_egg_load(REgg *egg, const char *code, int format) — loads source code into the egg context. format tells it the input style (egg/c).
• void r_egg_append(REgg *egg, const char *src) — appends extra source code onto the egg context. more is more. 💅

---

🔨 COMPILATION 🔨

ngl, compilation is generally a two-step process: first you parse/compile the egg language into an intermediate representation, then you assemble that IR into machine code. this section lists helpers for both stages, plus utilities to grab assembly listings so you can inspect them. 🧚

• bool r_egg_compile(REgg *egg) — compiles the loaded source code into intermediate representation.
• bool r_egg_assemble(REgg *egg) — assembles the compiled code into machine code. the glow-up stage. 🔥
• bool r_egg_assemble_asm(REgg *egg, char **asm_list) — assembles the code and hands you the assembly listing in asm_list.

---

🏃 EXECUTION 🏃

functions that run the generated shellcode, either directly or through a ROP execution helper. frontends use these to invoke or emulate the generated payload. go bestie go!! 🚀

• int r_egg_run(REgg *egg) — executes the compiled shellcode.
• int r_egg_run_rop(REgg *egg) — executes the shellcode using ROP (Return-Oriented Programming) techniques. fancy. 💅

---

📤 OUTPUT 📤

functions to access the compilation results: the raw binary buffer, the original source text, and the emitted assembly listing. frontends love these for printing, saving or further processing the artifacts. 📦

• RBuffer *r_egg_get_bin(REgg *egg) — returns the compiled binary code as a buffer.
• char *r_egg_get_source(REgg *egg) — returns the source code.
• char *r_egg_get_assembly(REgg *egg) — returns the assembly representation of the compiled code.

---

🕯️ SYSCALLS 🕯️

helpers to insert syscall invocations and manage the syscall-related language state — argument marshaling, syscall table entries and emitted code. all of it. 🫶

• void r_egg_syscall(REgg *egg, const char *arg, ...) — adds a syscall instruction to the shellcode. it's a variadic, so bring your args. ✨

---

🧠 MEMORY MANAGEMENT 🧠

functions to reserve and manipulate the data your generated code uses: allocate space, place strings, and manage small data patches emitted into the output buffer. 🎀

• void r_egg_alloc(REgg *egg, int n) — allocates memory in the shellcode.

---

🚦 CONTROL FLOW 🚦

labeling, branching and conditional helpers that the egg language uses to implement control flow — labels, if/while blocks, and simple arithmetic operations. the plot structure of your shellcode. 📖

• void r_egg_label(REgg *egg, const char *name) — defines a label in the shellcode.
• void r_egg_if(REgg *egg, const char *reg, char cmp, int v) — adds a conditional statement.

---

🧱 RAW CODE 🧱

low-level helpers to shove raw bytes or preassembled snippets directly into the output buffer — for when the high-level language can't express a pattern, or when hand-crafted machine code is the vibe. 💀

• bool r_egg_raw(REgg *egg, const ut8 *b, int len) — inserts raw binary code into the shellcode.

---

🎭 ENCODING 🎭

encoder and shellcode-template helpers. encoders transform the produced binary (for obfuscation or packing), while shellcode templates provide parameterizable payloads and generators that frontends can pick from. choose your fighter. ⭐

• bool r_egg_encode(REgg *egg, const char *name) — applies an encoder to the shellcode.
• bool r_egg_shellcode(REgg *egg, const char *name) — generates shellcode using a specific shellcode template.

---

🩹 PATCHING 🩹

binary patching helpers to apply small modifications to the compiled output — bytes, words, qwords. the CLI uses these to apply user-specified patches before finalizing output. little touch-ups. 💅

• bool r_egg_patch(REgg *egg, int off, const ut8 *b, int l) — patches the compiled binary at the specified offset. use -1 for append. 📌

---

🔌 PLUGINS 🔌

the plugin framework that extends r_egg with shellcode generators and encoders. hosts discover and register plugin implementations, which then get invoked during the compilation or encoding phases. plug her in. 🌸

• bool r_egg_plugin_add(REgg *a, REggPlugin *plugin) — adds an egg plugin (encoder or shellcode generator).
• bool r_egg_plugin_remove(REgg *a, REggPlugin *plugin) — removes an egg plugin.

---

⚙️ OPTIONS ⚙️

key/value configuration that controls compilation and encoding behavior — the selected encoder, padding, the chosen shellcode template, and auxiliary keys used by plugins. the settings menu, basically. 🎛️

• void r_egg_option_set(REgg *egg, const char *k, const char *v) — sets an option for the egg context.
• char *r_egg_option_get(REgg *egg, const char *k) — gets an option value from the egg context.

---

📎 INCLUDES 📎

include helpers that load files or strings (like C headers or inline code) referenced by egg source. also holds the helpers that manage the include search paths the preprocessor uses. 🧚

• bool r_egg_include(REgg *egg, const char *file, int format) — includes a file in the egg compilation.
• bool r_egg_include_str(REgg *egg, const char *arg) — includes a string in the egg compilation.
• void r_egg_lang_include_path(REgg *egg, const char *path) — adds an include path used by the egg preprocessor.
• void r_egg_lang_include_init(REgg *egg) — initializes include-related state (called at setup time by hosts).

---

🎬 FINALIZATION 🎬

finalizers and convenience helpers you call after compilation to finish transformations, apply padding/encoders, and release temporary resources. the closing credits. 🫶

• void r_egg_finalize(REgg *egg) — finalizes the egg compilation process.
• void r_egg_printf(REgg *egg, const char *fmt, ...) — printf-style helper that appends formatted text to the current egg output (used by emitters/plugins during code generation).
• void r_egg_option_set(REgg *egg, const char *k, const char *v) — helper noted above; kept here to emphasize lifecycle usage by frontends.

---

🧪 EXAMPLES 🧪

basic shellcode generation:

REgg *egg = r_egg_new();
r_egg_setup(egg, "x86", 32, 0, "linux");
r_egg_load(egg, "write(1,
r_egg_compile(egg);
r_egg_assemble(egg);
RBuffer *bin = r_egg_get_bin(egg);

using syscalls:

r_egg_syscall(egg, "exit", 0);

adding raw code:

ut8 code[] = {0x90, 0x90}; // NOP NOP
r_egg_raw(egg, code, 2);

---

👀 SEE ALSO 👀

r_asm(3), r_syscall(3)

---

and that's the whole page, bestie!! this one came from Debian, dated September 20, 2025, and it lives in the manual as R_EGG(3). go write some shellcode, you absolute legend 💖✨🦋🎀💅👑