radareorg/radare2 6.2.0

on GitHub

Authors

AGhebrea Abhi Anton Bolshakov Claude Evgeny Kolmakov Hissssst MiKi Mohammed Hassan Mohammed Hassan OrbisAI Security ProMix Ricardo J. Rodríguez ada-l0velace arhwx dependabot[bot] gogolovefish neil nnguyen609 pancake pancake pancake phix33 phix33 potato ryawa

Changes

abi

• Pahole more structs to drop gaps and reduce struct size
• Make RCons authoritative for command help rendering
• Unify the struct and union member model into RAnalTypeMember
• Use BE bool flag (instead of int le) for utf16->utf8

anal

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Name the stack canary from a register write index instead of trace position
• Fix cc stack arg slot offsets and bound the argslot scans
• Fix the double return-address skip in the callargs stack walk
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Keep fail-only fallthrough edges in the function graph
• Fix arm64 =SN syscall register alias to follow asm.os
• Use stateful decoding in the /r, aea and aespc linear sweeps
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Unify struct and union field picking and simplify the const retype in aaft
• Propagate callee types into struct and union fields during aaft behind types.fields
• Add anal.gpseed to seed a PIC base register during ESIL analysis
• Use r_anal_block_successor_addrs_foreach to build the function graph
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument access patterns (afts)
• Better call clobbered register detection for arm64
• Honor calling convention clobbers in ESIL analysis
• Add r_anal_cc_isclobber API
• Emulate bbs in CFG order for the type matcher
• Add callconv for all archs (updates clobber and preserve info)
• Fix pdb/dwarf union parsing to fill the union member vec
• Add clobber and preserve register for ppc and arm callconv
• Dont pick ppc TOC pointers as function argument registers
• Mark variadic libc functions properly and fix caller arg over-recovery
• Restore arm32 AAPCS register args r0-r3 in calling convention

analysis

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument access patterns (afts)
• Better call clobbered register detection for arm64
• Honor calling convention clobbers in ESIL analysis
• Add r_anal_cc_isclobber API
• Emulate bbs in CFG order for the type matcher
• Add callconv for all archs (updates clobber and preserve info)
• Add clobber and preserve register for ppc and arm callconv
• Dont pick ppc TOC pointers as function argument registers
• Mark variadic libc functions properly and fix caller arg over-recovery
• Restore arm32 AAPCS register args r0-r3 in calling convention

api

• Use the formatted sdb setters
• Use the new formatted SDB getters -200LOC

arch

• Fix opcode decoding and endian selection in the ppc.gnu plugin
• Pseudo for ppc ctr branch
• Add the missing operand count to the PowerPC lfiwax pseudo rule
• Keep every operand in the mips and sparc pseudo fallbacks
• Widen the PowerPC word rotate masks to the full ISA MASK
• Simplify the cr0 and trap helpers in the PowerPC pseudo filter
• Decode hex trap conditions and the folded unconditional trap forms
• Fix the rldicr rotate mask being taken from the rldic rule
• Dispatch the PowerPC pseudo fixups by mnemonic instead of table position
• Keep every operand when no PowerPC pseudo rule matches
• Add the missing isel rule to the PowerPC pseudo table
• Fix PowerPC bclrl link register handling
• Support the capstone v6 PowerPC operand and branch predicate model
• Write LR on the linking conditional branch-to-ctr forms even when not taken
• Workaround ppc.cs UB bug causing random esil test fail (capstone followup)
• Fix x86 rip-relative ptr for zero-displacement destination operands
• Fix PPC mfspr/mtspr decoding, stwu/stdu stack detection and vle archinfo
• Type arm64 flag-setting adds/adcs/subs/ands/bics in ESIL analysis
• Remove capstone v3 support, capstone 4 is the minimum
• Fix the v35 plugin build and stop typing valid arm64 instructions as ILL
• Fix MIPS conditional branch-and-link (bgezal/bltzal) jump target
• Fix arm.gnu Thumb branch and svc/udf imms
• Gate PPC toc_map TOC with RArchOpMask.STATEFUL and wire it into aar
• Early error handling when arch is not initialized
• Fix PPC conditional lr/ctr branch aliases incorrectly decoded as jmp2zero
• Add RArchOpMask.STATEFUL and RArchSession.reset
• Invalidate the toc_map base register on PPC update-form loads and stores
• Invalidate the cached t9 call target on untracked writes and drop the mips.gnu decoder state
• Accept MIPS ISA CPU names

bin

• Fix signed underflow case for ppc elf imports
• Preserve PE section names when COFF strings are unavailable
• Strictier coff magic check
• Gate the ppc64 opd and glink logic by ELF ABI and fix the ELFv2 stub stride
• Fix out-of-bounds read on the SOM dynamic loader string table
• Fix uninitialized .NET stream sizes
• Pack bin vector element structs
• Better DEX header and string validation with less code
• Reject malformed DEX headers before string parsing
• Add v128, ref and reftype support for wasm
• Initial implementation of the rust v0 demangler
• Implement iuo command to open resoUrces inline
• The old iU is now under iu, same goes for rabin2 -u
• Move the rabin2 -u feature into an env var
• Some binfiles require custom resource retrievals
• Add raw resource extraction controls
• Add iU, table output and handle invalid subcommands
• Add support for encoded resources and extraction
• List demangler plugins as part of rbin
• Make RBin demanglers pluggable and selectable
• Handle macho resources on 64bit fat slices too
• Add support for GLib Resources inside ELF files
• Expose macho code signature and certificate as resources
• Add dir.binsdb (from binpath/dirprefix) for PE/MDMP ordinal lookups
• Parse and expose PE/CLR Resources
• Add OS/2 LE/LX resource support
• Add ix command for extract sections, segments and resources
• Rename iR to iU and add iUx extraction
• Implement resource extraction api wired to rabin2
• Fix leak and harden the Java parser to not parse too much garbage
• Better QNX header check
• List and extract QNX LMF resources
• Add resources support for the Pebble
• Expose PE resources from mdmp
• Extract resources with rabin2 -xU
• List resource metadata and paddr
• Deprecate the old sdb metadata for resources
• Preserve generated NE entry symbols (bin.unnamed=false)
• Honor 32bit NE absolute addressing for > 64k tables
• Reject invalid NE resource shifts
• Expose and harden NE binary resources
• Use the generic resource API for iR commands
• Expose PE resources through the generic API
• Add generic binary resource API
• Fix #23827 - oba not loading bin info from fat macho headers
• Add error if pdb7 root size negative or zero
• Fix PE version string parsing on big-endian hosts
• Utf16 strings in minidumps are always little endian
• Fix infinite loop in the NE fixup parser
• RBinPluginAny is now "null" for consistency and no longer uses LibMagic
• Decode PEF relocs lazily, add more bounds and overflow checks
• Fix AArch64 ELF relocation patching
• Stop parsing invalid PE import libraries
• Fix PE library import deduplication slowdown
• Fix warnings parsing zero-sized PE import directories
• Only do the right PE msvcseh checks for given arch/bits
• Fix bits in arm64 PE
• Name defined dynsym GOT slots in section-less ELFs
• Name global GOT slots to resolve relative GOT loads in mips.gp

build

• Add MiKNix platform support
• Fix #26312 - Compile against zydis 4.1 ... 5dev
• Improve jslinux build times, linking only the r2blob
• Add docker for dist/jslinux to compile on macOS
• Add dist/jslinux using temu/rv64
• Dont force x86.pseudo on single-arch-non-intel
• Build fixes for empty muta, egg, fs plugin lists
• Fixes for Windows XP
• Add libandroid-spawn to Termux package installation
• Select CS_ROOT after including config-user.mk so configure --with-capstone-next takes effect
• • Add android-sdk script for multiabi toolchain
• Fix #24090 - Android ARM64 static compilation
• Autodetect NDK from Android Studio in sys/android-*.sh
• Use an alternative windows ci action with newer deps
• Ignore the test_anal_types unit test binary
• Silence nullability extension warnings with GCC

ci

• Publish Android SDK in releases
• Specify ref to checkout testbins
• Dont build for filc in PRs

cons

• Use sorted RVec to store themes
• Update statically compiled color themes
• Detect terminal capabilities with COLORTERM
• Isolate new task command handlers with child consoles
• Isolate consoles and share console state in ctx cloning
• Fix edge cases of the sort comparator
• Make case-insensitive grep modifiers stage-local
• Fix chained grep range and column stage ordering
• Fixed multi-digit $:NN parsing
• Fix sort and uniq grep counts
• Fix ?. after filtered output
• XML formatting leaves a stale buffer capacity
• Expose cancel and failure states for RConsEditor
• Fix editor line-list ownership
• Remove global RConsEditor state
• Fix TAB help prompt redraw

core

• Route task output through parsed command contexts
• Keep task identity local to command execution
• Fix windows build (strset is declared in mingw and msvc string.h)
• Structure only natural loops in the pdc region AST
• Select core.pseudo in all plugin profiles that keep pdc
• Build a region AST for pdc with a pdct debug dump
• Move the pdc pseudo decompiler into a core plugin
• Fix #26245 - Handle waitpid failures in r_sys_cmd_str_full()
• Report invalid analysis subcommands

crash

• Memory exhaustion bug parsing malformed kernelcaches
• Fix #26390 - Bound HFS+ btree records and catalog names
• Fix #26390 - ASAN OOBR when namelen > 30 in hsfplus
• Fix #26374 - Stack oobread in print_insn_tic6x
• Fix oobread in ELF’s PN_XNUM
• Fix UAF in oc -;oc -
• Use dynamic base64 encoding in command callers
• Reject empty r2agent HTTP auth tokens
• Fix OOB reads in ropchain/pxb/ptb/px3 print commands
• Fix OOB reads in print commands and Apple cache parsers
• Fix OOB reads in dyldcache dep carving
• Fix #26343 - heap OF using _dyn variants in ?b64[-]
• Fix stack overflow, offbyone, UB and leaks in the visual mountpoint code
• Fix #26342 - stack overflow in tinycc include
• Fix pxd8 and pxu8 short-buffer reads
• Fix off-by-one in the http socket api
• Fix #26325 - NULL realname dereference in disasm flag comments
• Prevent pipe and redirect injection after escaped quotes
• Fix r2agent authentication fallthrough
• Fix 1 byte oobwrite bug in the gdbclient
• Fix heap over-read at buffer end when parsing gdb regs
• Fix oobwrite in gdb register bounds
• Fix OOM crash in the gdbserver xml register
• Fix stack exhaustion gdbserver in xi:include href=self.xml
• Fix oobread in vFile pread gdbserver responses
• Same oobread for the P register packet parsing
• Fix oobread in gdbserver p/P register handlers
• Fix oobread in gdbserver p/P register handlers
• Fix #26255 - heap overflow write in our gdb server
• Fix #26258 - punycode encoder oobread
• Refactor and harden LE/LX page decoding
• Harden LE/LX section and relocation parsing
• Validate uleb128 parsing in the DEX debug-local operands
• Fix #26240 - egg include parser buffer underflow
• Fix #26241 - null deref on dex memory exhaustion
• Fix #26243 - Handle REgg initialization failure
• Fix #26246 - fdleak when pipe(2) fails in lang_pipe_run
• Detect NE relocation chains infinite loops
• Bound NE counted string parsing
• Harden lua parser fixing many oobreads
• Fix Lua function parser OOB reads
• Fix oobread in Mach-O protocol list pointer parsing
• Fix Swift Mach-O invalid type metadata parsing
• Fix Swift Mach-O member metadata bounds check
• Fix Swift Mach-O field metadata bounds check
• Fix null+1 bug in afvt parsing
• Fix bplist Unicode string conversion
• Fix oobwrite by one (final null byte) in RStrStore
• Always null terminate utf16->utf8 strings
• Validate Mach-O LC_DATA_IN_CODE ranges
• Fix oobread when skipping subtests in softmagic match
• Fix segfault in malformed dwarf
• Fix malformed pyc refs crash and discarded ELF reloc leak
• Fix oobread in ELF PN_XNUM phdr count handling
• Validate dmp64 page counts against dump size
• Fix pyc marshal interned ASCII handling and validate code object section sizes
• Fix heap write overflow in Python loader
• Reject truncated PEF relocation tables

debug

• Fix windows build and debugstop on unix
• Implement dcut command to continue until time
• Fix getreg/setreg on wxp
• Fix ptrace requests on NetBSD
• Fix the FreeBSD build of the syscall trace mask
• Fix typo in desil exprmatchreg == handling
• Fix wrong size used in realloc
• Handle arv as a mirror of drv, to handle vector registers
• dc calls aec when cfg.debug is false
• Initialize subprocess env when not available for nix-ld

disasm

• Derive emu comment stack args from the calling convention layout
• Resolve stack-located format strings and scalar call args in emu comments
• Unify pd/pi/pdj backward walk and align the map-start window
• Harden backward disasm corner cases near file start and blocksize
• Fix #26262 - backward pdi/pdj drift when the window contains invalid instructions
• Add asm.cmt.invalid to comment invalid instructions
• Fix #26262 - pdj and pdi with negative count on aligned archs
• Expand printf-family varargs from the format string in emu call comments

esil

• Fix mips.gnu REGIMM branch targets and unconditional link
• Fix MIPS bgezal/bltzal to always write the link register
• Fix mips.gnu jal ESIL empty jump target
• Set cr0 on PPC record-form instructions and fix sraw/srawi word sign extension in ESIL
• Fix mips.gnu add/mult decode fallthrough and add missing hi/lo registers
• Fix mips signed mult high word and add srav ESIL
• Add arm64 BICS ESIL and type BIC as AND
• Fix mips.gnu slt-family ESIL dstreg and signed comparison
• Fix x86 SHL/SAL and NEG condition flags in ESIL (incl. memory destinations)
• Fix arm32 CMN flags and MOVT top-halfword replacement in ESIL
• Fix arm64 sbc ESIL carry sense and add sbcs/ngc/ngcs with NZCV flags
• Fix NZCV flags for arm64 flag-setting ops and carry-in for adc/adcs in ESIL
• Fix PPC extsb/extsh/extsw ESIL to always sign-extend into the destination
• Encode full-width compare results in the PPC cr ESIL model
• Apply the delayed branch when the delay slot op emits no ESIL
• Fix arm halfword and byte load widths in ESIL
• Fix ppc64 ld ESIL to not update the base register
• Propagate stop reason for esil debugging
• Stop ESIL continue at unmapped PC

graph

• Point switch case graph edges at the case jump target

http

• Improve the launcher webui style
• Prevent stale WebUI assets
• Fix HTTP browser launcher selection
• Update the Material WebUI from latest radare2-webui
• Empty lines in http auth file let pass any password
• Protect with auth the r2agent web sessions spawns

io

• Initial io.ebpf for Linux-x64,arm64,rv64
• Fix #26411 - oobwrite in io.gprobe
• Preserve permissions in io.xattr

lang

• Avoid null language plugin lookups

magic

• Run text magic rules after binary misses
• Fix #26164 - libfile 5.47 deprecated regex/c

port

• Add dist/netbsd to boot r2 in the browser

project

• Fix new project script for meta, hint and var
• Add 'prj list' subcommand
• Complete Ct commands and project persistence
• Lossless Ct base64/json serialization

projects

• Fix new project script for meta, hint and var
• Add 'prj list' subcommand
• Lossless Ct base64/json serialization

pseudo

• Convert only whitespace-preceded semicolons to comments in pdc
• Bring back the orphan block in pdc
• Fix zero-width pdcj annotation ranges in the pseudo decompiler
• Use strbuf padding for pdc indentation instead of a fixed buffer
• Return NULL instead of false in the dalvik pseudo parser
• Fix #26392 - oobread in asm_filter
• Initial h8300 pseudo decompilation
• Emit structured if/else in pdc
• Implement pdc* comment output

r2pm

• Add R2_LIBS with the library flags from R2_LDFLAGS

search

• Fix #26294 - Search stops on 0xffffffff data when io.cache is enabled
• Fix disassembly regex parsing and validation
• Preserve instruction boundaries across disassembly search blocks
• Apply search alignment to disassembly hit starts
• Global search.maxhits in disassembly search (not reset after each map)
• Fix multi-regex disassembly sequence search
• Make text magic scan optional with /mt

shell

• Check r2p in basename for r2pipe calls
• Cleanup dollar files apis
• Iterate command aliases directly in the hashtable
• Port echo to task-owned command contexts
• Fix #26377 - rm command silently ignoring -r and -rf flags
• Change b64: command behaviour and add b64:'
• Fix -j? and wire subcommands to js
• Accept parenthesis in temporal heading seek expressions
• Implement the heading @ syntax support
• Bring back the command substitution execution
• Improve cmd syntax test coverage and fix separator bugs
• Keep command substitution output opaque
• Support raw calls inside command substitutions
• Support literal commands after && and ||
• Normalize raw calls at command boundaries
• New CtxOnly RCmd API callbacks and add generic subcommands helpers
• Use the new cmdapi in the agD plugin
• Validate raw call addresses and faster quote strip
• Remove the deprecated double-quote raw call
• Preserve shell preprocessing and internal pipe chains
• Unify r2 and system shell command boundaries
• Support && and || command short-circuiting
• Add lazy argument slices to command contexts
• Add contexts for the new command handlers
• Keep command dispatch results structured internally
• Implement the new cmd api for trie based commands
• Make inline double quotes transparent before dispatch
• Preserve literal escapes in echo pipelines
• Fix the use of ', " and \ with lots of tests
• Prevent command injection in quoted spans
• Fix grouped grep after json format
• Fix subcommand parsing + help for z-
• Fix parsing /ad search subcommands modifiers
• Handle ed/-E errors and both behave equally
• Sync buffer length to avoid unnecessary strlens
• Respect cursor position in Tab, and autocomplete afvn varnames
• Fix exact autocomplete lookup for command arguments

sync

• Support thread conds on Windows 95/XP
• Add timeout support for r_th_cond_wait

test

• Avoid shared .tmp directory races between parallel tests
• Escape colon in count greps now that ~? honors line ranges
• Split the struct synthesis tests out of the overgrown types test file
• Add r2r test proving pdb unions survive the anal base-type path

tests

• Avoid shared .tmp directory races between parallel tests

tools

• Show -Os in 'r2 -v' for size optimized builds
• Add more vars for r2 -H
• Slurp raw stdin before converting it with rax2 -S
• Fix #24090 - Android toolchain reuse across architectures
• Centralize rcfile path construction and update -E/ed doc
• Document r2 -E flag
• Make rasm2 -L exit 0 like r2 -L and rafind2 -L

types

• Regenerate c2 golden files and test in CI
• Accept multiline function signature definitions
• Parse function pointers within function parameters
• Store variadic args as both forms
• Fix ctypes argument store for fnptr members and (void) prototypes
• Remove redundant null checks before free in the C types parser
• Expose type signedness and variadic checks in the r_type api
• Type the variable receiving the malloc'd pointer in afts
• Resolve the type matcher arg location and slot offset from one lookup
• Resolve stack arg slots via the cc argslot API in the type matcher
• Synthesize allocator return objects in afts
• Report size-function provenance in aftsj sizehints
• Cleanup the size-fn harvesting code in anal_tp
• Harvest object sizes from memset-style call sites
• Support long return types with > 64chars
• More comma based types support for structs, surviving sizeof, pf and tsc
• Support member fields with types containing commas
• Parse hex array dimensions in struct and union members
• Unify struct/union sdb serialization between the C parser and base types
• Expose and use real type size and field alignment details
• Strip wrapping quotes from the afvt type argument
• Struct redefinitions replace the saved members
• Preserve struct member array counts through the base-type sdb roundtrip

util

• Add non-recursive thread lock support for Windows
• Preserve partial stdin reads and remove dead newline code
• r_stdin_readline: correct EOF handling
• Add RSys.open(), a reusable system opener API
• Fix duplicate separators in r_file_root paths
• Fix r_num_units integer check for 80bit long doubles
• Disable log colors on legacy Windows consoles
• Implement strict vs tolerant base64 parsing modes
• Fix #26359 - out-of-range shifts and rotates in RNumMath
• Fix hex string escape decoding
• Document tolerant base64 decoding
• Initial import of the Trie data structure
• New r_sys_exepath and more portable pidpath api
• Add r_str_filter_file API for project names
• Fix #26244 - Prevent r_sys_cmd_str_full pipe hangs
• Fix dominator tree construction and add unit tests
• Add r_str_printfmt and the pfp command to map printf formats to vararg types
• Preserve callback RNum errors in math parser
• Fix math tokenizer race condition in RNum
• Add the new RStrPnlen for printable length strings
• Match unstripped function names in type guesser so afs protos resolve
• Optimize strbuf with less strlen and better weakref uses
• Format large strbuf appends in place

visual

• Implement scr.drag to click+drag to scroll in disasm/hex/graph
• Fix null dereference on prompt exit in visual find
• Fix visual disassembly scrolling across middle boundaries
• Fix disasm scroll bug over metadata
• Lock horizontal scroll in hexdump/disasm with scr.wheel.hscroll
• Fix visual disasm reverse scroll over metadata rows
• Fix visual disasm scroll stuck inside metadata

windows

• Add dist/reactos to create live web images for r2
• Fix debugger bugs for w32 (io read, attach and maps listing)
• Parse more ansi escape codes for non-vt terminals
• Disable more ansi codes on non-vt terminals
• Fix RCons.clearLine performance on legacy w32

zignatures

• anal: fix zignature drop for functions with empty-typed vars or varargs