radareorg/radare2 6.2.6

on GitHub

Authors

Aaron Thomas Adam - Zyph. Tech. Ali Ahmet Memiş Andrei Bacescu Andrei Bacescu Angelo Ayton Bhavay Goyal Francesco Tamagni Huzaifa Iftikhar HuzaifaChaudary Jay Hemnani Kayyo321 Kirby Kuehl Kisnner Obando Kushagra Mar Marcel Alexandru Nitan Matt Fulghum Mluo2011 Mohammed Hassan Nathan Chandrasekar Noah1 Ole André Vadla Ravnås Priyanshu Kumar SAIREX Yashvardhan Thanvi aeonframework arxhr007 astralia bdunahu condret dependabot[bot] h4ck-u jayhemnani9910 kaii-k mfulghum pancake pancake pancake phix33 potato qiyuhuating 祈雨

Changes

abi

• Completely eliminate CbPrintf from RBin

anal

• Look up bin symbols at rebased addresses by their file vaddr
• Don't give C main and C++ helpers Swift self/error args
• Count stack frames of 8 KiB or more in aat
• Keep array declarators whole in c2 function args
• Fix slow analysis of wasm and pyc functions declaring huge argument counts
• Remember DWARF location list picks and bound .debug_loclists reads per load
• Cap DWARF multidimensional DWARF types to stop blowing up the memory usage
• Drop cons+core dependency from rtti_itanium recover_all
• Cap Itanium VMI base classes at 64 and make avrr interruptible
• Walk DWARF children through a per-unit sibling table to stop quadratic time on nested DIEs
• Bound JNI method table scanning and cap Java descriptors at 255 argument slots
• Fix #14078 - Mask AVR jump targets with the flash byte-address width
• Shrink fcn/bb structs and cache block order
• Bound and trim gopclntab names to reduce memory usage
• Use RVec (instead of RList) for RAnalFunction->bbs
• Add types.maxtrace to bound the type propagation trace per function
• Use sanitized names for the class rename lookups and keys
• Skip unmapped gaps to fix DoS in aav/V
• Compare sanitized base names when deduplicating class bases
• Keep three-operand esil ops in the aeg dataflow graph
• Walk MIPS delay slots before branch arg recovery
• Fix leaked break frame in 64-bit MSVC RTTI base class parsing
• Fix O(n^2) renaming DWARF local names
• Clear stale zignature collisions when zac runs again
• Accept za C so z* output reloads its collisions
• Report the inline function attribute in aflj
• Fix RH850 ELF CPU detection and V850 CI regressions
• Fix V850 analysis boundaries and wrapped branch targets
• Describe and test Xtensa hardware loop setup conditions
• Fix xtensa stack frames, register roles and illegal ops
• Classify arm64 structure accesses and account for their SP writeback
• Drop stale clobber and preserve sets when redefining a cc
• Skip C++ vtable analysis in aaa for golang binaries
• Add afia command to list and set function attributes
• Add is_inline function attribute to RAnalFunction
• Include interrupt handlers in function graph export
• Store zignature collisions as one string per item
• Fix z/ renames on offset-only matches and slow collisions
• Fix zignature collision intersection in z/ matching
• Expose V850 branch predicates and correct pseudo address arithmetic
• Add IAR V850 calling convention and track movhi definitions
• Model V850 stack frames and dispose transfers correctly
• Name the read,write op direction instead of casting it
• Recover V850 scalar arguments and stack variables
• Fix default Thumb stack variable widths
• Distinguish unknown return types in afsj JSON
• Use register widths for Thumb argument recovery
• Fix duplicate java switch successors in afb
• Add the swift cc to 16-bit ARM analysis
• Fix arm16 cc args and preserve set in the 32-bit arm db
• Fix STM8 memory access metadata and pseudo AND
• Keep all argument registers in profile calling conventions
• Use the argument-structure ABI for i386 old mmap
• Record Linux syscall clobbers and the MIPS error register
• Parse the numeric IPv4 immediate hint as base 32
• Correct MIPS o32 syscall numbers and add socket calls
• Describe Linux syscall argument conventions across architectures
• Expose syscall arity and argument formats in asj
• Preserve delay slot in noreturn functions
• Expose int hints in analbytes
• Keep traversing successors after a missing basic block
• Correct PYC code permissions and MZ header virtual size
• Fix analysis section checks in physical address mode
• Stop analysis at non-executable sections
• Fix MIPS analysis continuing past invalid instructions
• Fix call-clobbered stack varnames for negative offsets
• Fix C++ function signatures with callable types for dwarf analysis
• Centralize function renaming to sync aan results
• Fix quadratic aav rescans of overlapping sections
• Optimize cubic time noreturn propagation in block automerge
• • (17min -> 23s)
• Expect the ARM64 switch recovered by larger prelude reads
• Use a configurable 64 KiB read buffer for prelude searches
• Stream prelude hits in address order with RSearch mode flags
• Scan all function preludes together with RSearch
• Analyze aap's prelude hits from the lowest address up
• Fix global registration with nonzero flag bases
• Reject conflicting global variable registrations
• Keep aea emulating an instruction past an access to unmapped memory
• Keep one read-ahead cache for each function walk
• Respect byte extents in ESIL function and block access scans
• Fix afsj address selection and failure status
• Recover IPA-RA arguments from cached register writes
• Use the caller cc at a direct call to an unanalysed target
• Ignore vector reads of a preserved register after a call
• Use the callee convention for copied FP argument widths
• Type arm64 float args by the width of their first read
• Fix global array sizes and type propagation
• Autoload API types through a library and OS dependency index
• Add GLib, GObject and GIO API type databases
• Add the gettext codeset function prototype
• Fall back to the target convention for unavailable function conventions
• Declare the ObjC runtime functions as objc4 does
• Support remaining ARM64 checked pointer arithmetic
• Analyze ARM64 tagged pointer subtraction
• Stop type propagation at constant argument assignments
• Preserve fixed-width integer types during signed inference
• Restore global flagspaces and exclude Dalvik metadata from globals
• Fix ARM64 code coverage across checked pointer arithmetic
• Add global type propagation and field inference in TP
• Add global discovery and typing from code accesses
• Fix reference scan tails and chunk alignment
• Fix x86 signed and floating access metadata
• Fix #26945 - Register and type globals automatically
• Recover arm64 args read by fp arithmetic and conversions
• Point relocated ARM xrefs at Thumb entries
• Keep pair slots on their access side, first src in aat/aht
• Find both stack slots of arm64 paired loads and stores
• Follow more sp restores: lea, arm32 writeback, typed zero
• Seed cleanup pads and mark the unwinder resume noreturn

analysis

• Look up bin symbols at rebased addresses by their file vaddr
• Don't give C main and C++ helpers Swift self/error args
• Count stack frames of 8 KiB or more in aat
• Keep array declarators whole in c2 function args
• Fix slow analysis of wasm and pyc functions declaring huge argument counts
• Remember DWARF location list picks and bound .debug_loclists reads per load
• Cap DWARF multidimensional DWARF types to stop blowing up the memory usage
• Cap Itanium VMI base classes at 64 and make avrr interruptible
• Walk DWARF children through a per-unit sibling table to stop quadratic time on nested DIEs
• Bound JNI method table scanning and cap Java descriptors at 255 argument slots
• Fix #14078 - Mask AVR jump targets with the flash byte-address width
• Shrink fcn/bb structs and cache block order
• Bound and trim gopclntab names to reduce memory usage
• Use RVec (instead of RList) for RAnalFunction->bbs
• Use sanitized names for the class rename lookups and keys
• Skip unmapped gaps to fix DoS in aav/V
• Compare sanitized base names when deduplicating class bases
• Keep three-operand esil ops in the aeg dataflow graph
• Walk MIPS delay slots before branch arg recovery
• Fix leaked break frame in 64-bit MSVC RTTI base class parsing
• Fix O(n^2) renaming DWARF local names
• Clear stale zignature collisions when zac runs again
• Accept za C so z* output reloads its collisions
• Describe and test Xtensa hardware loop setup conditions
• Fix xtensa stack frames, register roles and illegal ops
• Classify arm64 structure accesses and account for their SP writeback
• Drop stale clobber and preserve sets when redefining a cc
• Skip C++ vtable analysis in aaa for golang binaries
• Add afia command to list and set function attributes
• Add is_inline function attribute to RAnalFunction
• Include interrupt handlers in function graph export
• Store zignature collisions as one string per item
• Fix z/ renames on offset-only matches and slow collisions
• Fix zignature collision intersection in z/ matching
• Expose V850 branch predicates and correct pseudo address arithmetic
• Add IAR V850 calling convention and track movhi definitions
• Model V850 stack frames and dispose transfers correctly
• Name the read,write op direction instead of casting it
• Recover V850 scalar arguments and stack variables
• Fix default Thumb stack variable widths
• Distinguish unknown return types in afsj JSON
• Use register widths for Thumb argument recovery
• Fix duplicate java switch successors in afb
• Add the swift cc to 16-bit ARM analysis
• Fix arm16 cc args and preserve set in the 32-bit arm db
• Fix STM8 memory access metadata and pseudo AND
• Keep all argument registers in profile calling conventions
• Use the argument-structure ABI for i386 old mmap
• Record Linux syscall clobbers and the MIPS error register
• Parse the numeric IPv4 immediate hint as base 32
• Correct MIPS o32 syscall numbers and add socket calls
• Describe Linux syscall argument conventions across architectures
• Expose syscall arity and argument formats in asj
• Preserve delay slot in noreturn functions
• Expose int hints in analbytes
• Keep traversing successors after a missing basic block
• Correct PYC code permissions and MZ header virtual size
• Fix analysis section checks in physical address mode
• Stop analysis at non-executable sections
• Fix MIPS analysis continuing past invalid instructions
• Fix call-clobbered stack varnames for negative offsets
• Fix C++ function signatures with callable types for dwarf analysis
• Centralize function renaming to sync aan results
• Fix quadratic aav rescans of overlapping sections
• Optimize cubic time noreturn propagation in block automerge
• • (17min -> 23s)
• Expect the ARM64 switch recovered by larger prelude reads
• Use a configurable 64 KiB read buffer for prelude searches
• Stream prelude hits in address order with RSearch mode flags
• Scan all function preludes together with RSearch
• Analyze aap's prelude hits from the lowest address up
• Fix global registration with nonzero flag bases
• Reject conflicting global variable registrations
• Keep aea emulating an instruction past an access to unmapped memory
• Keep one read-ahead cache for each function walk
• Respect byte extents in ESIL function and block access scans
• Fix afsj address selection and failure status
• Recover IPA-RA arguments from cached register writes
• Use the caller cc at a direct call to an unanalysed target
• Ignore vector reads of a preserved register after a call
• Use the callee convention for copied FP argument widths
• Type arm64 float args by the width of their first read
• Fix global array sizes and type propagation
• Autoload API types through a library and OS dependency index
• Add GLib, GObject and GIO API type databases
• Add the gettext codeset function prototype
• Fall back to the target convention for unavailable function conventions
• Support remaining ARM64 checked pointer arithmetic
• Analyze ARM64 tagged pointer subtraction
• Stop type propagation at constant argument assignments
• Preserve fixed-width integer types during signed inference
• Restore global flagspaces and exclude Dalvik metadata from globals
• Fix ARM64 code coverage across checked pointer arithmetic
• Add global type propagation and field inference in TP
• Add global discovery and typing from code accesses
• Fix reference scan tails and chunk alignment
• Fix x86 signed and floating access metadata
• Fix #26945 - Register and type globals automatically
• Recover arm64 args read by fp arithmetic and conversions
• Point relocated ARM xrefs at Thumb entries
• Keep pair slots on their access side, first src in aat/aht
• Find both stack slots of arm64 paired loads and stores
• Follow more sp restores: lea, arm32 writeback, typed zero
• Seed cleanup pads and mark the unwinder resume noreturn

arch

• Clear the sign of -0 and -NaN in arm64 fabs esil
• Fix #8389 - Make MIPS branch offsets relative to the instruction address
• Fix #16533 - Decode the TriCore 1.6 BOL loads and stores
• Walk each wasm function once and decode the control flow pre-pass with a 64 byte window
• Add the Epson E0C62 4-bit microcontroller arch plugin
• Fix Z80 ESIL build and refresh assembler regressions
• Add ARM64 SHA256 execution and fix vector REV32
• Encode rotated immediates in arm32 data processing instructions
• Stop 8051 div-by-zero from clobbering the flags
• Fix the condition and stack mode suffixes of arm32 ldm and stm
• Fix arm32 instructions that ignored their condition code
• Fix arm64 braa/brab ESIL to branch to Xn
• Reject invalid push/pop, cps and mov operands in the arm32 assembler
• Fix arm32 mov shifts, register list ranges and cps in the assembler
• Add ESIL for arm32 sdiv and udiv
• Add pseudo syntax disassembly for xtensa
• Fix x86.nz test and xchg with a memory operand
• Decode ARM BE8 code as little-endian in the GNU backend
• Decode arm64 BE8 instructions in LE 
• Wrap STM8 interrupt-frame addresses at the stack width
• Keep full extended opcodes in the V850 E0 decoder
• Recover firmware trap continuations and interrupt return contexts
• Model STM8 byte multiplication and interrupt masks in ESIL
• Fix V850 status flags and interrupt control semantics
• Six emitters use r_strbuf_setf and wipe their condition
• Fix stores, srai and jalr in the RISC-V assembler
• Base the x86.nz displacement limit on the address size
• Fix x86.nz not, neg, mul, div, imul and idiv operand encoding
• Size arm32 pc-relative literal loads by their access width
• Fix UB left shifts in ppc
• Encode all 16 immediate bits of svc, hvc, smc, brk and hlt in the arm64 assembler
• Implement V850 division results and status flags
• Preserve V850 absolute memory operands in ESIL
• Fix ARM32 VFP compatibility and stack recovery
• Add ARM32 scalar VFP effects and FPSCR flags
• Fix CF/OF for the 64-bit 2/3-operand imul
• Fix the condition code of csel, cset and ccmn in the arm64 assembler
• Fix STM8 register widths and overlapping register views
• Encode every movzx and movsx memory operand in x86.nz
• Fix v35 fccmp, ccmp and ccmn conditional flag updates
• Fix zydis sar sign fill on narrow memory operands
• Fix BPF branch immediates and JMP32 operand widths
• Sign extend BPF ALU64 immediates
• Fix unsigned BPF branch comparisons in ESIL
• Fix BPF wide immediates and fifth argument register
• Assemble s, d and q register pairs in arm64 ldp and stp
• Fix ldp and stp encoding in the arm64 assembler
• Fix negative immediates in arm32 (ldr/str) assembler
• Fix arm assembler for cmp/test conditional on reg/imm
• Add bt, bts, btr and btc to the x86.nz assembler
• Fix x86.nz ALU instructions between registers and memory
• Fix #11724 - Fix x86.nz scaled index and displacement in 32-bit memory operands
• Mask loongarch .w register shift counts to rk[4:0]
• Fix truncated FSR operands in PIC midrange disassembly
• Truncate ut64 branch targets passed to %x in snes and or1k
• Fix SPARC operand and control flow analysis
• Add MIPS r5900 CPU support
• Fix MIPS MSA register profiles and BZ ESIL
• Fix x86 rotate memory access on capstone 5
• Add is_vector_op helper for arm64 ESIL vector detection
• Fix x86.nz lea with index, extended and 32-bit registers in 64-bit mode
• Fix x86.nz mov between registers and memory in 64-bit mode
• Add ESIL for mips clz, clo, dclz and dclo
• Word-form arithmetic shifts on 64-bit ISAs feed ASR a 32-bit
• Fix MIPS addi overflow check for negative operands
• Emit REX for r8-r15 in 8, 16 and 32 bit ALU register forms
• Fix x86 rotate memory destination access in capstone
• Emit the operand size prefix and REX in x86 cmovcc
• Fix arm64 conditional select ESIL and add csinv/csneg
• Use Intel operand detail order for AT&T on capstone 6
• Stop marking every mips and on sp as a stack alignment
• Track microMIPS addiusp and 64-bit sp in mips stack ops
• Emulate arm64 mrs and msr of the thread pointers and nzcv
• Add the offset of an ARM pc-relative load in pseudo disassembly
• Keep the index register of an ARM load from pc in its ESIL and listing
• Declare the x87 registers in the 32-bit x86 profile
• Emulate fninit's reset of the x87 control, status and tag words
• Emulate the Thumb mov and movs moves and their flags
• Return to the register an arm64 ret names

asm

• Fix x86.nz bsf, bsr, popcnt, lzcnt and tzcnt with REX registers
• Add cmpxchg to x86.nz
• Add pause and the 64-bit string instructions to x86.nz
• Fix x86.nz mov between 8 and 16-bit registers that need REX
• Fix x86.nz cmovcc with memory operands
• Fix x86.nz setcc with REX registers and memory operands
• Fix x86.nz test between two registers
• Fix x86.nz segment override on memory operands
• Fix x86.nz xadd operand sizes, REX and memory destinations
• Fix x86.nz memory offset sign when a negative immediate follows
• Fix x86.nz mov of an immediate to memory
• Fix gb asm jp [hl] and uppercase hl operand
• Support more gb ld asm forms and math in operands
• Rewrite .equ substitution in a single pass
• Fix z80 labels, indexed operands and disasm branch targets
• Assemble data directives that reference labels and symbols
• Fix disp32 for jmp/call on x86nz assembler
• Fix signed opcode shifts in the PowerPC assembler
• Fix signed shifts in ARM64 arithmetic assembly
• Add the lock prefix to the x86.nz
• Assemble uxtb and uxth in the arm64 assembler
• Fix avr assembler for io addresses and predecrement pointers
• Fix rasm2 block comments spanning statements dropping all later code

bin

• Fix Java class calling conventions broken by the io.va=false lookup
• Keep dex, CIL and wasm calling conventions under -B
• Fix import signature resolution and prepare target types
• Add a sig column to ii, and a sig field to iij
• Fix PE/NE ordinal lookup path traversal
• Fix slow loading and excessive memory use on Wii REL files with shared relocation tables
• Fix excessive memory use when opening .NET files with shared method bodies
• Fix quadratic memory use loading crafted java classes
• Fix excessive memory use when opening files with cyclic or shared C++ exception tables
• Fix excessive memory use when opening ELF files with aliased GResource sections
• Fix excessive memory use when opening PE64 files with shared exception tables
• Bound COFF relocation tables by the file size
• Bound the sep64 app slices copied at load time
• Reject pyc marshal lengths past the end of the file
• Cap .NET metadata names at 512 chars
• Bound CoreSymbolication line info allocation and fix addrline dedup
• Use malloc:// for the sparse ordinal tests and cover imports
• Fix #27281 - Size phdr symbol lookup by the highest dynsym ordinal
• Bound DWARF attribute values per unit by its size to stop zero-size form blowups
• Reject PDB DBI module_size larger than the stream before allocating it
• Stop dropping ELF section relocs after the dynamic pass
• Fix #19873 - Detect MZ executables shorter than 0x3e bytes
• Do not index cfstring copies so records cannot chain cstr. prefixes
• Never scan more data section bytes than the file holds when loading strings
• Bound pyc dotted code object names to avoid quadratic memory use
• Share pyc marshal objects through TYPE_REF instead of deep-copying them
• Cap cfront back reference expansion in the xlc, gnu-v2 and armabi demanglers
• Fail msvc nested names with 0 instead of a partial length to avoid exponential demangling
• Treat MIPS small-common symbols as common in ELF relocs
• Bound C++ demangler output so nested substitutions cannot hang the loader
• Bound DEX class members to size/2 so shared class data cannot multiply load work
• Limit the DEX constpool Cd format to the string and type id tables
• Tag DEX static fields as FIELD symbols so aa does not analyze them as code
• Build RBinFilterSym once and update dups in place (20% speedup)
• Use HtUU instead of sdb for dex methods 5% speedup
• Presize the class methods to avoid rehashing 15% speedup
• Stop rebuilding the shared sections vec from ELF and Mach-O getters
• Fix memory leaks on failed allocations and reads in mach0 and symbols
• Fix leak and section size clobbering in ELF parsing
• Fix upgrade test fixtures and skip oversized DWARF inflation
• Read DEX files once and verify the checksum once per load
• Test word-aligned Thumb bl to blx and tidy attribute parsing
• Use blx and the long bl range only when the ARM arch has them
• Don't patch Thumb branches to ARM functions into bad jumps
• Fix invalid bit hints on some arm/thumb binaries
• Bound DEX proto parameter lists and signature length
• Bound dmp64 bitmap dumps by the dump size
• Percent-encode the PDB name in symbol server URLs and disable curl globbing
• Escape Java Utf8 constants once and share attribute names
• Copy only the Java attribute bytes instead of the rest of the file
• Fix reloc names when ELF symbols come from PT_DYNAMIC
• Store LE entries as addresses in an RVec capped at the ordinal range
• Walk LE chained fixups once per page instead of up to the header pagesize
• List s390 R_390_32 relocs in ir
• Patch riscv64 dynamic relocs when relocs are applied
• Stop Java attribute loops on rejected entries instead of retrying
• Walk NE reloc chains once per segment and cap relocs by file size
• Don't count repeated prelink sections in the kernelcache loader
• Check the prelink section pairs before detecting a kernelcache
• Don't detect prelink-less arm64 kernel images as kernelcaches
• Avoid quadratic OMF data block appends and symbol lookups
• Index LE import module names instead of rescanning per fixup
• Bound PEF exported symbol count by the file size
• Fix Dis loader hang on negative type pointer counts
• Fix oobread in PDB stream sizing
• Keep tls symbol offsets unbiased in irj and is under -B
• Report rebased reloc vaddr and sym_va in irj under -B
• Fix aarch64 RELATIVE import addresses doubling the link base
• Fix BE8 ARM reloc patching byte-swapping instructions
• Name the .got.r2 slots of linked ELF imports
• Stop iH printing past the two LE signature bytes
• Patch mach0 fixups with their pointer width and keep the ones at address zero
• List and apply mach0 chained fixups at their segment address
• List ppc32 DTPREL32 and TPREL32 dynamic relocs in ir
• Keep patched reloc rows at their site and list each slot once
• Size .got.r2 slots by addend range and skip unsafe patches
• Size .got.r2 slots for arm rel in-place import addends
• Keep import addends inside their own .got.r2 slot
• Fix Game Boy ROM bank sizes and memory regions
• Fix verneed path leak in iV for ELF files without version needs
• Mark visited __chain_starts fixups and only take DYLD_CHAINED_PTR_ARM64E_KERNEL
• Walk __chain_starts heads as a flat list and honor reserved1
• Rebase __chain_starts pointer chains in arm64e firmware images
• Read DT_ANDROID_RELR tables from the dynamic tags
• Fix aarch64_be PLT import addresses in section-less BTI files
• Fix afc picking symbols from the wrong bin file
• List R_390_64 relocs in s390 ELF binaries
• Fix BPF ELF call and data relocation addresses
• Set the Thumb bit in Thumb movw relocs to Thumb functions
• Prefer linkage names for Rust DWARF and fix Mach-O main detection
• Fix double free of the name list in the msvc demangler
• Fix leaks in the msvc demangler and iD
• Stop dropping AArch64 PREL64 and MOVW_UABS relocs
• Avoid repeated byte hashing of long binary symbol names
• Drop link base from AArch64 PREL16/PREL32 reloc listing
• Fix #27096 - Do not sort a wasm section vector that failed to parse or is empty
• Fix dex header fields read before skipping the signature
• Fix repeated ELF parsing and accept empty symbol tables
• List relocs from every CREL section, not just the first
• Fix rabin2 demangle trylib env var and type output
• Add function parameters to DWARF type analysis
• Add Swift field offset regression coverage
• Fix Swift class parsing and handle zero field offsets
• Write the DEX adler32 checksum little-endian in fix-dex
• Avoid duplicate work when loading and listing symbols
• Fix ARM MOVT REL addends to read imm16 as signed
• Keep lua header symbols across rebases
• Fix #15449 - Rabin2 ELF section resize and permission patching
• Fix quadratic swift symbol attribution on deeply nested names
• Flatten PDB leaves to remove type punning in the TPI parser
• Simplify Plan 9 history lookup without allocations
• Resolve chained Q backrefs iteratively in the D demangler
• Fix objc list-of-lists decoding on big-endian hosts
• Fix several memory explosion bugs in the ELF parser
• Keep x32 and ILP32 address relocs 4 bytes wide
• Skip the PE export address table slots that hold 0
• Exclude globals from .got.r2 section
• State a fat Mach-O slice's entry header field at its file offset
• Place Android imports with a GOT slot too on their PLT entries
• Keep absolute ELF symbol values unshifted in symbol listings
• Give the Mach-O entrypoint header field its virtual address
• Report the ELF entrypoint stated over a NOBITS .text
• Keep DWARF attributes in one vector per unit, not one per die
• Reject failed reads of Mach-O constructor pointer tables
• Translate Mach-O constructor targets to physical file offsets
• Fix CFString file offsets and ignore incomplete records
• Report Mach-O resource file offsets and preserve slice reads
• Handle empty section dumps without reading slice buffers
• Use Mach-O segment file sizes for hashes and extraction
• Fix #26976 - Use file offsets for fat Mach-O sections
• Inline r_bin_dwarf_find_die so libr_anal needs no r_bin symbol
• Drop the DWARF die table and walk debug_info once per load
• Fix overlapping mach0 import slots on 16-bit Thumb binaries
• Show the Mach-O section header flags in iS
• Fix native ARM64 Mach-O slice selection and identify X1 subtypes
• Place x86 imports on their .plt.got stubs
• Point ELF reloc listings at absolute and common symbol values
• Create valid PE32 and PE32+ binaries
• Expose ELF core register note sections
• Fix indexed and rebased DWARF global locations
• Fix Mach-O data symbol classification
• Stop symbol-less and TLS ELF relocs taking .got.r2 slots
• Move bin plugin listing into core and reuse plugin metadata
• Point relocs against ELF common symbols at a shared slot
• Keep absolute ELF symbol values unshifted in applied relocs
• Detect, warn and block when x86-64 relocs overflow
• Show the real target of REL and RELR relative relocs
• Test and document rabin2 library injection
• Add ELF dependency injection to rabin2
• Split dwarf.c into per-section files under format/dwarf
• Move dwarf.c into libr/bin/format/dwarf
• Only read ELF compression headers from ELF DWARF sections
• Look up DWARF abbrevs through one abbrev_find helper
• Prefix the dwarf.c helpers shared by the coming split
• Add CLu compilation-unit listings and CLt source trees
• Introduce -e bin.inmem=true and use it in ELF
• RBinListPlugins moved into CoreList
• Fix Mach-O rebasing without a selected I/O descriptor
• Fix slow exception type lookups when loading large binaries
• Give DWARF args their entry location, keep units with bad bases
• Read DWARF 5 loclists on demand, bounded by their contribution
• Read DWARF 5 .debug_loclists for variable locations
• Add the finally kind for SEH and CLR termination handlers

build

• Update Capstone v5 and next subprojects
• Add VC4 XPS adapter for ARM64 UEFI images
• Add uefi-arm64 in ci and ship the vc4 plugin with it
• Support the older gnu-efi aarch64 crt0 with an embedded PE header
• Reserve x18 on aarch64 and add an aarch64 UEFI CI build with a boot check
• Make CHAR16 16 bit with any gnu-efi in the UEFI build
• Support building the UEFI build for aarch64
• Fix Windows header conflicts and dependency warning flags
• Bypass Windows Defender
• Fix msys format warnings
• Fix C23 const-discarding strchr/strstr warnings and stop writing into const input
• Add fma to the UEFI libc shims for the F*+ esil op
• Add prj, mmc, writedwarf, gb/java asm and io.zip to build profiles
• Build panels core plugin in android, cs6, ios, jslinux, mingw, nocs, termux, vinix and wasi
• Fix arm64 immediate test with sparse capstone 6 operand enum
• Fix capstone 6 arm64 vector layouts and zext warnings
• Fix meson builds: msvc asserts and the apfs fs plugin
• Fetch anita over https and verify its sha256 in the NetBSD demo
• Fix the avr assembler build after a duplicated io operand branch
• Limit FMSTAT compatibility cases to Capstone 5
• Fix combined operation direction build warning
• Restore pinned subprojects automatically during Make builds
• Fix x86.nz loop index declaration for lint
• Fix format diagnostics rejected by strict builds
• Fix MSVC Winsock include order in the Mach-O parser
• Add printf format checks to unchecked variadic APIs
• Fix plugin builds without OpenSSL development headers
• Fix C++ format macro spacing in analysis header
• Exclude the JSLinux filesystem HTTP relay from UEFI
• Ship r2ai and decai in the jslinux builds
• Preserve object files in test/bins in make clean
• Fix the socket unit test build without network support
• Update capstone-next to d01f16f4
• Use private Java headers in Make and Meson builds
• Keep packaged WASI smoke test on the plain API variant
• Fix WASI build by excluding Unix user signal handlers
• Fix USEMESON install step without symlinks
• Android NDK compilation fixes
• Build and package the arm64 iOS SDK in CI
• Fix iOS signing and preserve Cydia install inputs
• Fix regression in bundle-relative prefix

ci

• Python 3.10 randomly crashes on Windows
• Smoke test packaged WASI API modules before upload
• Pin all the github actions

config

• Fix #6867 - Keep cfg.bigendian when asm.arch changes
• Make UTF-8 flag names opt-in with asm.flags.utf8
• Sort config nodes if any change happened since the lock

cons

• Remove r_cons_gprintf and the RIO print callback and bump ABI
• Don't leave raw mode on r_cons_readchar_timeout timeout
• Fix console input and ANSI output handling on UEFI builds
• Disable colors by default on UEFI builds
• Improve r_cons_isatty(fd) to remove thunk
• Avoid per-entry HUD filter allocations and repeated tokenization
• Remove unused HUD state and reuse prepared entry buffers
• Replace linear RGB cube lookup with direct calculation
• Avoid redundant canvas background reset replacements
• Fix HTML formatting in internal command captures
• Cache terminal raw mode and avoid copying queued input per byte
• Highlight stdint types with :))
• Fix ANSI corruption when recoloring command output
• Handle mouse wheel in RConsLess
• Consolidate str instead of ai.ascii in color themes
• Fix string highlight in all themes
• Open slides at the current source line in cfg.editor
• Fix mouse wheel scrolling in vslides
• Fix vslides cleanup and horizontal scroll
• Fit Markdown code block backgrounds to content width
• Add Markdown rendering with ~:D
• Fix mouse-wheel jitter in the internal pager
• Optimize computations with CJK and emoji (2-3x faster)
• Support unicode3 unicode width
• Fix theme selection contrast and ANSI color pairs
• Five times faster canvas rendering
• Three times faster grep experience
• Fix internal editor data loss and line navigation
• Fix pager search hangs, highlighting and navigation
• Fix pager for files with long lines and ansi chars
• Avoid undefined pointer comparison in RConsWrite
• Fix markdown code block wrapping and backgrounds
• Add bulk actions to the outdated plugin prompt
• Reduce 98% of line render calls in graph viewports
• Stream canvas rows into the console buffer on flush
• Store canvas cell colors in compact pages
• Canvas resize reuses rows for performance
• Fix sign overflow issue with large canvas

core

• Make RCoreLogCallback return void
• Fix ar printing of 512-bit registers like zmm0
• Keep bool config values as true after int restore

crash

• Fix DEX string table count wraparound on huge inputs
• Fix buffer under-reads on empty macro, search and att2intel input
• Fix under-read and duplicated text in asm parsing
• Preserve arguments and bypass cmd.exe for r2pm -r executables
• Reject unsafe r2 command substitutions and type formats
• Fix archive member names being reopened as URIs
• Fix temporary-directory plugin loading when HOME is unset
• Fix sandboxed HTTP clients stopping the server via =l-
• Fix excessive memory use when opening PE VERSION resources
• Gate @p, @dp and @@t behind the sandbox
• Fix ELF extended section numbering
• Fix excessive memory use when opening PEF files
• Fix excessive memory use when opening ELF exception tables
• Prevent CRLF injection in debuginfo download URLs
• Bound 9P directory listing memory
• Fix oobreads, bound imports and allocation checks for PE
• Dont exhaust memory parsing .NET signatures
• Harden PDB page validation and simplify parsing
• Validate PDB DBI sections and module records
• Fix null deref crash when parsing unnamed pdb globals
• Apply synced T= comment events through the meta API instead of running them as commands
• Don't overflow the bit buffer printing Cd data in binary
• Fix out-of-bounds reads of unterminated SFS object names
• Fix stack out-of-bounds read in the HFS catalog key compare
• Validate GNU v2 class and template bounds with shared parsing
• Fix GNU v2 global symbol demangler overread
• Pass ExpandEnvironmentStrings its buffer size in characters
• Bound mdmp module image copies by the dump size
• Fix nested r2 quick exits terminating the parent
• Fix sandbox fork failure handling
• Fix FLIRT referenced function name overread from an empty string
• Reject oversized egg elements during recursive parsing
• Fix #27277 - Refresh shortened flag lengths in disassembly
• Fix command injection in iddlg via global symbol names
• Fix aeg crash on register aliases and vbank names
• Fix #27268 - NTFS attribute-list size rounding overflow
• Fix out-of-bounds read of the NTFS update sequence array
• Fix out-of-bounds access in wrapped seek prompt history
• Fix out-of-bounds read on level-0 relative magic offsets
• Fix SHA-2 hashing of unaligned input
• Fix unaligned string headers in the C parser
• Fix idpi crash on missing files without a loaded binary
• Fix pyc opcode table leak for unknown Python versions
• Fix stack exhaustion on cyclic PDB type references
• Fix stack exhaustion on deeply nested FLIRT signature trees
• Fix stack exhaustion on long chains of tail calls
• Fix JFS directory hang on cyclic leaf page chains
• Fix UB returning freed value from r_anal_op_reg_delta
• Write rafs2, ragg2, mmc and idpd output through the sandbox wrappers
• Bound Java nested attribute parsing depth
• Bound Lua function prototype nesting depth
• Bound the MSVC demangler nesting depth and drop its per-level copy
• Bound DWARF type chain depth and render each type once per load
• Fix command injection and avoid dupped flags from dwarf
• Fix heap out-of-bounds read of BFS file data
• Fix fs shell cat buffer oobread
• Fix null dereferences in the dis and pyc disassemblers without a loaded file
• Add the script sandbox grain and require it to run rlang scripts
• Build pseudo output in RStrBuf for the remaining strcpy/strcat plugins
• Confirm RPRJ embedded scripts execution and honor prj.sandbox
• Sandbox spp's system/pipe/include/grepline
• Validate UDF entry descriptor lengths and clamp embedded file reads
• Bound the FB file list walk to the list and fix fb leaks
• Fix out-of-bounds read in rax2 -K randomart seed
• Bound XFS extent and BMAP record counts and validate the superblock geometry
• Reject compressed DWARF sections that inflate beyond 64x and cache the failure
• Bound the kvc function pointer member search to the member
• Bound anal_graph_to by depth and visit each call site once
• Clamp mdmp list format counts to the stream size
• Judge compressed .debug_line by its inflated size in the startup guards
• Fix out-of-bounds reads in magic regex rules
• Index .NET symbols by token and typedef name instead of walking the list
• Regexp memory exhaustion
• Drop the per-append search when building zignature collision lists
• Index the Java constant pool with an RVec for O(1) lookups
• Find the free autoname suffix for stack variables in one pass
• Fix out-of-bounds read in the whitespace disassembler
• Fix out-of-bounds read of register names in the jdh8 disassembler
• Handle each ObjC method entry once in aao to stop cubic xref work
• Clamp mach0 iH load command sizes to the buffer
• Bound DWARF section strings so shared long names are not copied per reference
• Bound bplist recursion and output, check container references once
• Bound sliced qXfer reads and thread lists from gdb stubs
• Use RBuffer slices for DWARF line headers
• Detect loops in FAT cluster chains instead of hanging on open
• Fix infinite loop in RIOBank.locate when aligned candidate wraps
• Stop vtable scans at zero-filled memory and bound methods per vtable
• Drop HTTP requests whose client hangs up before the end of the headers
• Fix infinite loop in CLd at line 0xffffffff and print CL lines unsigned
• Cap ASN.1 nesting depth to stop stack overflow and quadratic parsing
• Store DWARF line include dirs in RVec instead of quadratic sdb array
• Do poll and fix socket close and overflow fds
• Fix heap overflow in rc2 encryption of unaligned input
• Check vector growth before initializing hint and dyld records
• Bound the DEX try/catch expansion to the file size
• Stop re-walking applied mach0 threaded bind chains
• Make r_str_ansi_strip linear to stop DWARF names hanging r2 on open
• Replace aaft loop member sets with a linear loop forest
• Fix infinite loop in wts via RSocketWrite
• Fix divisions by zero in io.dsc
• Fix heap over-read on NTFS resident attributes outside the MFT record
• Fix heap oobread in radiff2 -i z in lua strings with embedded nulls
• Fix heap over-read copying PDB S_PUB32_ST symbol names
• Fix heap OOBreads and infinite loops in SFS
• Fix heap over-read and wrong matches in zcn name comparison
• Fix stack over-read in iz when bin.str.debase64 decodes a string
• Fix mismatched format arguments in R_LOG calls
• Fix non-string arguments passed to %s in R_LOG calls
• Fix 32-bit crash in mips and sparc subvar passing st64 to %x
• Fix stack over-read in PE follow_offset during main detection
• Validate dyld v1 slide info toc entries against entries_count
• Reject register profile offsets and sizes that overflow int
• Fix OOB read on Java MethodHandle reference kinds out of range
• Fix heap oobread in multivalue parsing for .byte and .cfloat
• Report failed and short reads in the cached RBuffer
• Clamp IO plugin reads to the requested length
• Fix heap over-read in the html filter on escapes ending the output
• Fix asm.sub.tail and asm.sub.reg rewrites being discarded
• Fix stack over-read and decoding of wide strings in pxr
• Fix stack over-read highlighting long HUD entries without colors
• Fix heap over-read colorizing opcodes ending in $
• Fix heap over-read on DWARF function names with a non-string form
• Fix out-of-bounds read on HFS b-tree records with oversized keys
• Fix uninitialized memory disclosure on lz4 match offset 0
• Fix type confusion in .NET class superclass lists
• Fix use-after-free of the selected winkd process after continue
• Fix type confusion in /mb sizing headers with the wrong bin plugin
• Fix endless substitution heap overflow in the tms320 disassembler
• Fix uninitialized stream data in truncated minidumps
• Fix uninitialized op type for wasm br without a target scope
• Fix null deref demangling MSVC RTTI names without class keyword
• Fix 4GB allocation computing the PE authentihash of crafted files
• Fix heap overflow in pi when the block cannot grow
• Fix class command exports and preserve UTF-8 names
• Fix type confusion in the JSON zignature loader
• Fix type confusion and null derefs in the pyc disassembler
• Fix heap overflow in woe when the block is not word aligned
• Fix heap out-of-bounds write in yf without address or file
• Fix integer overflows in io_dsc slide info table sizes
• Fix heap overflows in asm.sub.tail and asm.sub.reg substitutions
• Fix heap overflow in r_anal_extract_rarg with too many callee reg vars
• Permit > 512 width terminals in mmc (fix stack overflow)
• Fix read_at error checks treating -1 as a huge size
• Reject cfloat profiles whose field sizes overflow
• Fix use-after-free of current_code_attr in the Java StackMapTable parser
• Fix integer overflow in RStrpool growth
• Fix heap overflow in r_str_trim_path on a trailing /..
• Sanitize io map names when they are set
• Encode unsafe file names in o*, ob* and projects as base64
• Reject newlines in config values, avoid e* script injection
• Fix command injection in Pebble company string
• Fix XNU thread-list deallocation in the debugger task
• Check sandbox in r_file_exists and refuse zos and kd writes
• Fix heap overflow in cons lastOutput with outputs over 2GB
• Fix size_t truncation of buffer lengths in RStrBuf, trim, grep and file_dump
• Fix UAF of cached BP/SP alias names in fcn_scan after asm.bits switches
• Fix UAF of plugin Sdb after obr by making RBinObject.kv always borrow bf->sdb
• Segfault in FcnCC when default CC is null after project reload
• Fix RTable offset truncation crash
• Fix missaligned read bug and shift overflow in xfs
• Fix zipbomb attack on io.zip
• Return the final status and body from curl POST after redirects
• Return -1 from r_sys_cmd when the sandbox blocks it
• Keep sandboxed HTTP on localhost and parse URL hosts consistently
• Never use curl or wininet for HTTP when the sandbox denies network
• Accept only real loopback addresses in the sandbox localhost check
• Disable === command in sandbox and restore stderr
• Fix heap overflow in pcJ on a one byte block
• Bound egg ifelse labels and inline functions to their tables
• Fix sm4-ecb oobread rejecting partial reads
• Fix stack overflow in pfb padding
• Grow the block for negative print lengths
• Reject po/wo numeric keys that are not 1, 2, 4 or 8 bytes
• Read the compared bytes through io instead of the block
• Run macros from a private copy of their code
• Detach inline op bytes before calling arch encoders
• Clear RBin.file when freeing the binfile it points into
• Fix FLIRT merge range wrap and truncated sig double frees
• Clamp oversized ubifs files and free the read buffer once
• Fix udf directory node ownership and name buffers
• Refuse to reset the qjs runtime while a script is running
• Keep the rtr tcp socket in the host table when reconnecting fails
• Size the aob bit-flip buffer like the instruction buffer
• Return the remote reply body as is in rtrcmd
• Make bin.prefix an owned copy and restore it after HTTP sessions
• Pint aobV byte separator fixing uaf
• Fix double free in AR close refcount
• Free the za item once when adding raw or demangled names
• Fix infinite loop parsing corrupted BFS images
• Fix io cache invalidation double free and vector reuse
• Fix UBIFS index cycles that exhaust the stack
• Fix oobread in BFS images with undersized iniodes
• Fix invalid memory read by snapshoting before updating the watcher in cw
• Clamp zignature and fingerprint masks to the buffer
• Release function bbrefs before reseting block tree
• Clamp ao mask and bytes output to the block (oobread)
• Fix type confussion in tlj/tllj commands
• Fix the p8x last row length (oobread)
• Read the wb merge byte through io instead of the block
• Bound macro labels and stop the macro on invalid labels
• Bound the ccd column padding to its buffer
• Fix bech32 muta buffers and return its output
• Fix format string vuln in io.gprobe
• Apply the Joliet conversion only to iso9660 names
• Clamp corrupt symlink sizes in xfs, hfsplus, ext2 and minix
• Bound pf arrays and field selectors by the buffer
• Fix several null derefs reachable from sandbox mode
• Fix z80 assembler oobread oobwrite bugs
• Fix register arena swap, narrow register stores and aligned arena blocks
• Always fill the buffer in physical io reads
• Clamp corrupt ReiserFS directory items and never free the root node
• Reject PPC32 thunk maps that do not fit in size_t
• Bound the sections created from LX iterated pages
• Fix format string vuln in dwarf symbols, via pifcj
• Fix stack exhaustion in c++/c++2 demanglers
• Fix 1 byte oobread in ASN.1 BIT STRING and BOOLEAN printer
• Fix out-of-bounds read on truncated winkd debug packets
• Fix UAF in jmptbl with deleted basic blocks
• Fix free(UB) crahs on truncated pdb type records
• Fix heap and stack overflows in pseudo.chip8
• Fix overflows in the v850 pseudo with long flags
• Fix stack buffer overflow in the z80 assembler db and ds directives
• Fix stack overflow in x86.nz parsing segment offsets
• Fix heap overflow and double free in .fill rasm2 directive
• Fix UAF when deleing classes with ic-
• Fix UAF and cmdinj in fs.r2, add RCoreBind.cfgSet
• Fix stack and heap overflows in the gdb client from hostile stubs
• Fix #27049 - UAF in lua53 addSections freeing the cached function name
• Walk the p9 source history iteratively in apply_history
• Fix unbounded recursion in the D demangler on chained backrefs
• Fix out-of-bounds read in p9 apply_history symbol walk
• Fix UAF in bbtree handling
• Fix oobread on reserved cr16 condition and processor register codes
• Fix out-of-bounds reads in r_hex_from_code
• Fix UAF in aaft when retyping deletes stack vars
• Add opt-in WASI host networking with sandbox enforcement
• Fix quadratic mach0 chained fixups walk with tiny pages
• Fix swift5 type loading repeating shared descriptors
• Fix swift5 metadata walk looping on sections larger than the file
• Fix objc_find_refs walking oversized objc sections forever
• Fix memory exhaustion from shared objc lists in mach0 classes
• Fix exponential mach0 export trie walk on shared nodes
• Fix cubic-time mach0 import stub resolution
• Fix 32-bit wrap in mach0 dysymtab range checks
• Fix empty DWARF abbreviation lookup
• Fix JSON symbol output for missing types
• Fix stack overread in Mach-O 64-bit data section creation
• Fix iH* command injection
• Fix out-of-bounds writes and an infinite loop in dsc slide info rebasing
• Fix memory exhaustion from kernelcache section sizes larger than the file
• Fix cubic-time kernelcache rebase on shared __thread_starts chains
• Fix infinite recursion in kernelcache IOKit vtable sizing
• Fix kernelcache plist type confusion in filter_kexts
• Fix exponential IDREF expansion in the kernelcache plist parser
• Fix unsigned short-read checks that accepted failed buffer reads
• Fix kernelcache text_ptr bounds near the EOF
• Fix kernelcache IO hook treating other files as kernelcache objects
• Fix double free of plist keys in the kernelcache dict parser
• Fix oobread in kernelcache LC_KEXT names without a terminator
• Fix 1-byte heap write in objc_type_toc on empty struct pointer types
• Fix heap overflow in dyldcache deps with R_DYLDCACHE_FILTER
• Fix UAF in the macho dsym sideloading with nested slices
• Defer user signal commands without a global core pointer
• Fix UAF in stale symbol caches after obr and ic-
• Fix UAF in mach0 chained fixups on bin reload
• Fix UAF in Macho.PatchRelocs for the current IODesc
• Fix stack overflow in the C parser with more than ten attributes
• Fix GResource decompression bomb from items sharing one value
• Fix memory exhaustion from oversized .gnu_debugdata in ELF files
• Fix ELF load hang walking Verneed and Verdef lists per versym entry
• Fix ELF load hang on repeated PT_DYNAMIC and DT_INIT_ARRAY
• Fix command injection in iV* and rabin2 -rg via ELF version names
• Fix internal pager cancellation, navigation and cleanup
• Fix agg crash on a second layout of a cyclic graph
• Fix aggg crash passing NULL to the GML printers
• Fix agt crash when the treemap canvas cannot be created
• Reject hex.cols values below 1
• Fix sl+N int overflow and missing lines cache
• Fix egg inlines recursing forever when expanded
• Fix negative width in printcode
• Fix infinite loops on cyclic XFS and HFS+ btrees
• Fix minix and ufs reads starting past the end of the file
• Fix in-process radiff2 freeing the session console
• Fix pss use-after-free by reading into a private buffer
• Fix OOB and remove unnecessary bound checks in in RCmd.cmds
• Fix use-after-free of pushed space names in fss and fs-
• Fix ppd heap over-read with lengths over 32 bits
• Fix NULL mnemonic crashes in pd when no arch plugin is loaded
• Fix NULL deref in ~?ea on empty output
• Fix NULL deref in aggb, agfb and graph.mini on empty output
• Take captured cons output with r_cons_drain instead of copying it
• Make r_cons_write alias-safe and centralize cons buffer replacement
• Fix use-after-free in non-interactive r_cons_less_str
• Fix ext2/3/4 bounds, symlink traversal and metadata escaping
• Bound cmdline in rap packages to avoid absurd allocs
• Fix SPP heap overflows and stale buffer state on reuse
• Fix flag removal after mask changes and absolute global addresses
• Fix uaf when Cr item deletes itself during pd
• Fix out-of-bounds read in the v810 bit string decoder
• Fix UAF in XFS directory walk
• Fix memory safety bugs and sandbox bypass in the tcc type parser
• Fix heap overflow and uninitialized bytes in asm data directives
• Fix heap overflow in spp lbuf_strcat on unclosed tags
• Fix heap overflow in egg data size capture
• Bound tab-completion writes to the line buffer
• Fix heap overflow in ext2 symlinks with zero or huge i_size
• Fix typedef cycle tracking during type sizing
• Fix out-of-bounds reads in b36_tonum
• Fix rafind2 crash on a regexp without slashes
• Fix DEX annotation name leaks
• Fix PEF overlapping import name leaks
• Fix empty Mach-O dylib ID leak
• Fix #26946 - Command injection in sdb listings
• Simplify Android Binary XML string handling
• Bound Android Binary XML reads to declared chunks
• Fix out-of-bounds reads in asn1_parse_header
• Fix Mach-O library injection sizing and bounds
• Fix heap out-of-bounds reads in the Android binary XML decoder
• Fix crash adding hardware watchpoints on macOS arm64 without a process
• Fix ax-$$ segfault
• Fix null deref in NE header() on truncated header
• Fix type confusion crash in PDB parsing fields

crypto

• Fix shifts of negative values in Ed25519 arithmetic
• Fix signed shifts in Blowfish block and key loading
• Fix signed shifts in AES encryption and key expansion

debug

• Return GDB monitor output through the IO system API
• Fix debugger filename precedence and PID overflow
• Guard the winkd module list walk like the process and thread walks
• Stop qnxr_pidlist on failed nto_send and bound the process walk
• Filter gdb target.xml register and flag field names to stop .dr* command injection
• Keep signed constant-register offsets in register profile JSON
• Fix software stepping on arm32 with pop returns
• Fix native macOS debugger restart and breakpoint stepping

decompiler

• Fix pdc.inline rebinding arguments from emulated call values

diff

• Fix leading blank lines in radiff2 -e -D output
• Add radiff2 -D instruction alignment regressions
• Fix #16344 - Show the file names in radiff2 -U headers
• Show every change in radiff2 -u output

disasm

• Fix #4974 - Print binary Cd data in value order
• Fix #9756 - Show Cd data as data in pdj
• Don't decode SH-4 fcnvds and fcnvsd with an odd DRn
• Fix #17381 - Decode SH-4 fsca and fsrra and tighten the ftrv pattern
• Fix asm.emu following null string pointers to address 0
• Fix v850 disassembly of 4-byte opcodes and wide immediates
• Avoid duplicate mid-instruction scans and function lookups
• Only check disassembly annotations at function starts
• Fix signed shifts when sorting SPARC opcodes
• Fix signed shifts when decoding Dalvik operands
• Simplify stm8 pseudo parser and fix empty output for operand-less instructions
• Show inline attributes in disassembly signatures
• Distinguish STM8 logical and arithmetic right shifts
• Honor flag colors in disassembly bytes and addresses
• Fix disassembly byte selection highlight overflow
• Stop the v850 subvar from writing into its const input
• Fix invalid symbol subst on archs having numerical regs
• Keep reg relative pc expressions on arm64 loads
• Fix relative flag substitution in memory operands
• Respect baddr for relocs in listings

doc

• Document packed N-bit images, rax2 -p/-P and bits://

egg

• Keep inactive bytes out of egg shellcode mangling

emu

• Stop ESIL until-runs at V850 HALT
• Fix V850 integer operations and exception contexts
• Keep v850 relative jump destinations at the CPU width
• Give v850 debug traps their own context and DIR mode
• Update v850 swap ESIL flags at the operand width
• Add v850 saturating arithmetic ESIL with sticky SAT
• Fix v850 ESIL condition flags for cmov and sasf
• Fix v850 ESIL mul order, div flags and psw restores
• Fix v850 ESIL flags, shifts, multiply and bit ops
• Use absolute ESIL destinations for Xtensa bit branches
• Add ESIL for xtensa loop instructions and registers
• Fix xtensa ESIL branches, shifts and integer ops
• Add ESIL for arm64 NEON LD2-4/ST2-4 structures and LDNP pairs
• Add ESIL for arm64 LD1 ST1 and LD1R vector structure accesses
• Fix single precision ESIL exceptional value conversion
• Fix ARM64 ESIL 64-bit vector lane writes leaving stale bits
• Fix arm64 ESIL scalar FP writes to zero upper destination bits

esil

• Fix arm64 ESIL ins to move a single vector lane
• Add arm64 ESIL vector support for CLZ CNT CLS
• Add arm64 ESIL vector support for REV REV16 REV32
• Build the arm64 smnegl and umnegl esil only with capstone 4 and 5
• Update the arm64 cmp and ccmp esil expected in tests
• Fix arm64 esil for cls, smnegl, umnegl and the V flag of 32-bit subs
• Fix x86 andn esil and add esil for the bmi and adx instructions
• Document the F*+ esil op in the manual
• Round the arm.v35 fmadd family once in ESIL too
• Round arm64 fmadd/fmsub/fnmadd/fnmsub once in ESIL
• Fix the arm32 esil flags of adds, subs, rsbs, adcs, sbcs, rscs, cmp and cmn
• Add the arm32 esil of teq
• Add esil of arm32's uxth, uxtb16, sxtb16
• Add the arm32 esil of smull, umlal, smlal and umaal
• Fix z80 DAA and CP flag updates in ESIL
• Avoid redundant register reads and lookups in ESIL register writes
• Run ESIL for z80 instructions and expose the missing registers
• Add the arm32 esil of rbit, sbfx, pkhbt and pkhtb
• Fix arm64 fabs ESIL negating positive doubles
• Wrap the lea address at the address size with a 0x67 prefix
• Fix the arm32 esil of rrx shifted register operands
• Report the ESIL fault address in ae*, step diagnostics and cmd.esil.trap
• Keep the full fault address of ESIL memory faults
• Version the ESIL trap record and bump ABI to 164
• Return IEEE infinities on ESIL float overflow
• Add ARM64 ESIL for MOVI, CMHI and UMINV
• Fix ESIL signed addresses and write-only memory hooks
• Fix ESIL D2F(16) returning double bits instead of binary16
• Simplify xtensa bit test branch emulation
• Fix counted ESIL stepping to follow execution and run hooks
• Allow ESIL step callbacks to preserve hardware polling loops
• Fix Game Boy instruction encoding and ESIL flags
• Convert binary16 values in ESIL F2D
• Fix ESIL F2D on 16-bit half-precision floats
• Emulate x86 cmpxchg8b
• Fix loongarch rotr.w and rotri.w ESIL to rotate within 32 bits
• Fix the big endian half order of 128-bit ESIL peeks and ar
• Keep the condition prefix in arm32 BFC, BFI, PUSH and UDF ESIL
• Fix 8051 movc a, @A+pc reading from the current instruction
• Fix 8051 add and addc overflow flag in ESIL
• Log ESIL stack push failures as errors
• Keep the condition prefix in ARM32 SVC ESIL
• Trap when an ESIL word no longer fits on the stack
• Report native and body for every ESIL op in ae???j

fs

• Limit Rock Ridge CE hops so a self-referencing area cannot loop
• Bound the mdt tree walk by a node budget
• Bound recursive filesystem walks on self-referencing directories
• Validate BFS block and allocation group shifts on mount
• Fix filesystem reads and preserve special entry types
• Fix slurp leaving files open and returning no data
• Fix fs read buffer sizing on repeated reads
• Use the newest UBIFS master node and full 32-bit inode keys
• Fix ubifs ranged reads, oversized allocations and leaks
• Expose DWARF compilation units under r2 filesystem /cu
• Add mdt ASCII directory tree command

graph

• Scale HJKL graph scrolling with terminal dimensions
• Fix overlapped graph nodes and edges
• Avoid duplicate graph node drawing and unnecessary body crops
• Reuse graph bodies for palette and edge changes
• Speed up agraph dummy-node layout with hashed lookups
• Skip duplicate body pass on visual graph entry
• Cache agraph edge routes after layout and cull offscreen edges

http

• Fix http.sandbox bypass via GET =h* and =h--
• Apply http.referer and http.colon to POST and match the referer by prefix
• Add JSLinux guest HTTP relay transport
• Add initial jslinux networking proxy in php
• Combine URL and post data for command
• Fix idle HTTP state and background task output

io

• Reject malformed ZIP member indices and look them up directly
• Fix zip0 opening more than the first archive member
• Require ZIP member selection and suggest listing with rafs2
• Fix ZIP filesystem directory listings and test rafs2
• Fix zip sandbox bypasses and oo command injection
• Bound dsc slide info parsing by the cache file size
• Fix ihex write-back, overlapping records and record validation
• Fix #14439 - Don't rewrite the last ihex record at the segment base on EOF
• Add the bits:// io plugin to access packed N-bit images
• Read and write files positionally and track seeks in memory
• Fix stale redo history after a deduplicated seek
• Fix seek undo and redo address handling with IO maps
• Fix writes over applied relocs not reaching the file
• Sandbox blocks r2k, ebpf and shm IO plugins
• Add build-time network disable and unify WASM HTTP callback
• Replace WASI sockets with optional HTTP GET and POST
• Encode r2pipe IO addresses as uint64 hexadecimal strings
• Parse quoted onn paths and open descriptors without temporary maps
• Fix r2pipe IO offsets, reply parsing and short reads
• Keep the end of the file when inserting bytes with r+
• Add wildcard nibble support to wx (like we did for /x)

lang

• Fix lost QuickJS error backtraces
• Expose generic QuickJS HTTP and enable QuickJS in JSLinux

muta

• Speed up adler32 by reducing once per 5552-byte block
• Sum fletcher64 words modulo 2^32-1
• Make the elf and xorpair hashes independent of host byte order
• Print ph adler32 hexpairs in the same order as rahash2
• Fix ssdeep digests to match the reference ssdeep tool

optimization

• Speed up single-character list splits under ASan
• Remove repeated format checks in magic printing
• Add cached regexes for magic rules
• Add first-byte indexing for magic rules
• Speed up collision resolution and ASan list splitting

panel

• Draw only visible rows in the panels modal
• Visual panels define in a modal frame
• Add nice menu arrows for submenus instead of ellipsis
• Modal frame for the vmark seek action
• Add fstree and compile units in panels

panels

• Visual panels define in a modal frame
• Add nice menu arrows for submenus instead of ellipsis
• Modal frame for the vmark seek action
• Add fstree and compile units in panels

pdc

• Expand calls to functions marked inline in pdc

performance

• Faster and safer PE resource directory parsing
• Derive ihex and srec ranges from the sparse buffer chunks
• Index sparse buffer chunks in a tree
• Use arrays for PDB OMAP and section lookups
• Faster JNI prototype registration and faster type removal

print

• Enable and improve pdc optimization with explicit test settings
• Color bytes patched in the io.cache
• Escape untrusted AXML pool strings in the pFA xml output
• Add pri1u and honor hex.cols and hex.stride in pri1
• Stop showing register flags as jump targets in pd
• Clamp the p= density scaling so full blocks no longer wrap to zero
• Keep every sample in the p== column bars when the ruler squeezes them
• Add value ruler to p== column histogram
• Strip control codes from flag names shown in pd
• Fix r_str_ansi_strip leaving escapes formed by removing inner ones
• Avoid redundant terminal image color escapes
• Fix terminal image pixels and grayscale row order
• Fix wide bitfield values in pfb output
• Fix magic output escaping and empty-match diagnostics
• Add two-column write cache hexdiffs with wcx
• Beautified markdown checkboxes
• Add pmd command to render Markdown from memory
• Subtract the 1904 epoch offset in pth HFS dates
• Print signed byte values in pcv Java arrays
• Color pf hex and qword values by the memory they point to
• Highlight markdown code blocks, syntax highlight and colors
• Resolve typed call arguments correctly in pdc
• Keep apostrophes in pdc comments from hiding call hints
• Keep zero pointer call arguments as registers in pdc
• Assign recovered pdc call results to their return registers
• Render recovered pdc tail calls as returns
• Promote recovered arguments into pdc call expressions
• Preserve quoted comment punctuation in pdc
• Suppot scr.utf8 in atree

projects

• Do not open the project vcs on load when prj.vc is false
• Open the -p project after parsing the rc files to honor prj.sandbox
• Fix inline attributes in project script exports
• Keep global type metadata across project reloads
• Preserve file mappings of zero-padded segments in projects

pseudo

• Optionally fold computed values in pdc
• Render unconditional self loops in pdc as while (true)

r2pm

• Fix broken Windows hooks and uninstall with spaces in path
• Sort the r2pm -l and -s listings
• Fallback to binary releases and reject unsupported Windows packages
• Keep quoted r2 and editor commands intact under cmd.exe in r2pm
• Install r2pm dependencies globally and stop when one fails
• Detect r2pm archive databases by their commit stamp instead of a missing .git
• Fail r2pm source installs when no R2PM_GIT repository can be cloned
• Fail r2pm source installs when updating the git checkout fails
• Download the r2pm database as a zip archive when git is not available
• Dont inject heuristic failure checks on batch scripts
• Report failures when updating the database and respect R2PM_OFFLINE
• Extract r2pm zip tarballs with tar or powershell when unzip is missing
• Use Scripts instead of bin for the r2pm python venv on Windows
• Stop Windows r2pm batch scripts on the first failing command
• Run Windows r2pm scripts line by line
• Upgrade all registered r2pm packages and keep their global/binary flags
• Share r2pm source directory setup and avoid null escaping
• Only cd into Windows package checkouts when they exist
• Stop Windows source installs after a failed command
• Register successful Windows source installs in r2pm
• Add R2PM_VERSION_MAP and simplify r2pm pkg parsing (heredoc, quoted, newline..)

r2r

• Fix interactive handling of assembly tests in r2r

refactor

• Vibecoded: Remove dead code from esil_trace and the unreachable dte command family

reg

• Fix 4bit register read and write
• Fix writes to 128 and 256-bit registers being dropped
• Fix reads of 128 and 256-bit registers returning 0
• Name the 32-bit x86 xmm[5,6] [h,l]
• Mirror sub-byte regs on big endian so PPC XER flags alias xer

sandbox

• Require the socket grain for localhost connections and document sandbox grains

search

• Block path traversal via pm sub-databases and bound the recursion
• Fix magic continuations and reject mismatched prefixes
• Keep equally strong magic rules in file order
• Fix signed magic comparisons and LZMA detection
• Keep keyword counts unchanged when suppressing adjacent hits
• Prefilter impossible first bytes in ordered keyword searches
• Skip unaligned keyword candidates before comparing bytes
• Start /as at the first aligned address of each boundary
• Stop /as at search.maxhits and on break across every boundary

security

• Replace line breaks in r_str_arg_escape to fix cmd injection in agi*
• Gate RFile.mkstemp behind the sandbox rules

shell

• Fix command injection via tab completion
• Create the '> -' cfg.editor scratch file privately and remove it
• Fix startup interactivity detection for redirected streams
• Require Return for outdated plugin actions
• Keep scr.interactive for -q when running in a terminal
• Fix in-session -V to match CLI library versions
• Fix whitespace trimming before temporary seek modifiers
• Internalize rafind2 with streaming search output
• Fix whitespace trimming in wao commands
• Internalize rahash2
• Internalize rabin2 into the core
• Fix izzzqj command to list quiet strings instead of assert
• Look up relative cd directories in CDPATH
• Skip redundant heading single quotes on command calls
• Run rabin2 dlopen in the child and wait in the parent
• Restore caller interactivity after internal rabin2
• Preserve the caller directory stack in internal rabin2
• Internalize rabin2 into the core cmd
• Fix autocompletion in 'cat -m'
• Run ragg2 internally through the console
• Improve manpage reader (man2md)
• Report noninteractive input requests as command failures
• Fix command status propagation and r2pipe2 JSON replies
• RMainRasm2 is now called internally instead of spawn
• Dispatch all the mains in an unified way
• Reload plugins after rebuilding them

signatures

• Find the next exported FLIRT function once per module walk
• Size FLIRT function names to their length instead of 1 KB each

test

• Add memory-source imul tests for x86-64 esil
• Test distinct nonzero chunks of a 512-bit register
• Add little-endian aarch64 BTI multi-import plt test
• Fix r2r reliability and limit macOS test contention
• Add arm64 MOVW_UABS and unsupported MOVW_SABS reloc test
• Pin single rounding in every arm64 fused multiply-add test row
• Test Thumb movw against an ARM-mode function target
• Add an asm bench for .equ substitution and source splitting
• Add rasm2 tests for the .cfloat profiles and truncated args
• Add unit tests for ESIL trap records
• Add malformed-size and boundary tests for DT_ANDROID_RELR
• Test pc-relative ldrd with two nonzero literal words
• Add Thumb2 negative-offset pc-relative load refptr tests
• Test afbi outputs and cases for java tableswitch
• Test DT_ANDROID_RELR slots under a nonzero load bias
• Update ARM64 ELF frame variable expectations
• Update Thumb stack width expectation
• Test arm16 swift cc selection, afcr and preserve set
• Pin zydis sar on registers and qword memory
• Add MIPS addi, dadd and daddi overflow trap tests
• Fix regression expectations and skip unused .NET signatures
• Pin both arch and bits on the fat Mach-O slice tests
• Update syscall convention and disassembly color goldens
• Add 32-bit mips clz and clo esil tests
• Remove socket readiness tests from poll change
• Add pdc test for a structured MIPS self loop
• Update regressions for section-aware analysis and wide strings
• Refresh MIPS signature indexes after profile expansion
• Add ESIL stack exhaustion tests for non-numeric words
• Add 16/32-bit Intel and AT&T rotate memory access tests
• Add dalvik shr-long/2addr and overlapping register ESIL test
• Test both arms of arm64 csneg ESIL execution
• Skip variable recovery in structural analysis tests
• Skip variable analysis in the tests that only check function names
• Mark failing r2pm version and metadata tests as broken
• Fix padded global structure size expectations
• Update Mach-O open tests for segment file sizes
• Keep Swift role propagation tests independent of constants
• Explain why the -B common slot case lists two addresses
• Account for the recovered Dalvik branch xref
• Refresh expectations for global flags and Mach-O symbol classification

tests

• Fix r2r reliability and limit macOS test contention

tools

• Run program= in rarun2 on Windows instead of silently doing nothing
• Add rax2 -p and -P to pack and unpack N-bit streams
• Fix rasm2 -E assembling hex input that starts with a letter
• Print rax2 Fx floats with enough digits to round-trip
• Make rax2 -w read values in the width that holds them
• Bound rahash2 -B blocks by -t and stop on failed reads
• Stop rahash2 -t from hashing past the end of the file
• Fix rahash2 crash on empty stdin in release builds
• Apply rahash2 -f/-t to every file, not just the first
• Read rafind2 hit context only when output needs it
• Apply resizing replacements in descending address order
• Report adjacent hits in rafind2 like / does
• Hash empty files in rahash2 instead of failing
• Fix stale R2CONS crash with a mycons init add reproducers
• Fix rasm2 -x word endianness, line breaks and tail read
• Fix #21190 - Support C-style hex escapes in rax2 -s input
• Convert every line rax2 reads from stdin
• Fix rahash2 -J printing nothing when hashing files
• Print the entropy value in rahash2 quiet, json and -r modes
• Fix #11735 - Show the right segment:offset in rax2 -r and rax2 -j
• Honor rax2 negative numbers (instead of be taken as flags)

types

• Fix comments and literals splitting c2 parameter lists
• Fix exponential sizing and member lookup of nested empty aggregates
• Report sandbox-denied type imports as command failures
• Report type import and lookup errors through command status
• Fix function-pointer member signatures and union offsets
• Preserve canonical aggregate member offsets in type output
• Record Darwin type offsets for the selected word size

util

• Fix temporary paths with trailing directory separators
• Add r_mem_{get,set,pack,unpack}_bits for non-octet units
• Honour PATHEXT when looking up programs in PATH on Windows
• Don't truncate long commands in r_sys_cmdf and r_sys_cmd_strf
• Don't escape ! in r_str_escape_sh on Unix
• Share string crop logic and avoid UTF-8 character suffix scans
• Stop pseudo from collapsing spaces in unmatched instructions
• Stop advancing a null pointer in numeric conditions
• Compare full key lengths in direct table lookups
• Keep short-key updates and empty alias setup cheap
• Speed up short hashes and flag, alias and ESIL lookups
• Fix log.ts never printing the timestamp
• Keep string pool indexing consistent after allocation failure
• Avoid duplicate slots and unused string pool indexes
• Index RStrpool with a compact tagged hash instead of a linear scan
• Simplify class export filtering and compact UTF-8 names in one pass
• Optimize ANSI cropping (2-14x faster)
• Fix stdin deadlock in r_sys_cmd_str_full_w32
• Check the previous add first in RStrpool
• Add reusable ASCII tree rendering API
• Support recursive memory refs in rnum

visual

• Fix disassembly scrolling after invalid instructions
• Fix offset prompt skipping the final redo seek
• Fix graph node navigation missing seek undo history
• Reduce canvas background fill allocations
• Avoid redundant visual variable scans and frame captures
• Reduce panel rendering copies and repeated writes
• Avoid repeated alignment when scrolling disassembly up
• Select panel modal entries by row instead of parsing canvas
• Avoid redundant block reads when scrolling disassembly
• Avoid resizing unchanged panel canvases
• Avoid rerunning clean panel commands on every frame
• Fix address selection in panels cursor mode
• Batch visual output writes and remove unused scr.slow setting
• Animate slide navigation with scr.demo
• Add a full-width slide progress bar
• Add document-wide search and match navigation to vslides
• Move mmc into a core plugin
• Add bgcolor, blocky and utfmt fonts in vslides
• Fix slide page scrolling and resize redraws
• Fix panels canvas size when switching between graph+disasm
• Swap vm/vM keys to match with Vm
• Add scrolling to visual mark selectors

webui

• Update bundled web interfaces
• Update tiled webui from radare2-webui

windows

• Fix stale subprojects, delete plugins with wrong abi on windows