radareorg/radare2 6.2.2

on GitHub

Authors

0xf00sec AGhebrea Aayush Khanna Angelo Ayton Bernhard M. Wiedemann Claude Jinbao Chen Kirby Kuehl Kleopatra Poritsi Mohammed Hassan Priyanshu Kumar Ruffalo Lavoisier Vaibhav Srivastava Vectrain51 mmustafasenoglu pancake pancake pancake phix33 phix33 potato root

Changes

abi

• Make RIOBind reads return byte counts
• Deprecate r_bin_is_static as requested by R2_590

anal

• Dont recover fp vars in frame-less functions
• Fix switch ownership when analyzing overlapping blocks
• Add arm64 swift convention for fpu args
• Rename default register arguments once when recovery ends
• Handle subregister arguments on x64
• Fix wrong variadic detection when eax is written before testing al
• Fix calling convention for arm64/swift fpargs
• Refresh VARTYPE metadata after variable renames
• Dont reuse fp args after calls
• Simplify floating-point argument recovery
• Add dyncc floating-point argument registers
• Memoize cc arg counts and skip fp walk on integer ops
• Recover float args from a separate fparg register sequence
• Fix readAhead UB in the function analysis loop
• Remove duplicate counted read bookkeeping
• Fix partial reads in analysis consumers
• Fix jump tables truncated by short reads
• Stop walking pc-relative indirect jumps as jump tables
• Analyze disconnected exception handler blocks
• Fix RAnalOp leaks in the disasm, diff and debugger decode loops
• Fix aeg folding ops without a dfg handler into constants
• Fix the memory leak and quadratic cost of aoj with many opcodes
• Fix dfg esil for goto and cmps
• Fix JSON disassembly architecture hints
• Use function call conventions for afsj arguments
• Fix fp local variable and arm32 reg tracking
• Resolve typed JNI table calls in analysis
• Typed JNI interface tables and indirection
• Materialize typed JNI native methods during analysis
• Add the new jni analysis plugin
• Stop afb and afbi from deleting switch cases that share a target
• Drop a stale arg from the float-formal expectation
• Separate a formal's ABI position from its sdb index
• Place formal parameters that DWARF leaves without a location
• Quiet aavrq to reduce noise in aaa
• Expose more switch details in the json output
• Forward register args through direct tail jumps like calls
• Match forwarded callee args by register instead of argnum
• Include the switch default target in block successor iteration
• Dont treat the returned int as a variadic marker
• Preserve registered types when linking DWARF prototypes
• Link DWARF types only when prototypes match
• Name local plt stubs in x86 retpoline layouts
• Free all flag metadata strings
• Name local plt stubs from their got relocs in aa
• Split the type propagation plugin into libr/anal/p/tp
• Warn for unresolved DWARF function return types
• Test bbstate restore doesnt rewind esil memory
• Bind exact DWARF function prototypes to their address
• Keep loop body register changes after the loop in aaft
• Honor address-linked function signatures
• Drop stale func arg keys when reanalysis recovers fewer arguments
• Fix local/global address detection for opmask in signatures

analysi

• Dont recover fp vars in frame-less functions
• Add arm64 swift convention for fpu args
• Rename default register arguments once when recovery ends
• Handle subregister arguments on x64
• Fix wrong variadic detection when eax is written before testing al
• Fix calling convention for arm64/swift fpargs
• Refresh VARTYPE metadata after variable renames
• Dont reuse fp args after calls
• Simplify floating-point argument recovery
• Add dyncc floating-point argument registers
• Memoize cc arg counts and skip fp walk on integer ops
• Recover float args from a separate fparg register sequence
• Fix readAhead UB in the function analysis loop
• Remove duplicate counted read bookkeeping
• Fix partial reads in analysis consumers
• Fix jump tables truncated by short reads
• Stop walking pc-relative indirect jumps as jump tables
• Analyze disconnected exception handler blocks
• Fix RAnalOp leaks in the disasm, diff and debugger decode loops
• Fix aeg folding ops without a dfg handler into constants
• Fix the memory leak and quadratic cost of aoj with many opcodes
• Fix dfg esil for goto and cmps
• Fix JSON disassembly architecture hints
• Use function call conventions for afsj arguments
• Fix fp local variable and arm32 reg tracking
• Resolve typed JNI table calls in analysis
• Typed JNI interface tables and indirection
• Materialize typed JNI native methods during analysis
• Add the new jni analysis plugin
• Stop afb and afbi from deleting switch cases that share a target
• Drop a stale arg from the float-formal expectation
• Separate a formal's ABI position from its sdb index
• Place formal parameters that DWARF leaves without a location
• Quiet aavrq to reduce noise in aaa
• Expose more switch details in the json output
• Forward register args through direct tail jumps like calls
• Match forwarded callee args by register instead of argnum
• Include the switch default target in block successor iteration
• Dont treat the returned int as a variadic marker
• Preserve registered types when linking DWARF prototypes
• Link DWARF types only when prototypes match
• Name local plt stubs in x86 retpoline layouts
• Free all flag metadata strings
• Name local plt stubs from their got relocs in aa
• Split the type propagation plugin into libr/anal/p/tp
• Warn for unresolved DWARF function return types
• Test bbstate restore doesnt rewind esil memory
• Bind exact DWARF function prototypes to their address
• Keep loop body register changes after the loop in aaft
• Honor address-linked function signatures
• Drop stale func arg keys when reanalysis recovers fewer arguments
• Fix local/global address detection for opmask in signatures

analysis

• Dont recover fp vars in frame-less functions
• Add arm64 swift convention for fpu args
• Rename default register arguments once when recovery ends
• Handle subregister arguments on x64
• Fix wrong variadic detection when eax is written before testing al
• Fix calling convention for arm64/swift fpargs
• Refresh VARTYPE metadata after variable renames
• Dont reuse fp args after calls
• Simplify floating-point argument recovery
• Add dyncc floating-point argument registers
• Memoize cc arg counts and skip fp walk on integer ops
• Recover float args from a separate fparg register sequence
• Fix readAhead UB in the function analysis loop
• Remove duplicate counted read bookkeeping
• Fix partial reads in analysis consumers
• Fix jump tables truncated by short reads
• Stop walking pc-relative indirect jumps as jump tables
• Analyze disconnected exception handler blocks
• Fix RAnalOp leaks in the disasm, diff and debugger decode loops
• Fix aeg folding ops without a dfg handler into constants
• Fix the memory leak and quadratic cost of aoj with many opcodes
• Fix dfg esil for goto and cmps
• Fix JSON disassembly architecture hints
• Use function call conventions for afsj arguments
• Resolve typed JNI table calls in analysis
• Typed JNI interface tables and indirection
• Materialize typed JNI native methods during analysis
• Add the new jni analysis plugin
• Stop afb and afbi from deleting switch cases that share a target
• Drop a stale arg from the float-formal expectation
• Separate a formal's ABI position from its sdb index
• Place formal parameters that DWARF leaves without a location
• Quiet aavrq to reduce noise in aaa
• Expose more switch details in the json output
• Forward register args through direct tail jumps like calls
• Match forwarded callee args by register instead of argnum
• Include the switch default target in block successor iteration
• Dont treat the returned int as a variadic marker
• Preserve registered types when linking DWARF prototypes
• Link DWARF types only when prototypes match
• Name local plt stubs in x86 retpoline layouts
• Free all flag metadata strings
• Name local plt stubs from their got relocs in aa
• Split the type propagation plugin into libr/anal/p/tp
• Warn for unresolved DWARF function return types
• Test bbstate restore doesnt rewind esil memory
• Bind exact DWARF function prototypes to their address
• Keep loop body register changes after the loop in aaft
• Honor address-linked function signatures
• Drop stale func arg keys when reanalysis recovers fewer arguments
• Fix local/global address detection for opmask in signatures

api

• Add R_LOG_HINT which is unset for automatic steps
• Replace system bits packing with generic value packs

arch

• Take the arm32 immediate shift carry from the source register
• Mask the arm32 shifted-operand count to its low byte
• Fix m680x jsr/jmp/bsr and branch targets so calls get xrefs
• Add CIL token resolution and stack ESIL
• Fixes for the Dalvik array, object and memory esil
• Fix Dalvik calls and result register handling
• Fix signed Dalvik operands and branch targets
• Fix sign data bug in dex decoder
• Reroute the capstone v6 ppc overflow-form ids onto their base cases
• Decode the mips.gnu unaligned word loads and stores
• Fix the mips.gnu instruction ids and let it decode at 64 bits
• Initial support for nvidia ptx sass encode/decode/pseudo
• Type ppc bcl 20,31 branch-always forms as jumps that set lr
• Remove the dead colon replacement from the ppc, mips and sparc pseudo parsers

bin

• Support msvc demangling single letter names
• Fix missing null byte when the msvc demangler emits std::nullptr_t
• Add string type suffixes to filter iz and izz output
• Patch aarch64 ET_REL GOT relocs against the import slot
• Place ET_REL NOBITS sections and its import slots
• Compute baddr for elf relocs outside the hot loop
• Patch relocs at their mapped address under a custom baddr
• Fix slow load of mach0 with repeated classes and huge objc lists
• Read the in-place addend for implicit-addend crel relocations
• Patch i386 GLOB_DAT, JMP_SLOT and RELATIVE dynamic relocs
• Stop reading REL targets while listing relocations
• Fix off-by-one array extents when DWARF uses DW_AT_count
• Add RBinSymbol.hsize for header metadata paddings
• Migrate RBin trycatch storage to RVec
• Parse the CLR exception clauses of the dotnet method bodies
• Fix the PE64 SEH scope tables and parse the MSVC C++ exception regions
• Harden the eh_frame trycatch parser and fix the flag fallout
• Parse the Itanium exception regions from the ELF eh_frame
• Generalize the LSDA parser and fix the typed trycatch details
• Keep import GOT relocs at their site when bin.relocs.apply is on
• Expose C++ vtable ownership in class metadata
• Improve C++ class metadata recovery
• Fix Itanium (c++) multiple-inheritance base offsets
• Fix bin base address handling with -m and in threaded loading
• Parse encoded DEX exception handlers
• Fix #26552 - type relr relocs for the target machine
• Add async and generator flags to symbol JSON
• Add JSON output for try/catch metadata
• Add bytecode argument and return metadata to isj
• Fix #26546 - stop zeroing relr relocs under bin.relocs.apply
• Fix #26547 - encode thumb branch relocs instead of a raw word
• Keep non-import ELF relocs at their site when bin.relocs.apply is on
• Parse CLR types, signatures and user strings
• Move the java member descriptor api out of r_bin into shlr/java
• Sideload macho dsym matching arch slice and uuid
• Fix #25480 - pcap stream selection support
• Fully expand ELF RELR bitmap relocations
• Add support for the android-specific ELF relocations
• Fix JNI symbol detection for ELF only
• Add structured Java and JNI descriptor parsing
• Fix dwo_id truncation in the DWARF5 unit header
• Scan the last 20 bytes of a range for ppc64 ELFv1 eager call stubs
• Recover Swift struct field offsets from type metadata
• Add AArch64 ET_REL relocation patching tests
• Encode AArch64 branch and data relocations instead of an 8 byte write
• Replace RList/RRBTree store of RBinRelocs into RVec
• Unify bounded ELF string table lookups with strtab_str()
• Cap the section-less ELF symtab scan with the stated symbol count
• Only import undefined symbols in the section-less ELF scan
• Bound the section-less ELF dynsym scan at the next dynamic table
• Fix heap out of bounds read in the ppc64 plt stub segment scan
• Scan every code range for ppc64 plt call stubs and accept static-chain loads
• Name ppc64 ELFv1 text call stubs after their plt slot
• Move ELF PLT import resolution into plt.c
• Fix ELF-ppc32 import addresses for fPIC secure-plt call thunks
• Fix ELF-arm64 plt entry stride for pac-plt and bti-plt layouts
• Use bin.lang as default for ic+ metadata
• Detect symbol languages independently of binary format
• Fix field sizes and IBM XL language detection
• Extend ic+ attribute parsing
• Expose class attributes in JSON
• Unify binary metadata in RBinAttr
• Register binary languages during symbol parsing
• Clarify scalar and packed binary language types
• Use value packs for binary languages
• Add mixin/late attributes needed for Dart classinfo
• Load Swift metadata classes from ELF binaries
• Refactor Mach-O Swift class extraction to use shared loader
• Add generic Swift metadata class loader
• Extend Swift demangler for symbolic references and members
• Fix null names and wrong addresses from DWARF5 indexed forms
• Add iccl command to list the langs
• Add CIL classdump output for icc
• Add Dart classdump output for icc

build

• Rebuild shlr objects when the headers they include change
• Reproducible egg xor key via SOURCE_DATE_EPOCH
• Fix wasi tool linkage against libr_java
• Fix JSLinux runtime patching and distribution packaging

ci

• Rewrite lint.sh in python to scan each file only once
• Removes 5-6 jobs + macOS x86_64 leg from PR triggers, restricting them to push-to-master only

cons

• Use RStrBuf instead of global CbPrintf in Stiv
• Faster graphs: 6x (color+utf8) 20x (nocolor+ascii)
• Fix console visual rendering bounds
• Prevent internal pager from scrolling its first page
• Clearline in ^R while typing to avoid glitching the terminal
• Forward mouse-wheel events in JSLinux terminal
• Fix wrong line count in command output

core

• New core plugin command context interface api
• Refactor r_num_math error handling in cmd_seek (Step 2)
• Add support for embedding .r2.js scripts via r2plugin/xps

crasg

• Fix stack overflow in the visual assembler

crash

• Fix msvc demangler string copy null deref
• Fix UAF on bochs.detach with the register cache
• Fix oobread parsing debug.bochs breakpoint list
• Fix stack buffer overflow parsing the bochs stop address
• Fix out of bounds write parsing bochs register replies
• Fix copy_string reporting success after freeing its buffer
• Fix heap buffer overflow in the base91 muta plugin
• Fix integer overflow in the swift demangler bounds check
• Fix gron filter null deref
• Fix #26600 - Define capability-based bin IO redirects
• Fix null derefs in pdb/tpi parser
• Fix infinite loop parsing fuzzer pe64 exception directory
• Otezip source doublefree in fszipdir
• Fix null assert for unbinded symbols in isj
• Fix xref cleanup ordering
• Fix UAF in fcn callconv
• Fix #26458 - oobwrite in RBin.NSO and LZ4.decompressBlock
• Fix bound bugs in WinKD io code
• Fix null deref in RBin.attrFromString
• Validate UBIFS node lengths before struct reads
• Share Mach-O bind repeat validation
• Validate threaded Mach-O bind repeats
• Limit malformed Mach-O bind relocation loops

debug

• Fix bochs register profile alignment when segments missing
• Add support for data watchpoints for Haiku
• Handle asynchronous Haiku thread exits
• Fix Haiku debugger exceptions handling
• Add native debugger support for Haiku (x86-32/6)
• More work on the single step for xnu
• Fix single stepping again on macos-arm-64
• Fix Linux RV64 native debugger register profile

disasm

• Don't print a string comment for a relocated pointer slot
• Fix riscv unsigned branch pseudo, add missing branch rows
• Fix heap buffer overflow when truncating the bytes column
• Fix fp based / x29 stack var disasm for arm64
• Show the instruction under a typelink that has no format
• Render arm conditional branches as v conditions in the pseudo output

esil

• Fix shift overflow and ASR sign extension
• Reorganize ESIL op registration and reuse gb nops
• Simplify ESIL string history ring
• Turn the esil stack arena into a ring buffer
• Fix esil F== and F!= to compare exactly and follow IEEE on NaN
• Correct the arm64 float compare flags and immediate width
• Fix nested esil conditionals running the wrong else arm
• Emit balanced esil for the arm64 conditional compares
• Count only jumps and definition nesting toward esil.gotolimit
• Warn on oversized CLZ width and keep plain esil fallbacks
• Document the CLZ and POPCNT esil operations
• Use the CLZ esil operation for the arm count leading zeros
• Model the ppc count leading zeros and popcount forms
• Add the CLZ and POPCNT esil operations
• Rewrite the compound esil ops with REsilDefine instead of C handlers
• Add r_esil_define to implement esil ops as word definitions
• Add the ROT esil op to rotate the third stack element to the top
• Declare the ++ esil op to push one value like --
• Fix esil_peek_some regsize handling and esil_poke_some return value
• Fix CIL equality stack comparisons
• Fix the arm64 bfxil, extr and smulh esil and model the msubl forms
• Extend the arm64 register operands before shifting and mask the uxt forms
• Wrap the esil signed division of INT_MIN by -1 like the hardware
• Model the mips divide, wide multiply and multiply-accumulate forms
• Model the mips sign-extend and byte-swap forms
• Model the mips bitfield extract and insert forms
• Model the mips64 shift and rotate forms and fix the dsra sign fill
• Fill the mips.gnu dsra result from bit 63
• Narrow the mips.gnu sll result to 32 bits
• Emulate the mips.gnu rotr and rotrv as rotates
• Fix the x86 att operand details in capstone, not in r2
• Model PPC XER.OV/SO for the overflow-enabled forms and mfxer/mtxer
• Fix the arm32 shift counts, sign extension and uadd8 esil
• Write back the post-index offset of the arm unprivileged loads
• Assign the arm adc, sbc and rsc result instead of accumulating it
• Model the ppc high multiplies and the rotate-insert forms
• Sign-extend the ppc word multiply and mask the shift counts
• Fix esil that writes a destination aliasing its own source
• Fix the x86 mul, div and movbe esil and model the bit counters
• Merge the addressed bytes in the mips unaligned loads and stores
• Deduplicate the x86 shift emitters and fix their flag ordering
• Take the x86 shift counts from the right operand
• Model the x86 rotates through the carry flag
• Reuse one load macro and one compare block in the mips esil
• Compare and multiply the whole mips64 registers in sltu and multu
• Sign-extend the mips 32-bit results and mask the shift counts
• Skip the x86 shift body when the count masks to zero
• Zero-extend the 32-bit registers the x86 esil writes by hand
• Jump to the right token when the bsf or bsr source is in memory
• Fix bic expression for arm64
• Fix the x86 adjust flag bit position and adc carry propagation
• Compute the sbb overflow correction before the destination write
• Fix the sbb carry, adjust and overflow flags in the x86 esil
• Store to the sbb destination and zero-extend its 32-bit register writes
• Zero-extend every W register the arm64 ESIL writes
• Zero-extend 32-bit register writes on arm64
• Zero-extend 32-bit register writes on x86-64
• Mask the x86 shift count to the operand width

flags

• Make r_flag_get_by_spaces only return flags from the requested spaces

globals

• Stop using RCons.Gprintf from heap api
• Stop using the global RCons.Gprintf in the pdb parser

http

• Fix Windows socket bugs breaking HTTP server mode
• Fix iOS JSLinux offline caching and startup
• Add iOS icon and complete offline JSLinux cache

io

• Fix counted reads backed by the IO cache
• Correct counted reads across IO maps

jslinux

• Font pinch recalculates terminal size
• Ship an optional size-optimized TinyCC
• Add terminal pinch font scaling to

muta

• Use r_base64_decode_dyn in the base64 muta plugin

panel

• Panel model initialized once and alphabetically sorted
• Tabs now appear in the 2nd line

panels

• Panel model initialized once and alphabetically sorted

perf

• Cache IOMap and skip overlapping data metas when flagging relocs
• Half the reloc string allocations, reduces 25% memory

port

• Finish the uefi port and publish artifacts in release

print

• Refuse base91 inputs that don't fit into an int
• Don't size the print block from a pf/pm/pa argument
• Fix psj misclassifying ascii strings with zero padding as wide
• Add entropy edges printing mode

project

• Don't save/load scr.theme in scripts
• Fix project saving error when no changes or prj.new fails
• Reject project notes paths escaping through symlinked directories

projects

• Don't save/load scr.theme in scripts

pseudo

• Resolve pdc goto names on demand instead of collecting labelable addresses
• Print pdc gotos to another function by its name
• Keep each pdc branch's emulated stores from its siblings
• Emulate every pdc block once in CFG order
• Render pdc blocks via r_core_print_disasm not pD
• Keep pdc emulation inside its own io cache layer
• Add pdc.trycatch and make it structured in the ast
• Initial support for trycatch statements in pdc (as comments)
• Render pdcj, pdca and pdc* through the structured pdc too
• Render sparc cmp and conditional branches
• Don't inline function jmps in pdc
• Improve pdc output on dex functions
• Add s390 pseudo parser
• Fix blockers that restricted pdc.structured
• Reduce duplication in the structured pdc renderer
• Resolve flag-named own edges and skip unset case targets in structured pdc
• Render loops and switches in the structured pdc output
• Ignore unset switch default and table addresses in pdc
• Register pdc.structured from the pseudo plugin
• Indent orphan blocks in pdc at the walk depth
• Dont truncate pdc orphan case tags

r2js

• Fix #26581 - Update to the r2papi 0.5.0

r2pm

• Add portable r2 package platform support
• Gate packages by platform

r2r

• Give valgrind-wrapped leak tests a minimum timeout

search

• Fix regex searches after short reads

shell

• Fix #23362 - Handle math errors in cmd_seek
• Port b to task-owned command contexts
• Fix 'No session started' on 'd?*'

test

• Add r2r tests for the ppc32 SDA_BASE agree/disagree gp seed
• Add r2r tests for esil F< F<= ordering and compare underflow
• Skip variable analysis in the glibc plt-local tests
• Update the dex symbol golden for the flags field in is.j
• Fix dex and cil test regressions, honor dyncc argcount in call comments

tools

• Fix #26636 - Dont load global scripts with -N
• Fix #26431 - Support endian-swapped hex streams in rax2

types

• Fix #26675 - lstat returns int
• Correctly handle void typedefs when omited
• Add missing POSIX and glibc prototypes to the type database
• Record DWARF DW_AT_byte_size for composite
• Fail closed when a struct names itself in r_type_get_bitsize
• Render void qualifiers (restrict, volatile..) from dwarf
• Save a base type under the spelling that refers to it
• Respect enum size if specified (defaults to 32bit like in C)
• Keep improved type propagation in the goldens
• Follow the declaration name into the jni and dwarf goldens
• Follow the printed declaration name in the signature unit tests
• Hand out the db key a function-name match went through
• Add long type variants for windows base
• Resolve typedefs before measuring pointer width
• Measure typedefs in r_type_get_bitsize
• Size pointer members with the target word width in the type api
• Fix struct/enum roundtrip names
• Fix type db lookups for __-prefixed names and comma-typed args

util

• Make the base91 char lookup static and use memchr
• Handle .r2so as a portable lib extension
• Use RStrBuf instead of memcat to render hexpairs
• Guard empty reloc names, keep bin.prefix on demangled reloc flags and dedup r_str_newf/newvf
• Speed up ASCII display-width calculations
• Grow strbuf pads with the append slack instead of an exact fit

visual

• Bound panel scroll to its contents
• Resize panels with the mouse drag event
• Fix mouse wheel events in panel menus
• Improve JSLinux touch navigation and guest defaults