# ragg2
ragg2 -P 300 -r : generate a De Bruijn Pattern of 300 chars
ragg2 -a x86 -b 32 -i exec -z : generate a x86, 32 bits exec shellcode

# rarun2
r2 -b 32 -d rarun2 program=pwn1 arg1=$(ragg2 -P 300 -r) : runs pwn1 with a De Bruijn Pattern as first argument, inside radare2's debugger, and force 32 bits
r2 -d rarun2 program=/bin/ls stdin=$(python exploit.py) : runs /bin/ls with the output of exploit.py directed to stdin

# radiff2
radiff2 -a x86 -b32 -C original patched : diff original and patched on x86_32, using graphdiff algorithm
radiff2 -a x86 -b32 original patched : show differences between original and patched on x86_32

# r2
## Analysis
aa : analyse all
afl : list all functions
is : show symbols
## Debugger
dr : show registers
dc : continue
dcu symbol : continue until symbol
dm : display map
## Print
pxw 8 @ sym.main : print hexdump grouped as word, on 8 bytes at offset sym.main
pdf @ sym.main : print the disassembly of the sym.main function
## Mitigations
i~pic : check if the binary has position-independent-code
i~nx : check if the binary has non-executable stack
i~canary : check if the binary has canaries
## Misc
/ pouet\x00 : search for the zero-terminated string "pouet"
woO 41424344 : get the index in the De Bruijn Pattern of the given word
/Rl jmp eax,call ebx : find ROP gadgets that match *;jmp eax;*;call ebx*;*

