radare2

Release Notes

Codename: "Febrer Deams" Version: 6.2.0 Previous: 6.1.8 AbiDiff: 110-132 (22) Commits: 503 Contributors: 25

curl -Ls https://github.com/radareorg/radare2/releases/download/6.2.0/radare2-6.2.0.tar.xz | tar xJv
radare2-6.2.0/sys/install.sh

Highlights

Authors

AGhebrea Abhi Anton Bolshakov Claude Evgeny Kolmakov Hissssst MiKi Mohammed Hassan Mohammed Hassan OrbisAI Security ProMix Ricardo J. Rodríguez ada-l0velace arhwx dependabot[bot] gogolovefish neil nnguyen609 pancake pancake pancake phix33 phix33 potato ryawa

Changes

abi

• Pahole more structs to drop gaps and reduce struct size
• Make RCons authoritative for command help rendering
• Unify the struct and union member model into RAnalTypeMember
• Use BE bool flag (instead of int le) for utf16->utf8

anal

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Name the stack canary from a register write index instead of trace position
• Fix cc stack arg slot offsets and bound the argslot scans
• Fix the double return-address skip in the callargs stack walk
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Keep fail-only fallthrough edges in the function graph
• Fix arm64 =SN syscall register alias to follow asm.os
• Use stateful decoding in the /r, aea and aespc linear sweeps
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Unify struct and union field picking and simplify the const retype in aaft
• Propagate callee types into struct and union fields during aaft behind types.fields
• Add anal.gpseed to seed a PIC base register during ESIL analysis
• Use r_anal_block_successor_addrs_foreach to build the function graph
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument access patterns (afts)
• Better call clobbered register detection for arm64
• Honor calling convention clobbers in ESIL analysis
• Add r_anal_cc_isclobber API
• Emulate bbs in CFG order for the type matcher
• Add callconv for all archs (updates clobber and preserve info)
• Fix pdb/dwarf union parsing to fill the union member vec
• Add clobber and preserve register for ppc and arm callconv
• Dont pick ppc TOC pointers as function argument registers
• Mark variadic libc functions properly and fix caller arg over-recovery
• Restore arm32 AAPCS register args r0-r3 in calling convention

analysis

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument access patterns (afts)
• Better call clobbered register detection for arm64
• Honor calling convention clobbers in ESIL analysis
• Add r_anal_cc_isclobber API
• Emulate bbs in CFG order for the type matcher
• Add callconv for all archs (updates clobber and preserve info)
• Add clobber and preserve register for ppc and arm callconv
• Dont pick ppc TOC pointers as function argument registers
• Mark variadic libc functions properly and fix caller arg over-recovery
• Restore arm32 AAPCS register args r0-r3 in calling convention

api

• Use the formatted sdb setters
• Use the new formatted SDB getters -200LOC

arch

• Fix opcode decoding and endian selection in the ppc.gnu plugin
• Pseudo for ppc ctr branch
• Add the missing operand count to the PowerPC lfiwax pseudo rule
• Keep every operand in the mips and sparc pseudo fallbacks
• Widen the PowerPC word rotate masks to the full ISA MASK
• Simplify the cr0 and trap helpers in the PowerPC pseudo filter
• Decode hex trap conditions and the folded unconditional trap forms
• Fix the rldicr rotate mask being taken from the rldic rule
• Dispatch the PowerPC pseudo fixups by mnemonic instead of table position
• Keep every operand when no PowerPC pseudo rule matches
• Add the missing isel rule to the PowerPC pseudo table
• Fix PowerPC bclrl link register handling
• Support the capstone v6 PowerPC operand and branch predicate model
• Write LR on the linking conditional branch-to-ctr forms even when not taken
• Workaround ppc.cs UB bug causing random esil test fail (capstone followup)
• Fix x86 rip-relative ptr for zero-displacement destination operands
• Fix PPC mfspr/mtspr decoding, stwu/stdu stack detection and vle archinfo
• Type arm64 flag-setting adds/adcs/subs/ands/bics in ESIL analysis
• Remove capstone v3 support, capstone 4 is the minimum
• Fix the v35 plugin build and stop typing valid arm64 instructions as ILL
• Fix MIPS conditional branch-and-link (bgezal/bltzal) jump target
• Fix arm.gnu Thumb branch and svc/udf imms
• Gate PPC toc_map TOC with RArchOpMask.STATEFUL and wire it into aar
• Early error handling when arch is not initialized
• Fix PPC conditional lr/ctr branch aliases incorrectly decoded as jmp2zero
• Add RArchOpMask.STATEFUL and RArchSession.reset
• Invalidate the toc_map base register on PPC update-form loads and stores
• Invalidate the cached t9 call target on untracked writes and drop the mips.gnu decoder state
• Accept MIPS ISA CPU names

bin

• Fix signed underflow case for ppc elf imports
• Preserve PE section names when COFF strings are unavailable
• Strictier coff magic check
• Gate the ppc64 opd and glink logic by ELF ABI and fix the ELFv2 stub stride
• Fix out-of-bounds read on the SOM dynamic loader string table
• Fix uninitialized .NET stream sizes
• Pack bin vector element structs
• Better DEX header and string validation with less code
• Reject malformed DEX headers before string parsing
• Add v128, ref and reftype support for wasm
• Initial implementation of the rust v0 demangler
• Implement iuo command to open resoUrces inline
• The old iU is now under iu, same goes for rabin2 -u
• Move the rabin2 -u feature into an env var
• Some binfiles require custom resource retrievals
• Add raw resource extraction controls
• Add iU, table output and handle invalid subcommands
• Add support for encoded resources and extraction
• List demangler plugins as part of rbin
• Make RBin demanglers pluggable and selectable
• Handle macho resources on 64bit fat slices too
• Add support for GLib Resources inside ELF files
• Expose macho code signature and certificate as resources
• Add dir.binsdb (from binpath/dirprefix) for PE/MDMP ordinal lookups
• Parse and expose PE/CLR Resources
• Add OS/2 LE/LX resource support
• Add ix command for extract sections, segments and resources
• Rename iR to iU and add iUx extraction
• Implement resource extraction api wired to rabin2
• Fix leak and harden the Java parser to not parse too much garbage
• Better QNX header check
• List and extract QNX LMF resources
• Add resources support for the Pebble
• Expose PE resources from mdmp
• Extract resources with rabin2 -xU
• List resource metadata and paddr
• Deprecate the old sdb metadata for resources
• Preserve generated NE entry symbols (bin.unnamed=false)
• Honor 32bit NE absolute addressing for > 64k tables
• Reject invalid NE resource shifts
• Expose and harden NE binary resources
• Use the generic resource API for iR commands
• Expose PE resources through the generic API
• Add generic binary resource API
• Fix #23827 - oba not loading bin info from fat macho headers
• Add error if pdb7 root size negative or zero
• Fix PE version string parsing on big-endian hosts
• Utf16 strings in minidumps are always little endian
• Fix infinite loop in the NE fixup parser
• RBinPluginAny is now "null" for consistency and no longer uses LibMagic
• Decode PEF relocs lazily, add more bounds and overflow checks
• Fix AArch64 ELF relocation patching
• Stop parsing invalid PE import libraries
• Fix PE library import deduplication slowdown
• Fix warnings parsing zero-sized PE import directories
• Only do the right PE msvcseh checks for given arch/bits
• Fix bits in arm64 PE
• Name defined dynsym GOT slots in section-less ELFs
• Name global GOT slots to resolve relative GOT loads in mips.gp

build

• Add MiKNix platform support
• Fix #26312 - Compile against zydis 4.1 ... 5dev
• Improve jslinux build times, linking only the r2blob
• Add docker for dist/jslinux to compile on macOS
• Add dist/jslinux using temu/rv64
• Dont force x86.pseudo on single-arch-non-intel
• Build fixes for empty muta, egg, fs plugin lists
• Fixes for Windows XP
• Add libandroid-spawn to Termux package installation
• Select CS_ROOT after including config-user.mk so configure --with-capstone-next takes effect
• • Add android-sdk script for multiabi toolchain
• Fix #24090 - Android ARM64 static compilation
• Autodetect NDK from Android Studio in sys/android-*.sh
• Use an alternative windows ci action with newer deps
• Ignore the test_anal_types unit test binary
• Silence nullability extension warnings with GCC

ci

• Publish Android SDK in releases
• Specify ref to checkout testbins
• Dont build for filc in PRs

cons

• Use sorted RVec to store themes
• Update statically compiled color themes
• Detect terminal capabilities with COLORTERM
• Isolate new task command handlers with child consoles
• Isolate consoles and share console state in ctx cloning
• Fix edge cases of the sort comparator
• Make case-insensitive grep modifiers stage-local
• Fix chained grep range and column stage ordering
• Fixed multi-digit $:NN parsing
• Fix sort and uniq grep counts
• Fix ?. after filtered output
• XML formatting leaves a stale buffer capacity
• Expose cancel and failure states for RConsEditor
• Fix editor line-list ownership
• Remove global RConsEditor state
• Fix TAB help prompt redraw

core

• Route task output through parsed command contexts
• Keep task identity local to command execution
• Fix windows build (strset is declared in mingw and msvc string.h)
• Structure only natural loops in the pdc region AST
• Select core.pseudo in all plugin profiles that keep pdc
• Build a region AST for pdc with a pdct debug dump
• Move the pdc pseudo decompiler into a core plugin
• Fix #26245 - Handle waitpid failures in r_sys_cmd_str_full()
• Report invalid analysis subcommands

crash

• Memory exhaustion bug parsing malformed kernelcaches
• Fix #26390 - Bound HFS+ btree records and catalog names
• Fix #26390 - ASAN OOBR when namelen > 30 in hsfplus
• Fix #26374 - Stack oobread in print_insn_tic6x
• Fix oobread in ELF’s PN_XNUM
• Fix UAF in oc -;oc -
• Use dynamic base64 encoding in command callers
• Reject empty r2agent HTTP auth tokens
• Fix OOB reads in ropchain/pxb/ptb/px3 print commands
• Fix OOB reads in print commands and Apple cache parsers
• Fix OOB reads in dyldcache dep carving
• Fix #26343 - heap OF using _dyn variants in ?b64[-]
• Fix stack overflow, offbyone, UB and leaks in the visual mountpoint code
• Fix #26342 - stack overflow in tinycc include
• Fix pxd8 and pxu8 short-buffer reads
• Fix off-by-one in the http socket api
• Fix #26325 - NULL realname dereference in disasm flag comments
• Prevent pipe and redirect injection after escaped quotes
• Fix r2agent authentication fallthrough
• Fix 1 byte oobwrite bug in the gdbclient
• Fix heap over-read at buffer end when parsing gdb regs
• Fix oobwrite in gdb register bounds
• Fix OOM crash in the gdbserver xml register
• Fix stack exhaustion gdbserver in xi:include href=self.xml
• Fix oobread in vFile pread gdbserver responses
• Same oobread for the P register packet parsing
• Fix oobread in gdbserver p/P register handlers
• Fix oobread in gdbserver p/P register handlers
• Fix #26255 - heap overflow write in our gdb server
• Fix #26258 - punycode encoder oobread
• Refactor and harden LE/LX page decoding
• Harden LE/LX section and relocation parsing
• Validate uleb128 parsing in the DEX debug-local operands
• Fix #26240 - egg include parser buffer underflow
• Fix #26241 - null deref on dex memory exhaustion
• Fix #26243 - Handle REgg initialization failure
• Fix #26246 - fdleak when pipe(2) fails in lang_pipe_run
• Detect NE relocation chains infinite loops
• Bound NE counted string parsing
• Harden lua parser fixing many oobreads
• Fix Lua function parser OOB reads
• Fix oobread in Mach-O protocol list pointer parsing
• Fix Swift Mach-O invalid type metadata parsing
• Fix Swift Mach-O member metadata bounds check
• Fix Swift Mach-O field metadata bounds check
• Fix null+1 bug in afvt parsing
• Fix bplist Unicode string conversion
• Fix oobwrite by one (final null byte) in RStrStore
• Always null terminate utf16->utf8 strings
• Validate Mach-O LC_DATA_IN_CODE ranges
• Fix oobread when skipping subtests in softmagic match
• Fix segfault in malformed dwarf
• Fix malformed pyc refs crash and discarded ELF reloc leak
• Fix oobread in ELF PN_XNUM phdr count handling
• Validate dmp64 page counts against dump size
• Fix pyc marshal interned ASCII handling and validate code object section sizes
• Fix heap write overflow in Python loader
• Reject truncated PEF relocation tables

debug

• Fix windows build and debugstop on unix
• Implement dcut command to continue until time
• Fix getreg/setreg on wxp
• Fix ptrace requests on NetBSD
• Fix the FreeBSD build of the syscall trace mask
• Fix typo in desil exprmatchreg == handling
• Fix wrong size used in realloc
• Handle arv as a mirror of drv, to handle vector registers
• dc calls aec when cfg.debug is false
• Initialize subprocess env when not available for nix-ld

disasm

• Derive emu comment stack args from the calling convention layout
• Resolve stack-located format strings and scalar call args in emu comments
• Unify pd/pi/pdj backward walk and align the map-start window
• Harden backward disasm corner cases near file start and blocksize
• Fix #26262 - backward pdi/pdj drift when the window contains invalid instructions
• Add asm.cmt.invalid to comment invalid instructions
• Fix #26262 - pdj and pdi with negative count on aligned archs
• Expand printf-family varargs from the format string in emu call comments

esil

• Fix mips.gnu REGIMM branch targets and unconditional link
• Fix MIPS bgezal/bltzal to always write the link register
• Fix mips.gnu jal ESIL empty jump target
• Set cr0 on PPC record-form instructions and fix sraw/srawi word sign extension in ESIL
• Fix mips.gnu add/mult decode fallthrough and add missing hi/lo registers
• Fix mips signed mult high word and add srav ESIL
• Add arm64 BICS ESIL and type BIC as AND
• Fix mips.gnu slt-family ESIL dstreg and signed comparison
• Fix x86 SHL/SAL and NEG condition flags in ESIL (incl. memory destinations)
• Fix arm32 CMN flags and MOVT top-halfword replacement in ESIL
• Fix arm64 sbc ESIL carry sense and add sbcs/ngc/ngcs with NZCV flags
• Fix NZCV flags for arm64 flag-setting ops and carry-in for adc/adcs in ESIL
• Fix PPC extsb/extsh/extsw ESIL to always sign-extend into the destination
• Encode full-width compare results in the PPC cr ESIL model
• Apply the delayed branch when the delay slot op emits no ESIL
• Fix arm halfword and byte load widths in ESIL
• Fix ppc64 ld ESIL to not update the base register
• Propagate stop reason for esil debugging
• Stop ESIL continue at unmapped PC

graph

• Point switch case graph edges at the case jump target

http

• Improve the launcher webui style
• Prevent stale WebUI assets
• Fix HTTP browser launcher selection
• Update the Material WebUI from latest radare2-webui
• Empty lines in http auth file let pass any password
• Protect with auth the r2agent web sessions spawns

io

• Initial io.ebpf for Linux-x64,arm64,rv64
• Fix #26411 - oobwrite in io.gprobe
• Preserve permissions in io.xattr

lang

• Avoid null language plugin lookups

magic

• Run text magic rules after binary misses
• Fix #26164 - libfile 5.47 deprecated regex/c

port

• Add dist/netbsd to boot r2 in the browser

project

• Fix new project script for meta, hint and var
• Add 'prj list' subcommand
• Complete Ct commands and project persistence
• Lossless Ct base64/json serialization

projects

• Fix new project script for meta, hint and var
• Add 'prj list' subcommand
• Lossless Ct base64/json serialization

pseudo

• Convert only whitespace-preceded semicolons to comments in pdc
• Bring back the orphan block in pdc
• Fix zero-width pdcj annotation ranges in the pseudo decompiler
• Use strbuf padding for pdc indentation instead of a fixed buffer
• Return NULL instead of false in the dalvik pseudo parser
• Fix #26392 - oobread in asm_filter
• Initial h8300 pseudo decompilation
• Emit structured if/else in pdc
• Implement pdc* comment output

r2pm

• Add R2_LIBS with the library flags from R2_LDFLAGS

search

• Fix #26294 - Search stops on 0xffffffff data when io.cache is enabled
• Fix disassembly regex parsing and validation
• Preserve instruction boundaries across disassembly search blocks
• Apply search alignment to disassembly hit starts
• Global search.maxhits in disassembly search (not reset after each map)
• Fix multi-regex disassembly sequence search
• Make text magic scan optional with /mt

shell

• Check r2p in basename for r2pipe calls
• Cleanup dollar files apis
• Iterate command aliases directly in the hashtable
• Port echo to task-owned command contexts
• Fix #26377 - rm command silently ignoring -r and -rf flags
• Change b64: command behaviour and add b64:'
• Fix -j? and wire subcommands to js
• Accept parenthesis in temporal heading seek expressions
• Implement the heading @ syntax support
• Bring back the command substitution execution
• Improve cmd syntax test coverage and fix separator bugs
• Keep command substitution output opaque
• Support raw calls inside command substitutions
• Support literal commands after && and ||
• Normalize raw calls at command boundaries
• New CtxOnly RCmd API callbacks and add generic subcommands helpers
• Use the new cmdapi in the agD plugin
• Validate raw call addresses and faster quote strip
• Remove the deprecated double-quote raw call
• Preserve shell preprocessing and internal pipe chains
• Unify r2 and system shell command boundaries
• Support && and || command short-circuiting
• Add lazy argument slices to command contexts
• Add contexts for the new command handlers
• Keep command dispatch results structured internally
• Implement the new cmd api for trie based commands
• Make inline double quotes transparent before dispatch
• Preserve literal escapes in echo pipelines
• Fix the use of ', " and \ with lots of tests
• Prevent command injection in quoted spans
• Fix grouped grep after json format
• Fix subcommand parsing + help for z-
• Fix parsing /ad search subcommands modifiers
• Handle ed/-E errors and both behave equally
• Sync buffer length to avoid unnecessary strlens
• Respect cursor position in Tab, and autocomplete afvn varnames
• Fix exact autocomplete lookup for command arguments

sync

• Support thread conds on Windows 95/XP
• Add timeout support for r_th_cond_wait

test

• Avoid shared .tmp directory races between parallel tests
• Escape colon in count greps now that ~? honors line ranges
• Split the struct synthesis tests out of the overgrown types test file
• Add r2r test proving pdb unions survive the anal base-type path

tests

• Avoid shared .tmp directory races between parallel tests

tools

• Show -Os in 'r2 -v' for size optimized builds
• Add more vars for r2 -H
• Slurp raw stdin before converting it with rax2 -S
• Fix #24090 - Android toolchain reuse across architectures
• Centralize rcfile path construction and update -E/ed doc
• Document r2 -E flag
• Make rasm2 -L exit 0 like r2 -L and rafind2 -L

types

• Regenerate c2 golden files and test in CI
• Accept multiline function signature definitions
• Parse function pointers within function parameters
• Store variadic args as both forms
• Fix ctypes argument store for fnptr members and (void) prototypes
• Remove redundant null checks before free in the C types parser
• Expose type signedness and variadic checks in the r_type api
• Type the variable receiving the malloc'd pointer in afts
• Resolve the type matcher arg location and slot offset from one lookup
• Resolve stack arg slots via the cc argslot API in the type matcher
• Synthesize allocator return objects in afts
• Report size-function provenance in aftsj sizehints
• Cleanup the size-fn harvesting code in anal_tp
• Harvest object sizes from memset-style call sites
• Support long return types with > 64chars
• More comma based types support for structs, surviving sizeof, pf and tsc
• Support member fields with types containing commas
• Parse hex array dimensions in struct and union members
• Unify struct/union sdb serialization between the C parser and base types
• Expose and use real type size and field alignment details
• Strip wrapping quotes from the afvt type argument
• Struct redefinitions replace the saved members
• Preserve struct member array counts through the base-type sdb roundtrip

util

• Add non-recursive thread lock support for Windows
• Preserve partial stdin reads and remove dead newline code
• r_stdin_readline: correct EOF handling
• Add RSys.open(), a reusable system opener API
• Fix duplicate separators in r_file_root paths
• Fix r_num_units integer check for 80bit long doubles
• Disable log colors on legacy Windows consoles
• Implement strict vs tolerant base64 parsing modes
• Fix #26359 - out-of-range shifts and rotates in RNumMath
• Fix hex string escape decoding
• Document tolerant base64 decoding
• Initial import of the Trie data structure
• New r_sys_exepath and more portable pidpath api
• Add r_str_filter_file API for project names
• Fix #26244 - Prevent r_sys_cmd_str_full pipe hangs
• Fix dominator tree construction and add unit tests
• Add r_str_printfmt and the pfp command to map printf formats to vararg types
• Preserve callback RNum errors in math parser
• Fix math tokenizer race condition in RNum
• Add the new RStrPnlen for printable length strings
• Match unstripped function names in type guesser so afs protos resolve
• Optimize strbuf with less strlen and better weakref uses
• Format large strbuf appends in place

visual

• Implement scr.drag to click+drag to scroll in disasm/hex/graph
• Fix null dereference on prompt exit in visual find
• Fix visual disassembly scrolling across middle boundaries
• Fix disasm scroll bug over metadata
• Lock horizontal scroll in hexdump/disasm with scr.wheel.hscroll
• Fix visual disasm reverse scroll over metadata rows
• Fix visual disasm scroll stuck inside metadata

windows

• Add dist/reactos to create live web images for r2
• Fix debugger bugs for w32 (io read, attach and maps listing)
• Parse more ansi escape codes for non-vt terminals
• Disable more ansi codes on non-vt terminals
• Fix RCons.clearLine performance on legacy w32

zignatures

• anal: fix zignature drop for functions with empty-typed vars or varargs

Release Notes

Codename: "Exploit Twist" Version: 6.1.8 Previous: 6.1.6 AbiDiff: 107-110 (3) Commits: 236 Contributors: 18

curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.8/radare2-6.1.8.tar.xz | tar xJv
radare2-6.1.8/sys/install.sh

Highlights

Authors

Abhi Evgeny Kolmakov Jon Palmisciano Kevin Stubbings Lazar Aleksic Luisss003 Nitan Alexandru Marcel Ole André Vadla Ravnås ada-l0velace bdunahu dependabot[bot] pancake pancake pancake phix33 phix33 potato randomjack94dev

Changes

abi

• The sdb_remove has been deprecated as dupe for sdb_unset

analysis

• Keep duplicate single-instruction import trampolines distinct on name collision
• Autoname import call stubs after the imported function
• Don't create string metadata at addresses inside analysed functions
• Add pebble script for stub scans
• Optimize SDB key renames in analysis metadata
• Ship the syscall tables for PebbleOS
• Render array stack var element accesses as name[i] in disasm
• Shadow phantom stack vars overlaid by an array-typed variable's extent
• Optimize a:six and add more tests for it
• Fix afv mislabeling DWARF register locals as args by honoring isarg
• Fix PPC bctrl losing CALL type under capstone6 via BCCTR/BCCTRL alias ids

arch

• Harden PPC64 TOC tracking by invalidating toc_map on register clobber, call and return
• Invalidate the PPC TOC register cache on function return
• Validate asm.cpu against plugin CPU list
• Default cpu for avr is now ATxmega128a4u
• Fix PIC disassembler on big endian hosts
• More ARM big endian fixes
• Update capstone v5/next, bigendian, m68k and x64 fixes

asm

• Apply the pseudo filter only once in rasm2 and pad

bin

• Fix obf reload stacking duplicate bin objects and io maps
• Autoresolve anal.gp for ppc32 via small-data
• Handle as cyclic memory the raw string map address wraparounds
• Honor paddr in raw strings
• Fix raw string rebasing for non-VA sections
• Fix #10722 - Respect mapaddr on raw strings
• Optimize dyldcache local symbol matching
• Fix #26079 - Local symbols missing in dyldcache
• In ftab/gns1 use segment tags for proper archinfo
• Harden GNS1 loader
• Add FTAB extractor plugin
• Improve GNS1 detection to solve dyldcache false positives
• Require spaced arguments for iz+
• Fix dyldcache local symbol offset matching
• Add R_DYLDCACHE_NO_DEPS option for shallow filtering
• Auto-resolve PPC64 TOC base (anal.gp) for ET_REL and ELFv2
• Fix fuzzed PE timeout bug, clamping vsize
• Reduce false positives in the PL PEs id
• Add Rust and D demanglers
• Add new C++ demangler
• Add IBM XL demangler
• Add ARM ABI demangler
• Add ldmap.r2.js script to load sourceline from ldscript map files
• Fix more bigendian parsing bugs for PE
• Fix kernelcache parsing on bigendian
• Fix SFC parsing on big endian
• Fix big endian parsing bug for MDT
• Implement idd command
• Apply PPC64 TOC16 relocations to addis/ld immediates on ET_REL
• Clean LE endian-safe parser
• Detect ppc32 e500/e500mc cpu from .PPC.EMB.apuinfo note
• Fix memory leaks in the mdmp parser
• Fix misaligned PPC ET_REL REL24/REL14 relocation targets

build

• Fix riscv_cs capstone mode detection for all capstone versions
• Move Nix stuff into dist/nix
• switch to rev for sdb
• Bump softprops/action-gh-release from 3.0.0 to 3.0.1
• update zydis subproject url for nix
• Add Nix flake and dev shell support
• Use #ifdef CS_VERSION_PRE_RELEASE instead of CS_NEXT_VERSION version guard for riscv_cs capstone mode
• Fix subproject updates
• Meson use_sys_zydis: find library as capital "Zydis"
• Detect system zydis without pkgconfig + ppc fixes

cons

• Use RStrConstPool for RConsMark names
• Fix console context races and UAF when running background tasks
• Fix bluy theme color for swi/new instructions
• Fix #25984 - Support negative internal grep columns
• Reset terminal with RCons in a portable way

core

• Fix numvar reference math state handling

crash

• Fix HFS+ filename UTF-8 buffer sizing
• Fix null deref when RBinInfo callback is null
• Fix p= sparse map allocation crash
• Fix len multiply overflow in r_str_utf16_encode
• Fix len multiply overflow in r_str_escape_utf
• Fix len multiply overflow in escape_utf8
• Fix sz multiply overflow in r_str_escape_raw
• Fix #26047 - allocation size overflow in r_str_word_get0set
• Fix count overflow in x examine command
• Fix blocksize multiply overflow in pfb command
• Fix integer overflow in pxAv print command
• Fix signed overflow and null deref in pv print command
• Fix #26048 - integer overflow in pb
• Fix #26051 - oobread on truncated mdmp files
• Fix #26049 - cmd.load descriptor UAF in bin load
• Fix #26045 - r_str_append signed length overflow
• Fix #26044 - UAF in pde, regprofile changing inside the loop
• Fix more OOB read bugs in the java parser
• Fix #26043 - 2 byte oobread bug in RBinJava line number table parser
• Fix #26042 - Fix aos opcode count overflow
• Fix #26046 - Harden and optimie RStr.replace for irreal 2 milion length strings cases
• Fix #26035 - Oobsfaults in omba, ombd and ombg commands
• Fix more empty buffer issues in bin2strdup callers
• Fix assert with 0 length quoted strings in w

debug

• Fix cons push leak in RDebugIo reg profile
• Open self with api instead of commands in r2preload
• Fix GDB register cache bounds and ownership checks

diff

• Use RCons.printf in core/gdiff

disasm

• Support hexdump/disasm addresses in octal base
• Unify asm.addr.base10/36 into asm.addr.base
• Fix overlapped strings length using RAnalOp.ptrSize
• Apply the pseudo filter only once in the disasm pipeline
• Preserve spaces in constructed string comments

esil

• Model PPC XER.CA ESIL for add/subtract-with-carry and algebraic shift-right
• Isolate ESIL registers for type link propagation
• Use local ESIL for type link propagation
• Unify ESIL constructors behind an REsilOptions struct
• Use core ESIL step-back for dsb
• Consolidate ESIL step-back history and tests
• Report ESIL step-over stop status
• Improve stepover and more aeso tests
• Print ESIL cmd handler values in hexadecimal
• Honor esil.iotrap in core ESIL stepping
• Rewrite ESIL stepping around core single step
• Get rid of esil.verbose
• Use ESIL voyeurs to track refs
• Reload core ESIL callbacks on arch changes
• Fix PPC indexed load/store, shift/rotate/divide and sign-extend ESIL
• Add ESIL for PPC scalar floating-point load/store/arith/convert ops
• Fix floating point emulation bug on 32bit
• Fix error handling in esil poke
• Fix esil poke on big endian hosts
• Add ESIL for PPC integer/logical/rotate/mod ops and fix subfze/nor/nand
• Add ESIL for the PPC isel conditional-select instruction
• Pass ESIL instances to arch callbacks
• Use local ESIL stats for ROP classification
• Tighten core ESIL step and trap handling
• Clean up core ESIL config and interface plumbing
• Treat unreadable pin PCs as handled in core ESIL
• Fix ESIL alias voyeurs seeing updated registers
• Add core ESIL lifecycle and stepback support

fs

• Fix HFS+ catalog filename conversion
• Avoid heap allocation in HFS+ catalog key compare
• Expose addrline dwarf info in the r2 virtual filesystem
• Fix ntfs utf16 filenames on bigendian

http

• Fix prefix and www root fallbacks

io

• The dsc io plugin is not a block device
• Fix memory leak in io.self on close
• Fix windows block device identify

muta

• Fix endian bugs in the serpent

print

• Implement pFJ for JWT token decoding
• Add the CLd for source baked decompiler command
• Add RTableOptions.wrap and more markdown improvements
• Extend all p-/p= with json and better bounds
• Fix #26034 - pf beyond blocksize prints zeros

pseudo

• Simplify pdc helpers and remove redundant null checks
• Refactor pdc line emission and loop goto filtering
• Resolve pdc global folds from analysis metadata
• Recover varnames with gp relative globals for pdc signatures
• Hold asm.addr.base for pdc too
• Reset asm.addr.relto in pdc to not break pseudo disasm
• Fold resolved TOC global loads into flag names in pdc

r2r

• Fix token test terminal reset expectation

refactor

• Use r_read_ble32 in rtti_msvc

reg

• Document lowercase register roles for dyncc

search

• Use isolated ESIL VM for gadget search
• Use local ESIL in search commands
• Preserve gadget class details
• Unify gadget class storage
• Fix legacy ROP classification correctness

shell

• Add r2vsql in the fallback command handler
• Shorten alias help messages
• Fix 'join' command argument parsing

socket

• Fix PTY dynapi initialization in socket redirection

tests

• Improve and document REQUIRE in r2r
• Some tests require zydis

tools

• Fix binary number parsing in rasm2
• Rafs2 wasnt included in binr/blob

types

• Fix type lookups for long function names
• Add 'tsn' to lookup struct names by size
• Add ten command for enum lookup by numeric value
• Support union offsets in type member lookup

util

• Optimize RStrBuf.slice - 30% faster
• Render inline markdown codeblocks/spans
• Render markdown attributes in table cells
• Add table trim option with ellipsis
• Fix markdown table emoji widths
• Fix custom float roundings and endian issues

windows

• Port the r2preload thing to Windows

Release Notes

Codename: "lospatos2" Version: 6.1.6 Previous: 6.1.4 AbiDiff: 83-107 (24) Commits: 455 Contributors: 25

curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.6/radare2-6.1.6.tar.xz | tar xJv
radare2-6.1.6/sys/install.sh

Highlights

Authors

AGhebrea AGhebrea Abhi Claude Dirk Mueller Dirk Mueller Hinotobi Mattia Galuppi Michał Mnich Ole André Vadla Ravnås Priyanshu Kumar WearyTraveller42 aviciano condret davidpolverari dependabot[bot] orbisai0security pancake pancake pancake phix33 phix33 potato randomjack94dev s-zaizen

Changes

abi

• Add command file string API
• Migrate RBinSymbols from RList to RVec
• Get rid of the backward compat r_core_cmd_calls (Use r_core_call)

anal

• Rename anal.flagstop to .flagbounds and clarify diff w/ anal.flagends
• Add anal.flagstop function boundary option
• Fix PPC positive conditional branches
• Fix garbage upper bits in xref/heap table size columns (ut64 casts)
• Add and test static x86 clobber cc metadata
• Add static x86 calling convention preserve metadata
• Add static x86 calling convention stack cleanup metadata
• Improve static and indirect call convention analysis
• Improve static x86 calling convention stack cleanup
• Stabilize register index ordering
• Honor calling convention register clobbers
• Track callee-popped stack arguments
• Resolve dynamic calling conventions lazily
• Add dynamic calling convention parser
• Generalize calling convention location accessors
• Use dyncc calling convention for isvm archs
• Add tests for static calling convention multi-return
• Fix static calling convention argument lookup
• Handle two-operand imul and idiv
• Use indexed return registers in calling conventions
• Initial support for multireturn in calling conventions
• Recover ObjC inheritance in analysis classes
• Better default fcn names, respect symbols
• Extend RBinMeta for Java/Dalvik/MSIL dynamic callconvs
• Stack based dynamic calling convention fix for Java
• Support dynamic calling conventions for Java and Dalvik
• Fix switch analysis for latest DEX
• Show branch cases in afbtj
• Speed up function basic block lookup a bit
• Keep SwitchOp.dependency ops in afbt, Vc and pdc
• Reduce type propagation churn and false positives
• Simplify type propagation backtrace state
• Tighten type trace access matching
• All public var apis use RVec now
• Configurable jumptable maxcases
• Fix stale Rust jump table bounds
• Fix x86 jump table autosizing for Rust niche switches
• Refactor jump table decoding and case analysis
• Clamp switch case counts and borrow register names
• Fix afbt script output and sparse zero entries
• Redesign and extend the jump/switch table API and commands
• Rename afj to afbt and add a test
• Fix arch value handling for stack operations
• Tighten x86 stack operand analysis
• Populate Xtensa value metadata for stack analysis
• Populate RISC-V stack value metadata
• Populate MIPS value metadata for stack analysis
• Fix ARM stack variable substitution
• Populate ARM value metadata for stack analysis
• Rewrite stack variable extraction around values
• Stop using ESIL in function analysis
• Fix MIPS register argument recovery
• Fix bug in 'as command' not showing the right syscall
• • The afbc forces the address to be the first of the basic block if any
• ArenaPushPop uses CoW optimization
• Fix infinite loop in the codemeta
• Support pining functions with custom emojis
• Fix CID 1654963,1654964,1654965 - check r_esil_get_parm_strs retval in set_mem dfg
• Fix CID 1654968 - check r_esil_get_parm_strs retval in esil_dfg
• Add missing anal.plugins.pre config var

analsys

• Rename anal.flagstop to .flagbounds and clarify diff w/ anal.flagends

analysis

• Add anal.flagstop function boundary option
• Fix PPC positive conditional branches
• Add and test static x86 clobber cc metadata
• Add static x86 calling convention preserve metadata
• Add static x86 calling convention stack cleanup metadata
• Improve static and indirect call convention analysis
• Improve static x86 calling convention stack cleanup
• Stabilize register index ordering
• Honor calling convention register clobbers
• Track callee-popped stack arguments
• Resolve dynamic calling conventions lazily
• Add dynamic calling convention parser
• Generalize calling convention location accessors
• Use dyncc calling convention for isvm archs
• Add tests for static calling convention multi-return
• Fix static calling convention argument lookup
• Handle two-operand imul and idiv
• Use indexed return registers in calling conventions
• Initial support for multireturn in calling conventions
• Recover ObjC inheritance in analysis classes
• Better default fcn names, respect symbols
• Extend RBinMeta for Java/Dalvik/MSIL dynamic callconvs
• Stack based dynamic calling convention fix for Java
• Support dynamic calling conventions for Java and Dalvik
• Fix switch analysis for latest DEX
• Show branch cases in afbtj
• Keep SwitchOp.dependency ops in afbt, Vc and pdc
• Reduce type propagation churn and false positives
• Simplify type propagation backtrace state
• Tighten type trace access matching
• All public var apis use RVec now
• Configurable jumptable maxcases
• Fix stale Rust jump table bounds
• Fix x86 jump table autosizing for Rust niche switches
• Refactor jump table decoding and case analysis
• Clamp switch case counts and borrow register names
• Fix afbt script output and sparse zero entries
• Redesign and extend the jump/switch table API and commands
• Rename afj to afbt and add a test
• Fix arch value handling for stack operations
• Tighten x86 stack operand analysis
• Populate Xtensa value metadata for stack analysis
• Populate RISC-V stack value metadata
• Populate MIPS value metadata for stack analysis
• Fix ARM stack variable substitution
• Populate ARM value metadata for stack analysis
• Rewrite stack variable extraction around values
• Stop using ESIL in function analysis
• Fix MIPS register argument recovery
• Fix bug in 'as command' not showing the right syscall
• • The afbc forces the address to be the first of the basic block if any
• ArenaPushPop uses CoW optimization
• Fix infinite loop in the codemeta
• Support pining functions with custom emojis
• Fix CID 1654963,1654964,1654965 - check r_esil_get_parm_strs retval in set_mem dfg
• Fix CID 1654968 - check r_esil_get_parm_strs retval in esil_dfg
• Add missing anal.plugins.pre config var

api

• Move markdown rendering code into a separate file

arch

• Add OpType/ESIL for PPC dword shifts, X-form ld/st, cntlz, mulh, CR moves
• Fix signed/endian branch-target analysis in vax, dalvik, xap, arm.gnu and java
• Fix sparc.gnu endian disassembly
• Fix capstone v5 M68K patch application
• More BE fixes even for capstone
• m68k big endian capstone bug patch
• More arch goodies for virtual regs
• Update wasm3 support for try/mmx ops
• Fix aarch64 big endian be8
• Update capstone v5/next for the x86 perf boost
• Fix STM8 pointer offset operands and jump targets
• Add opt-in Zydis x86 arch plugin
• Optimize the cs_len_prefix_opcode helper for x86
• Add RArchInfo.WODST for archs with write-only destination operands
• Stack allocate insn to avoid malloc/free in arm.cs
• V850 ESIL: Fix flags, sign-extension, bit ops, shifts
• Fix v860 esil sign, bit ops like shifts and update flags

asm

• Cleanup ppc.nz handlers and emit_ppc comments
• Add ppc.nz r_asm encoder plugin
• Refactor r_num_math error handling in asm
• Fix memory leak in x86_nz parseOpcode error paths

bin

• Add remove class ..field/:inheritance info with ic[+-]
• Fix per-section reloc cap dropping relocs on multi-section ET_REL objects
• Fix signed-char Swift super-class and field-type parsing in mach0
• Fix iS/iSS flags column showing garbage upper bits
• Emit dynamic calling conventions from bin metadata
• Implement RBinPlugin.getCc for dotnet,java,dex,python and wasm
• Parse valid wasm sections 12 and 13 (datacount + tag)
• RBinStrings are now stored in a vector
• Speed up COFF bigobj loading
• Preallocate flag storage from cbin
• Store flag names in arena and fix DEX leaks
• Keep trimmed RBinString.length sync
• Fix objc/macho/swift parsing bugs on big endian
• Dettach reloc_fixups from load_unnamed
• Migrate RBinSection store from RList to RVec
• Invalidate addr2klassmethod when ic- removes a method
• Use RVec for Mach-O reloc fixups
• Add r_bin_class_add_method and surface class methods
• Use chained fixup page size for mach0 swizzle chunks
• Fix Coverity static analysis findings
• Avoid stale COFF relocation symbol pointers
• Fix integer overflows in dex_parse_class_method_addrline
• Add bin.meta config var to permit disabling the codemeta info
• Lazy-load DEX addrline debug info
• Extend 'ies' for Dalvik onCreate symbol entrypoints
• Skip abstract methods when listing dalvik entrypoints
• Add bin.classes.namesonly option to skip method/field parsing
• Fix macho-swift/objc metadata leaks
• Map DEX code sections after method headers
• Limit DEX_PROTO_STACK_PARAMS to 64
• Fix the MAX_DEX_PARAMS warning happening in some dex
• Fix huge macho chained fixup memory leak
• Add bin.relocs.xrefs to avoid creating them if not needed
• Parse side support for binunnamed for elf, som, dyldcache and more
• Extend bin.unnamed to other file formats
• Add RBinOptions.loadUnnamed via bin.unnamed to not load unnamed symbols
• Preserve xtr bin info when metadata is partial
• Add bin.flags to skip bin symbol flags
• Fix double free in r_bin_import_free
• Fix DWARF compilation directory metadata leak
• Guard large id* scripts, reduce dwarf memory usage more and fix ^C trap
• Warn on huge DWARF debug info loads
• Dont do drama when loading libraries without entrypoint
• Trim bin startup metadata with the help of a profiler
• Handle more PPC64 reloc types and BE-aware reloc patching
• Port the sep64 binxtr plugin to fs
• Initial refactoring of the binxtr plugins as rfs ones
• Ignore fatmacho magics in the java bin plugin
• Fix #25859 - entrypoint with overlapped elf segments
• Fix CID 1654967 - widen addr_sym_table to ut64 in load_symbols_from_phdr
• Add ii+ and ii- to add/remove imports at will
• Fixes v2p/p2v conversion for in-memory ELFs
• Handle ABS32 and GLOB_DAT relocs for arm32
• Force fallback to phdr parsing when stringtab fails in ELF
• Fix buffer size when parsing binaries from memory
• Reduce double derefs in dex for perf reasons
• Fix detection of stripped Swift machos
• Reduce double derefs in elf for perf reasons
• Parse and display DER signatures in macho (iC command)
• Expose DYLD_ENVIRONMENT, __RESTRICT and MH_APP_EXTENSION_SAFE via sdb
• Kill the hacky RABIN2_CODESIGN_VERBOSE hack using rbinoptions
• Expose macho signing type in the sdb
• Reduce double derefs i macho for perf reasons
• Support globs in the symclass patterns
• Add fortify and asan symbol names
• Refine mach0 is_pie and has_nx (heap and stack) checks

build

• Fix all warnings spotted by GCC-15. Hello Ubuntu26
• Hide otezip symbols from libr_util
• Fix the dist tarball and test it in the ci
• This slots naming is a Qt keyword conflicting with iaito

ci

• Allow Coverity Scan workflow failures
• Publish tcc r2r report in CI
• Run more tests and fix crossmbuild mipsbe
• Avoid libatomic when linking wasm r2r
• Add big endian testsuite runs
• Link Zydis in iOS blob build
• • Disable Zydis in Fil-C builds
• • Link bundled Zydis in static builds

cons

• Add R_PRINTF_CHECK to r_cons_printf and fix the format-width bugs it surfaces
• Add strikethrough support the markdown renderer
• Support italic and bold markdown
• Fix terminal mouse escape parsing

core

• Clean up line seek cache rebuild
• Expose dynamic calling convention inspection
• Double free in visual mode when highlighting string >= 32 chars
• Prompt to rebuild outdated r2pm plugins
• Report invalid dotted eval keys
• Iterate over the external plugin system once again
• Custom internal plugin reorder and unify plugin storage

crash

• Fix gdb's stop reason exec path lifetime
• Fix #25992 - Sanitize library names in il* and add obf base64:
• Use strbuf for GDB XML register profiles
• Fix #25974 - oversized GDB XML code pointer aliases
• Fix #25977 - oversized GDB register cache writes
• Fix parseCodeDirectory OOB Read
• Avoid unbounded memcpy in gdb’s handle_vFile_pread
• Fix Mach-O chained fixups starts bounds
• Fix Dalvik get_name ownership mismatch
• Dont crash when RMagic dataset is not installed
• Stabilize bin vectors before reloc creation
• Fix use-after-free when commenting in visual mode
• Fix double free in r_bin_import_free
• Fix #25918 - Fix out of bounds read in RBin.PE.getName
• Preallocating 7GB of DWARF dies makes kernels unhappy
• Fix memcpy UB with 0 and sign type for winkd
• Fix #25886 - null deref in corrupted dwarf
• Fix #25872 - null deref in r2fload
• Fix int ovf allocation macho bugs spotted by @apkunpacker
• Fix memory exhaustion on corrupted DEX
• Fix CID 1655150 - clamp num_annotations and dedupe rtv/rti helpers in shlr/java
• Fix null deref in default cc
• Fix lot of vulns in shlr/java
• Fix integer overflow in java extract_type_value
• Fix #25840 - OOB read in Java class parser and simplify ref-name building
• Fix #25835 and #25836 - UAFs in the gdb remote protocol
• Properly null-terminate readlink() buffer - fixes UB in r2pm
• Fix an offby1 in rasm2+stdin with r_str_ntrim

debug

• Enforce syscall number lookup and add more tracing tests
• Fix register response too large warning in gdb client
• Reduce DWARF debug info memory usage
• Group debugger configuration in RDebugOptions
• Add support for syscall tracing in FreeBSD
• Add Linux fasttime debugger support
• Add syscall enter and leave hooks
• Add parameter format for all syscalls
• Add checkpoint replay api and commands
• Fix dx restore
• Ignore unknown breakpoints by default and show some help
• Add missing eiz register for the x64-32 profile
• Sync cpu flags definitions in all the intel reg profiles
• Fix YMM stitching loop to iterate 8 regs for 32-bit targets
• Fix print_fpu to use runtime bits check instead of compile-time
• Add missing vec64 mm0-mm7 and vec128 xmm0-xmm7 to x64-32 regprofile
• Fix FPU st0-st7 register size from .64 to .80 in x64-32 regprofile
• Fix i386 syscall calling convention aliases in x64-32 regprofile
• Fix 4 byte oobread in ptrace_setregs for Linux-x86_64_32
• Fix #9995 and #15255 - DRX regprofile for 32 on 64-bit hosts

disasm

• Memoize the current basic block in RDisasmState
• Fix big-endian bugs in the disasm refs
• Add ahie to specify an enum type hint for imms
• Use disasm api instead of commands in pdr
• Use RVec in Reflines
• Dynamically pick the needed decoding features in the disassembler
• Display function pins in the disassembly

doc

• Document dynamic calling conventions

egg

• Refactor ppc emitter helpers; default ragg2 endian from arch
• Add REggEmit priv hooks; move ppc emitter state off file-scope statics
• Update ppc emitter for REggEmit RStrBuf migration
• Treat -c bigendian without value as truthy in ragg2
• Add PowerPC support to ragg2
• Fix #15468 - ragg2 -P/-B/-w now work on archs without an egg backend
• Add example programs and ragg2 regression tests for egg
• Rewrite the ESIL backend in ragg2/egg as an expression compiler
• Add raw-register syntax and parser cleanups in ragg2/egg

esil

• Add ESIL for ppc byte-reverse loads/stores and fix opex invalid-reg crash
• Skip op decode for hard pins in ESIL step
• Use explicit ESIL interfaces in analysis helpers
• Use explicit ESIL interfaces for aop cost
• Setup ESIL DFG instances through r_esil_setup
• Fix ESIL voyeur initialization and empty write hooks
• Add packed register sizes to ESIL interfaces
• Wire ESIL BITS through util interfaces
• Keep caller ESIL interfaces during setup
• Add explicit ESIL interfaces and voyeurs
• Heapless emulation using the new sliced strings
• Honor failed IO reads in ESIL memory callbacks
• Fix voyeur index in r_esil_mem_write
• Clamp shift amount in esil >>=[N] helper
• Fix stray stack push in esil %=[N] helper
• Fix null anal deref in pdo / r_esil_toc_new
• Unbroke 4 FPU emulation tests
• Add more esil step back tests
• Fix ESIL trace register rollback off-by-one
• Return false on oversized ESIL parser tokens

flags

• Avoid double name filtering in r_flag_set

fs

• Initial support for the plan9 Fossil FileSystem
• Add fsoptions and welcome the 9fs support

graph

• Two dimensional scrolling with urxvt events

io

• Explicit sperm listings for RIOMaps and RIORegions
• Warn when map resize is ignored due to new size being 0
• Fix zero size/resize for gzip, malloc, null and xattr

lang

• Improve error handling in r2fload qjs
• Fix all the memory leaks in the qjs plugin

magic

• Fix CRLF parsing in RMagic needed for windows

perf

• Improve RBitMap and fix some bugs
• Cache DEX prototypes to not rebuild signatures
• Use RBitmap in Dex.isClassIndexInClasses (O(n^n) => O(n))
• Cache ELF bits detection (6x faster loads)
• Use HtPP instead of Sdb and inline node shortcuts
• Use RVec and Sets in more graph places
• Use RVec instead of RList in the asciiart graph
• Use RVec.findSorted in disasm and core analysis

print

• Enjoy utf8 cursors in disasm
• Add emoji name support, and use it from aflp
• Show function/bb/flag color in aflj and afl=
• Add bbcolor/flagcolor in navbar json

projects

• Improve module id and support debugger and r2frida
• Refactor newprj into separate files
• Implement project diffing subcommand
• Save localvars, types and callconv in newprj
• Support function/bbs/colors in newprj
• Save/restore xrefs in newprj
• Honor prj.new on load
• Save eval vars in new projects
• Save flagspaces and other flag attributes in new projects
• Register prj plugin tab autocompletion
• Implement prj open to start on a clean session
• Fix a bunch of UB and logic bugs in the new projects
• Ignore symlinked notes

pseudo

• Fix pdco output
• Supress jmps when they are actually switches in pdc

r2r

• Fix dyncc tests on mipsbe
• Use posix_spawnp for r2r child processes
• Fix r2r subprocess reaping race

reg

• Consolidate vregs banks and regprofile parsing
• Dont warn regprofiles without A0
• Add virtual register banks

sandbox

• Fix #25803 - Replace execl with execlp on r_sandbox_system

search

• Rename /G to /ag and improved gadget classification
• Add gadget.esil to classify conditional branches
• ROP search it's now /G and we have rop.cond
• Improve deterministic syscall search

security

• Confine project deletion to dir.projects
• Fix cmdinj via DWARF filenames in the CL* emitters
• Fix cmdinj in agn/age emitters
• Fix cmd injection via raw type names in txg graph script
• Fix cmd injection via raw DWARF file/line in CL/CC emitter
• Fix cmd injection via raw class names in icg graph script
• Fix command injection in project's comment replay
• Fix 3 command injection bugs related to varnames
• Fix cmd injection via unsanitized DWARF arg name in afsv

shell

• Add RCons.yesNoBut and use it to permit deleting onprompt load
• Add scr.font.* and the new utf8 fonts support
• Check VISUAL first, then EDITOR when deciding cfg.editor
• Add scr.prompt.r2pm for r2pm rebuild prompts
• Swap /g and /ag - gadget vs graph
• Better spot invalid 's' subcommands
• Add cat -m to expose the markdown renderer api
• Fix repeated command parsing after semicolons
• Fix wrong relative seeks +3+1 != 9
• Add CCb basic-block comment listing
• Add CLLb basic-block source listing
• New ?(){}{} conditional syntax
• Hello miniclippy!
• Implement ls -a to list hidden files too

socket

• Expose all HTTP request headers in RSocketHTTPRequest

syscall

• Add PowerPC linux syscall definitions

tools

• Fix rasm2 show_analinfo leaks on text path
• Fix rasm2 -f - stdin skip to use the slurped length

types

• Switch c2 types parser to use the rstrs api

util

• Add PJ's api to append an rjson
• Use r_hex_from_byte in asn1_str
• Fix large regex matcher state comparison
• Remove r_snprintf and bump ABI version
• Introduce RBitSet data structure
• Implement RVec.findSorted using skiplist tricks
• Add hidden sandbox grain
• Fix #16549 - r_regex_init leaks when called on initialized RRegex
• Initial implementation of the string slice&store api

visual

• Initialize visual ESIL analysis context
• Fix unaligned ops with mouse wheel scroll

windows

• Add r_str_iendswith for case insensitive extensions

Release Notes

Codename: "CottonMouse" Version: 6.1.4 Previous: 6.1.2 AbiDiff: 77-83 (6) Commits: 340 Contributors: 20

curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.4/radare2-6.1.4.tar.xz | tar xJv
radare2-6.1.4/sys/install.sh

Highlights

Authors

0xf00sec AGhebrea Abhi Adam LaPoint Adam Satko Ahmethan G. Claude Jake Lamberson Ole André Vadla Ravnås Quentin Buathier awlapoint-afk buzzer-re condret jro-calif jwntree pancake pancake pancake phix33 potato

Changes

analysis

• Use dash for callargs modifier and support rnum expressions
• Rework aCe/aCf to support plaintext, JSON and r2 output modes
• Improve scoring strategy for the function autoname
• Fix arm64 jmptbl detection for multi-LEA dispatchers
• Fix leak, dead branch and int overflow in jmptbl code
• Fix some possible command injection analysis scripts
• Fix afv* for afvr variants
• Extend RAnalPlugin to hook preanalysis commands if elligible
• Add r_anal_xrefs_setf to avoid fcn lookups for a 3% speedup
• Better conditional return instructions support (z80, arm, nds32)
• Remove redundant zeroing in RAnalOp.init
• Refactor autoname into analysis plugin (a:autoname)
• Performance improvements in arch and analysis
• Add RAnalPlugin.thumb to scan code for mode-switch hints
• Resolve PPC64 ELFv1 TOC-relative address chains in
• Add more binary magic signatures to is_bin() in data
• Remove r_anal_archinfo in favor of r_arch_info
• Use R_ANAL_DATA_TYPE_ZERO for zero-filled data instead of INVALID
• Implement wide string length measurement in is_string()
• Import the C rewrite of the gopcintab plugin by @asherdll
• Materialize switch cases through core analysis
• Expose typed function context with params, stack slots, and base types

arch

• Fix a bunch of logic bugs for v850 esil
• Improve pseudo for nds32
• Refactor the nds32 esil cooker from O(n) to O(1)
• Support inline function calls for NDS32 via ESIL
• Cache capstone options in x86/arm/mips arch plugins
• Improve ESIL for v850
• Fix satsub disasm text for v850
• Refactor nds32 ESIL argument handling for O(1) access and safer parsing
• Extend nds32 optype and esil support
• Use encoder fallback in arch session encode

asm

• Initial generic support for camel syntax
• Use the RArch api from RAsm instead of the anal callbacks

bin

• Fix a couple of boundary checks causing minor oobreads in the dmp parser
• Fix logic bugs, cleanup and simplify the PDB parser
• Fix memory leaks, endian issues and major cleanup for WAD
• Fix logic bugs, memory leaks and cleanup in the OMF parser
• Fix logic bugs, memory leaks and cleanup in the mach0 parsers
• Fix logic bugs, type mismatches and missing bounds checks in the ELF parser
• Cleanup and fix logic bugs in the DEX parser
• Fix memleak, off-by-one and unchecked init failure in the XCOFF64 parser
• Fix wrong type and unchecked read in PE section parsing
• Fix UB reads in the XBE parser
• Fix OOB loops in resize_section, del_rpath and segment_perms for elfwrite
• Segment permission patching for mach0s
• Implement rabin2-OP to patch segment permissions (Op is for sections)
• Improve elf write via rabin2 -O to patch segment permissions
• Use API (instead of cmd) and check for double redirects for bclass
• Add support for nds32 elf relocs
• Limit Swift demangler substring appends to 255 bytes
• Improve special hint symbols for ARM (elf/macho)
• Support more v850 relocs
• Extend Swift demangler with more abbreviation tables and conforms
• Improve class name extraction from demangled Swift symbols
• Fix ppc64be imports, symbols and entrypoint addresses
• Fix #25715 - wrong string vaddrs in kernelcache plugin for fat Mach-O binaries
• Entorce bclass sanitize right before use in core
• Fix #25707 - slow iOS kernelcache loading by bulk-reading into memory
• Fix memory leaks and unnecessary checks for dyldcache
• Fix memory leaks in the DEX parser
• Fix memory leaks in the PE parser
• Fix ELF versioninfo bounds and dynstr guards
• Fix clear deinits, memleaks and a heap overflow in mach0
• JNI_* symbols must be listed as entry-symbols via ies
• Autoload JNI types when loading
• Fix #24453 - Remove fixed flagName size
• Fix mdmp loop count underflow in bounds check
• Maxbound strings to 512 chars
• Clean up PE delay import parsing
• Fix PE delay import directory parsing
• Fix bin.limit consistency in Mach-O and .NET
• Fix memory leak when using RBinLimit with DEX
• Respect RBinLimit for PE too
• Respect RBinLimit in DEX
• Make bin.limit consistent across bin listings
• Respect RBinLimit when preallocating arrays in ELF and MACHO

build

• Install to lib64 on Fedora/RHEL/SUSE
• Fix quarantine related build error with scmangle
• Fix compilation in illumos

ci

• Add github actions for radare2
• Compile with FilC and ship the artifacts

cons

• Fix tv_usec overflow in r_cons_readchar_timeout for msec >= 1000
• Fix OOB write and underflow in winutils __fill_tail
• Fix overlapping strncpy in dietline kill-to-start handlers
• Fix cursor restore and OOB read in w32 xterm size probe
• Fix width clipping arithmetic in r_cons_print_at
• Fix rainbow buffer realloc and zero-size handling in r_cons_rainbow_new
• Shorter codepath for color2rgb
• Performance improvements in grep, dietline and canvas
• Fix parsing bold ansi colors to html

core

• Rename RCore.cmdCall to RCore.call
• Clarify cfg.sandbox.grain help text
• Fix endianness handling in cmd_write_inc
• Fix @@c parsing regression in @dp/@dr handling
• Rename R_CORE_LOADLIBS_ALL to R_LIB_LOAD_ALL
• Introduce R2_PLUGINS_ORDER to specify locations

crash

• Fix UAF when loading the same r2js script twice
• Fix some more integer overflows in NSO TE PE NE
• Extra check for boundary checks in the kernelcache
• Fix partial read bug in truncated kernelcache files
• Fix some integer overflows causing undersized allocations resulting in oobwrites
• Fix ubread in io.maps=bin.sections
• Fix invalied underflow state in the rbtree
• Fix integer underflow in the wfs command
• Fix overflowed array index in the rap server
• Avoid reading tainted phnum in ELF and cache a valid one once
• Harden winkd packet parsing against malformed KD/KDNet input
• Harden PDB parser against malformed TPI/DBI streams
• Fix multiple OOB reads and overflows in PDB parser
• Fix infinite loop and uninitialized free in PDB DBI module parser
• Fix r2 script injection via DWARF filenames in idL* output
• Fix oobread bug in r2k-linux and major cleanup
• Fix several oobread/oobwrite issues in shlr/gdb
• Fix several oobread/oobwrite issues in shlr/qnx
• Fix #25786 - heap buffer overflow in qnxr_read_memory
• Fix nds32_init_args crash + other side bugs spotted in the process
• Fix null deref in r_flag_tags_list when sdb is corrupted
• Refactor MSVC RTTI name reader and fix unchecked read loop
• Fix non-null terminated and zerosize file slurp bugs
• Fix OOB write and underflow in winutils __fill_tail
• Fix double-free and silence OOB warnings in r_cons_canvas_resize
• Fix OOB pointer arithmetic in regex p_bracket lookahead
• RFile.new can now take null as root without crashing
• Fix use-after-free and silent truncation in lines cache init
• Fix uaf in the elf parser
• Fix buffer overflows in xtensa disassembler
• Fix buffer overflows in tms320 disassembler
• Fix buffer overflow in m68k disassembler
• Fix buffer overflows in cris disassembler
• Fix buffer overflows in arc disassembler
• Limit ASN.1 hex string expansion to prevent memory exhaustion
• Fix GNS1 segment bounds checks to avoid overflow
• Avoid copying partial or overflowed ansi codes in rcons
• Fix uaf in r_asm_from_string
• Fix buffer overflow in dietline gcomp_line copy operations
• Use r_config_set API instead of r_core_cmdf for anal.cc
• Fix heap-buffer-overflow in macho parse_import_stub
• Fix OOM in mdmp parser due to unsigned underflow in safe_loop_count
• Fix integer overflow in parse_symbol_table() (CID 1646630)
• Fix integer overflow in parse_symbol_table
• Fix memleaks and heap-overflow in ELF parser for duplicate sections
• Fix heap overflow in egglang using 4096 variables
• Remove dead code, off by one and a null check in the esil analisis loop
• Harden SOM string-table bounds checks
• Fix r_str_wrap allocation sizing
• Fix #25650 - Command injection in curl PDB download
• Fix oobread bugs in the dotnet header parser
• Fix SSL crash in r_socket_connect: goto success instead of return true
• Fix #25636 - Oobwrite in the xtr.sep64 parser
• Fix webserver uaf based on @as0ler PR
• Fix pd-- heap overflow on long offsets
• Fix checkpoint snapshot ownership double free
• Fix seven charset decode buffer overflow
• Fix .hex directive odd-length parsing overflow
• Validate .cfloat bit sizes to prevent negative byte lengths
• Initialize command autocompletion before loading plugins

debug

• ptracewrap error handling and lock fixes
• Implement hardware breakpoints for winkd
• Implement single stepping and wait reasons for winkd
• Cleanup gdb responses, dedup death/thread parsing, remove dead code
• Add branchable debug session checkpoints
• Fix memory leaks, reduce LOCs and cleanup r_bp
• Add @p:PID and the @dr:/@dp: aliases for temporal attach

disasm

• Cache flag lookups in ds_print_ptr to avoid redundant calls

flags

• Fix lower zone tracking in r_flag_zone_around
• Preserve rawname and demangled in flag clones
• Fix flag zone list format strings

fs

• Fix memory leak in the zip filesystem
• Fix kvloc bounds validation and cleanup APFS btree parsing

http

• Webserver stop bug fixes

io

• Check allocation and insert in io_treebuf __write fallback
• Fix leak, drop dead code and bool return in io_xattr
• Guard io_dsc rebase loop against non-8-aligned count
• Fix io_r2web read to copy decoded byte count
• Fix io_sparse partial read propagation and RBuffer leak
• Fix r2pipe write return value and NULL-deref on read
• Format uf2:// and add a couple of new device families

magic

• Bring back the magic file baked apis + perf improvements
• Add buffer-baked functions in r_magic

panels

• Add Analysis.Plugins submenu and menuitem description
• Add filesystem manager, fs and js shells into
• Automatic scrolling and paning out of screen menubars

print

• Fix pp2/pp4/pp8 endian issues
• Honor cfg.bigendian in pp2, pp4 and pp8 commands
• Fix CSV escaping in RTable as for rfc4180
• Implement r_print_code_indent for C-like code indentation via ~:}
• Add pdub and pdur (until eob and until ret) commands

projects

• Cleanup project code and check for missing file on load
• Optional absolute file paths
• Show in Pi if those are new format
• Add json and show filepath, timestamp info in Pi
• Rename prj.alwasyprompt to prj.prompt

pseudo

• Initial support for while statements in pdc
• Fix pdca/pdco output with synthethic helpers
• Smarter switch labels, inline returns and label suppression in pdc
• Improve synthetic return statements to reduce gotos
• Initial support for switch statements in pdc

r2pm

• Fix ldpath handling on Termux

r2r

• Fix r2r subprocess teardown vector invalidation

sandbox

• Add network granularity for localhost/network

search

• Use r_str_trim_head_ro() in keyword search
• All search ref commands accept multiple targets now

security

• Fix logic bug spotted by codex security related to traversal path sandbox bypass
• Set restrictive umask around mkstemp in r_file_mkstemp
• Sanitize all the analysis hints for newlines
• Faster meta dumping with less boilerplate using quote commands
• Fix some more theorical shell injection vulns in projects
• Fix command injection in debug, type, mount and cbin commands
• Properly use and escape shell formatting system calls
• Improve r_str_escape_sh for Windows
• Fix command injection bugs in visual menus for flags and types
• Fix command injection when interactively setting flags in visual
• Fix command injection when changing register value in panels
• Fix command injection in cmd_open
• Fix two command injection bugs in t subcommands
• Fix command injection disasm.c via format binds
• Fix command injection vulns in aaF
• Fix command injection in idp command
• Fix command injection bugs in f commands
• Fix a command injection bug in cmd_print
• Fix command injection in abe command and add r_core_callf_at
• Sanitize zignature script output
• Fix command injection via graph node title
• Fix #25752 - Another command injection caused by the bad previous fix
• Reuse and improve the string sanity apis
• Reuse and improve the string sanity apis
• Be super picky about the sand grains
• Harden r_str_sanitize_r2 a little bit more
• Fix #25730 - command injection in pdb loading realnames
• Fix #25708 - command injection vulnerability via RBinInfo.bfile
• Sanitize bclass read from binary data in smd, io and pebble plugins

shell

• Implement -E command, it was already documented
• Add dot-quote commands support
• Fix a crash and gracefully handle ob*?
• Fix support for trailing space and newlines in scr.prompt.format
• Numeric and boolean config vars show description when set to '?'
• Better commandline handling of invalid r2pm flags
• Remove Cz metadata alias (Use Csz instead)

socket

• Fallback to curl when r2 is built without ssl and tries to https

tests

• Improve jq-r2r-js script for better testsuite profiling results
• Log interrupted tests when r2r is killed
• Fix r2r errors when r2/rasm2 not in path
• Various fixes for r2r, memleaks, wrong timeouts and counters

types

• Detect JNI_ symbols in utype function guessing

util

• Add and use R_INBETWEEN macro to handle ranges in ranges
• Honor short reads in get_whole_buf and r_buf_tostring
• Fix #12007 - Use RVec for RLog callbacks
• Improve the XML DOM parser
• Base64 decode now have "strict" option
• Add thead/th header row to r_table_tohtml output
• Validate underscore placement in hex literals
• Add r_json_parsedup that owns and frees the input string
• Optimize r_str_last() to search from end of string

utils

• Base64 decode now have "strict" option

visual

• Cleanup panels, fix UAF and leaks, dedup code, add helpers
• Fix key hints for push common on windows binaries

vulnerability

• Also sanitize newlines, solving some command injection bugs

Release Notes

Codename: "Brainroot" Version: 6.1.2 Previous: 6.1.0 AbiDiff: 70-77 (7) Commits: 224 Contributors: 15

curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.2/radare2-6.1.2.tar.xz | tar xJv
radare2-6.1.2/sys/install.sh

Highlights

Authors

AGhebrea Adam Satko Antoni Viciano Armin Weihbold David Given Dennis Goodlett Priyanshu Kumar condret dependabot[bot] pancake pancake pancake pancake potato satk0

Changes

analysis

• Preserve anal.timeout across and iterators
• Add APIs to get/set function signatures and other attributes
• Fix selection of overlapped functions in pdc
• Unify invalid code checks and stop filler-prefix blocks early
• Dont crash when reaching large bb limits, defaults to 64KB
• Improve the jmptbl bb isvalid checks
• Shrink the default max basicblock size from 512K to 8K
• Refuse to accept invalid jmptbl blocks
• Add anal.vars.maxframe and anal.vars.maxbbsize
• Fix esil-computed refs without losing type propagation information
• Implement the 'ah=' command to copy instruction details into hints
• Optimize isString logic for anal.strings reducing heap allocations
• Minor optimization on a function called a lot of times in aae

api

• Remove all the filetype related apis from librmagic
• Remove r_name_filter_print function

arch

• Fix Thumb label resolution for b/bl
• Fix #23536 - Changing arch.endian affects cfg.bigendian
• Initial implementation of the Python pseudo plugin
• Fix overlapping registers in the dalvik profile
• Honor endian settings for the or1k disassembler
• Add ex9patch script for nds32

arm

• • Fix overlapping function selection and pdc boundary crossing on arm64 kernelcache

asm

• Use RArch instead of RAnal for consistent settings
• Fix the .fill directive wrongly using sizeof multiplier
• Add bf.pseudo plugin

bin

• Avoid redundant ELF uncaps scans in get_stripped
• Fix the ELF phdr parsing beyond symtab
• Add RBinInfo.uncaps to expose non-encapsulated symbols
• Improve stripped detection on MACHO binaries
• Improve stripped detection on ELF binaries
• Refactor and cleanup the PEF and PDB parsers
• Fix PDB parser cleanup on failed parses
• Handle empty XTAC names safely
• Pass around RBinFile in dwarf. instead of using bin->cur
• Fix Mach-O redacted symbol scanning in NUL-separated string tables
• Harden Mach-O entitlement bounds checks
• Optimize the RBinFilter code for section names
• Clamp nindirect count saves 7GB parsing corrupted macho
• Fix tons of memory leaks in the DEX parser
• Fix memory leaks in the microsoft demangler
• Fix infinite loop in walk_codesig by using blob offsets
• Fix kernelcache nested Mach-O symbol parsing under rebased IO
• Local LE optimization for the macho parser
• Speedup RBin.XnuKernelCache parser
• Improve icc's objc output to be more correct
• Fix ObjC instance/class method types when dumping via icc
• Simplify the macho header parsing to extract endianness
• Clamp code signature slots and simplify parsing checks
• Add missing CSSLOT code signature types for macho
• Refactor Mach-O bind parser to reduce nested code and improve bound checks
• FIx #25482 - Improved macho bound to avoid unparseable allocations
• Fix 'isv' error message and other code cleanups in cmd_info

build

• Support v6 as an alias for capstone-next for meson
• Fix #25607 - arm64 disassembler wasn't available for capstone-next
• Remove shlr/capstone leftovers
• Do not use LTO for static builds by default
• Zig toolchain for debian/i386 crosscompilations
• Add docker and scripts for testing on i386
• Initial bootable dist/iso machinery

ci

• Pub the r2r json artifacts for the asan jobs
• Use -j4 in a windows build instead of -j1
• Improve the wasi build machinery

cons

• Preserve cons.timeout across context stacks
• Add missing keys in color themes
• Hardened nullable context cloning

core

• Fix RConfigSet bug creating keys when storage is locked
• Defer autocomplete and envprofile setup in non-interactive startup
• Initial support for $$..XXX addressing
• Rename anal.types. config vars to be just types.

crash

• Memory ownership improvements for the http webserver
• Fix nullable outputs in r_flag_zone_around
• Fix use-after-free in bin_any filetype detection
• Fix pcap buffer unref on parse failure
• Fix 3 critical bugs in the regex engine
• Use RStrBuf in librmagic to fix two vfprintf bugs
• Add more safety bound checks in dotnet
• Fix oobread in dotnet parser
• Fix assert in '?e je|!cat' writing 0 bytes
• Fix null deref in the PEF parser
• Fix oobread exposed in the new psp tests
• Fix invalid mem free when one DIE has two or more DW_AT_name attributes
• Fix SIGCHLD deadlock for r2r 32bit systems
• Fix race condition in Linux's system causing random r2r failures
• Bound Mach-O SuperBlob count before allocation
• Fix infinite loading times for a fuzzed macho file
• De-recurse bbtree walks abusing stack usage in wasm/asan
• Fix UAF in the dotnet metadata parsing
• Clamp utf8 decode length for truncated null terminate inputs
• Fix deinitialization segfault in the background webserver

doc

• Document r2r tests in the manpage

dwarf

• Find dwarf attr DW_AT_frame_base once outside the hot loop

egg

• Inline assignments, block bodies, no empty frames and fastcall handling
• Refactor arm emitter, memory access, branch logic
• Refactor arm64 load/store helpers
• Fix fastcall declaration parsing and add a test
• Fix arm thumb emitter for frame, string, getvar and load
• Some arm64 egg emitter fixes (string, jmp, 8byte alignment, stp/ldp)

esil

• Dont run aeim in esil analysis related commands
• Push a zero into the esil stack when dividing by zero

fs

• Fix HFS+ extent overflow search key initialization

graph

• Add graph.bb.maxsize option to limit basic blocks size in graphs

io

• Speed up dyldcache rebase backtracking in io.dsc
• Fix memory leak, zip creation in readonly and other minor bugs in zip
• Do not corrupt files when using zip://

lib

• Refactor DRY user plugins load logic

muta

• Simplify the transposition muta plugins

print

• Merge pz and p= subcommands capabilities
• Support utf8 dots on truncated text with the new r_print_ellipsis
• Simplify cmd_print string helpers and drop null guards
• Fix utf8 checks for invalid and overlong encoding

projects

• Add prj.new config to use the new prj formats

r2js

• Implement more r2js variants for r2pipe2

r2r

• Fix r2r temp diff file handling
• Run iH for all the fuzzed binaries

ragg

• Fix memory leak in ragg2

remote

• Expose URI instead of basename for r2agent sessions

sandbox

• Do chdir("/") after chroot(".") to avoid sandbox escapes

search

• Use block buffering for faster anal search
• Optimize /az reading blocks and use minopsz and opalign

shell

• Fix #25556 - Internal grep with macros
• Support copying to directory and handle errors in cp

snslydid

• Run data-flow reference analysis to cmd_anal_all for consistent behavior witha aa

test

• Fix null/len checks to please the fuzz suite
• Add fuzz loop scripts
• Introduce the new indent suite

tests

• Add fuzz loop scripts

tools

• Add r2r -1 as an alias for -j1
• Fix formatting braced stuff like enums
• Reuse RCons in rafs2 interactive shell
• Fix SIGSEGV in rafs2 interactive mode
• Add support for user plugins in rafs2

types

• Lazy-load and cache types to speed startup
• Merge OS-specific types in RAnal.setOS
• Use sdb_set instead of sdb_query to store data after parsing
• Support parsing vararg in function pointers
• Support parsing forward structs declaration
• Include line number and type name when parsing fails
• Implement the tf- command to delete function definitions
• Add anal.types.xrefs for the tv commands
• Show xrefs for function signature definitions in tfv
• Implement tfv command to view function arguments and its offsets

util

• Add a larger regex testsuite and fix a couple of bugs

visual

• Add TV as an alias for TV
• Improve quality in the treemap '?em' code

Release Notes

Codename: The Low Table Version: 6.1.0 Previous: 6.0.8 AbiDiff: 54-70 (16) Commits: 346 Contributors: 24

curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.0/radare2-6.1.0.tar.xz | tar xJv
radare2-6.1.0/sys/install.sh

Highlights

Authors

Abhi Ahmethan G. Alberto Marnetto Antoni Viciano Carl Smedstad Charloitte Daniel Nakov Hakal Ignacio Sanmillan Marc R. Oblivionsage Oblivionsage Priyanshu Kumar Quentin Kaiser Zhichen Wu astralia aviciano condret dnakov pancake pancake pancake potato satk0

Changes

abi

• Reimplement RBufRef on top of RRef
• Fix the RLibDelHandler api

analysis

• Delete stale JAY code. wasnt used in 10 years
• Use invalid_page in aap, fixes another slow CI test
• Improve the invalid page check to speedup /azs
• Break aac when io fails or its not even executable
• Make use of the cmp value for jmptbl size, this was dead code before
• Better integration of plugins in the analysis pipeline
• Use RRef instead of custom refcounting in RAnalBlock -26LOC
• Add anal.jmptbl.split option to experimentally solve the missing cases
• Fix infinite loop in the jump table with shared basic blocks
• Fix #5136 - Add anal.jmp.pair to flatten consecutive inverse branch antidisasm tricks
• Add time_t type definition with size specification
• Handle CS_AC_READ_WRITE in the x86 cs plugin
• Honor op.ptr references in /re for x86 only
• Add plugin to import traces from DRCOV logs
• Rewrite RCore.seekOpForward for the better
• Better autoname filtering chars with RName apis
• Introduce afnq refactor afn into a separate helper
• Improve better fastpath function autoname
• Rewrite RCore.seekOpBackward for the better
• • Rewrite RCore.seekOpBackward for the better
• Move core.sixref plugin to anal.six
• RAnalCmd now returns a string instead of bool

api

• Add the new RNum.getErr helper
• Enforce non-null compile-time check for R_NEW and R_NEW0
• Single RConsVisual.readline helper used everywhere
• Introduce the new R_QUIET_FAIL for fast path asserts

arch

• Update from binutils the ARC disassembler from 2009 to 2026
• Use RStrBuf instead of the unsafe sprintf in the rv disassembler
• Use refcounted RArchSession
• Fix incorrect plugin references in RLibStruct structures
• Dont use strcpy/strcat or globals in xap disassembler
• Fix typos in the java opcode tables

asm

• Implement the asm.pseudo plugin for dotnet's CIL
• Add support for camelcase disasm syntax
• Add ARC pseudo plugin and update opcode descriptions
• Fix #25232 - x86asm for sil,dil,spl,bpl
• Fix x86 assembler accepting invalid register names like r1

bin

• Extend iH to return a string and permit multiple formats
• Import function signatures and types definitions from DWARF
• Fix arch hints for cil/x64 binaries and its tests
• Extend the CIL detection for Mono exe/dll
• There's no need for a PE to have a certificate
• Fix resource leaks in NE format parser
• Implement iz. izj. and izq. to show string in current address
• Add izzc and izzzc commands to count raw strings
• Fix leaks and other bugs in the LE format parser
• Implement izjq and its alias izqj
• Add bounds check for MDMP comment stream size
• Disable the xtr.dyldcache, fix a crash and other XXX in xnu.kernelcache
• Count and pagination of iz strings listing commands
• Add iz+ command
• Extend iz- command to accept length and type
• Fix endian-unsafe struct read in LE reloc parsing
• Add support for ARM64's GLOB_DAT ELF reloc types
• Fix code_length bounds check in Java class parser
• Replace eprintf with R_LOG in Java class parser
• Use actual data_size for MDMP comment streams
• Expose RTM revision version information from minidumps (mdmp)
• Fix #25382 - Open Limit chained fixup loop iterations in le reloc parsing
• Expose macho imports as vectors
• Use RVec for the ELF imports
• Priorize the use of RVec for RBinImports
• Ten times less memory use when loading DEX
• Fix some other bugs and memory leak in izz
• Remove deprecated addrline storage and fallback code paths
• Clamp MZ sections with file size
• Fix #25209 - Ensure we have enough data to read in mdmp
• Generalize imports cache for performance
• Support the Apple C4000 Baseband firmware (gns1)
• Fix memory leak in zimg plugin
• Fix memory leak in bflt plugin
• Zero copy string handling in swift demangler and remove one global
• Cache the has_nx value in the elf to parse it once
• Extract NX information for QNX ELF binaries
• Fix memory leak in PE parser
• Fix #25277 - oobread by one in the OMF parser
• Rework bin.xtac to fix tainted, memleaks and BE
• Fix memory leaks in Java binary parser
• Fix memory leaks in MDMP plugin and RBinMem
• Fix memory leaks in the som parser
• Fix #25248 - memory leak in MDMP parser
• Fix memory leaks in QNX binary parser
• Fix memory leak the SOM import parser
• Optimize symbol loading
• CUBINs are ELF based on EM_CUDA
• Lazily compute the PE autentihash once + add missing muta hash plugins
• Use RMutaBind in the PE plugin
• Use RMutaBind in RBin too, replace r_hash calls in macho
• Rename r_bin_command to r_bin_cmd
• Refactor the bflt code, more cleanup and minor reloc improvements
• Support non-arm bflt executables
• Fix reloc native types for mach0
• Expose more native reloc types
• Expose the reloc type for REL binaries
• Add support for records and invoke dynamic in java
• Add support for ACC_HIDDEN Java classes

build

• Cydia builds use rootless prefix and target arm64
• Inform the user about the command to run as sudo in sys/install.sh
• Fix to meson without any zip dependency, not even otezip
• Specify arm64e to please Sileo packages
• Fix r2_fortunes path inconsistency in meson.build
• Initial support for third party plugins
• Move shlr/ar into libr/io/p/ar
• Replace bundled libzip+zlib with otezip (-55kLOC)
• The csnext job now tests libuv and no-undefined
• Disable debug log statements in release builds

ci

• Fix #25179 - Merge the csnext and ssl jobs

cons

• Fix #17391: preserve UTF-8 in graph output
• Remove repeated spaces in hud lines
• Fix the color palette propagation problems via rcorecmdstr

core

• Add more guards to make background tasks more predictible
• Fix #25374 - Convert RLib->plugins_ht to a per-type array of hashtables

crash

• Fix a double free in r_str_replace_icase
• Fix stale pointer used when temporal blocksize changes
• Fix overflows array oobread index in intervaltree
• Fix negative index used in *r_anal_function_get_var
• Fix overflows return value in io.dsc
• Fix another integer overflow in bin_pelf
• Fix oobread caused by integer overflow in kernelcache
• Fix integer bug in dotnet getname causing oobread
• Fix two oobwrite bugs in canvas_resize
• Fix two integer overflows in RCore.getBoundariesProt
• Fix untrusted loop bound, integer overflow and oobread bugs in bin_pef.c
• Fix uaf in /m
• Fix integer overflow in the wfs command with large files
• Fix zero and size_t multiplication overflow UB issues in rvec
• Fix oobwrite in visual write commands and oobread pascal demangler
• Fix UB cast in container_of macro
• Sanitize function names in afl* to avoid command injection
• Fix UAF in RBin.ELF.fini
• Sanitize callconv in fcn_print_detail output
• Fix iter page underflow in le parser
• Fix integer overflow bug in r_cons_print and r_cons_write
• Fix #25338 - Out-of-bounds read in the NSO parser
• Fix #25336 - integer underflow in QNX parser
• Fix use-after-free in LE/LX reloc parsing
• Fix possible argument injection vuln in the swift demangler
• Fix #25290 - ELF extended phnum allocation check
• Sometimes the webserver calls this function with null command
• Fix otezip UB and incorrect java boundary check
• Fix heap buffer overflow in SPP processor
• Fix core plugin initialization order
• Fix #25212 - oob read in r_str_len_utf8
• Fix potential overflows in snprintf for cmd_mmc according to codescan
• Fix potential uaf in gdbclient/responses.c
• Fix the space for the null byte in seven.c

debug

• Fix #2079: Add source line breakpoints
• Implement native breakpoints support for XNU/ARM64
• Use RMutaBind in RDebugSnap
• Implement print fpu registers for linux-arm/arm64

diff

• Resolve 6 TODO comments from xpatch

disasm

• Support overlapped strings in the disassembly listing
• Do not emit Color_RESET in disasm loop when scr.color=0
• Improve auto-string comments in disasm
• Honor RMeta string size in 'str' flags
• Fix #680 - Keep :NN suffix in symbol substitution

esil

• Extend emulation support for x86 FPU

fs

• Fix #16396 - add mlx to list deleted files only for FAT
• Fix #19411 - Handle r2 alias for 'open'
• Move shlr/grub into libr/fs/p/grub

hash

• Fix #13937: rahash2 -R sdb output

http

• Fix the webserver when sandbox is enabled

io

• Fix #15699 - Add SREC file format support
• Remove globals from io.winedbg
• Remove globals from the io.bochs plugin
• Remove global state from io.gdb
• Remove global states from io.sysgdb
• Remove globals from the io.mach plugin
• Remove globals from the io.qnx plugin
• Remove core->block from write-op
• Update uf2families
• wx+ nibble writes no longer depend on block size
• Add r_io_bank_get_regions to speedup io.unalloc
• Add sandbox guards for zip://

muta

• Fix the license checks for all the crypto/hash
• Fix incremental hashing for SIP and ADD algorithms
• Reimplement ph to use RMuta and do blocksize incremental hashing
• Fix garbage value in aes crypto
• Move the seven bit string encoder/decoder into a plugin
• Improve RMuta api to cover the usecases from RCoreCmdPrint
• Support custom text output for RMuta.ssdeep/entropy
• Dont use RHash from RCoreBinFile
• Combine the RMuta.rc plugins
• Create the RMutaFletcher for all the fletcher subtypes
• Implements is now an array in json
• Create a single RMuta.crc plugin for the 22 crcs supported by rhash
• Combine all the sha checksums into a single plugin
• Support subtypes in muta plugins, combine rol/ror
• Port sha384 and sha512 from hash
• Use RMutaBind in anal
• Initial implementation of RMutaBind

print

• Fix escaping multibyte rune strings
• Fix #25445 - crash in p== and add tests for it
• Use RStrBuf in pxa (instead of strcat/strlen/strcpy)
• Fix "p8," command output (missing 0x prefix)
• Move p2 and p3 into pri2/pri3
• Honor cfg.bigendian in cv commands
• Use the new .getRegions for printing

r2js

• Add script to discard non-english strings

r2pm

• Fix LD_LIBRARY_PATH in r2pm for Termux

refactor

• Address all the java covs + more cleanup, shorter method names
• Remove globals from the java library -350LOC

search

• Nibble-sized hexpairs must roundup the negative size
• Document and enforce the nibble mask search in rafind2
• Fix #10875 - rafind2 filter files by rbin info
• Fix #22299 - add rafind2 search-and-replace
• Remove core->block dependency for /P

shell

• Fix #23629 - implement print/printf/println
• Fix 'a:' behaviour

tools

• Resolve the test path for r2r following symlinks as fallback

types

• Implement the tde command to define types with cfg.editor
• Implement e subcommand for all types using cfg.editor
• Add support to delete types using glob expressions
• Implement the tev command to view enums
• Colorize the types view output (tv command)
• Implement tv, tsv and tuv to view type offsets and xrefs
• Implement the tsx command to show struct offset like in hexdump
• Implement pack and align attributes for pf
• Add ts. and tu. commands as alias for .ts/.tu
• Add tu- command and fix command injection in other t*- commands
• Implement support for the hidden visibility attribute
• Improve propagation for windows structs and variable names
• Support embedding structs inside unions
• Fix support for unions in cparse->pf
• Remove typesdb global and use more pj api to build jsons
• Show struct fields as an array in the tsj output

util

• Add snake<->camel string conversion apis
• Redesigned RTypesOverflow apis to capture the result and don't duplicate ops
• Use compiler intrinsics to check for add/sub/mul overflows if available
• Make thread delays interruptible

visual

• Add 'agfma' with disasm and edge color for mermaid graphs

wasi

• Fix stdout redirect on wasi build

zignatures

• Add dir.flirt to scan for FLIRT signature database

Release Notes

Codename: CleanWheat Version: 6.0.8 Previous: 6.0.7 AbiDiff: 39-54 (15) Commits: 291 Contributors: 11

curl -Ls https://github.com/radareorg/radare2/releases/download/6.0.8/radare2-6.0.8.tar.xz | tar xJv
radare2-6.0.8/sys/install.sh

Highlights

Authors

Copilot Francesco Tamagni Ole André Vadla Ravnås Ole André Vadla Ravnås dependabot[bot] pancake pancake pancake potato qz satk0

Changes

abi

• Migrate r_vector to RVec in core, anal, io, and other components

analysis

• Unify redundant state vars in type propagation
• Use faster data structures for caching data for type propagation
• Remove anal.a2f and the a2f core plugin, it's in anal already
• Conver the blaze analysis from core into an analysis plugin
• Make the leading double lowerdash in symbols irrelevant
• Fix aaef corrupting files in write mode by routing ESIL writes to IO overlay
• Fix analysis command plugin listing 'a:?'
• Add test for type propagation after manual aei
• Move and improve type propagation as a plugin
• Compute with memoization the amount of refs in functions
• Fix null asserts in the 'ap' command and handle prelude binmask
• Resolve gp-relative jump tables for MIPS
• Fix function arg name counting

arch

• Fix #25037 - Support to assemble the 'enter' instruction for x86
• Support AT&T syntax in x86 disassembly and ESIL generation
• • Simplify x86 operand handling by removing find_*op helpers
• Heavily refactor and improve the z80 plugin
• Fix bugs in the z80 assembler and disassembler
• Expose rbin metadata for dotnet in disasm
• Initial support for CIL disassembler and assembler
• Execute delay-slot instructions in branch instructions and fix gp alignment

bin

• Fix support for Java class loading
• Add kernelcache test and simplify rbuf reference issues
• Emit demangled class names even if demangled is disabled
• Remove rvector calls away from the elf
• Use RVec in machos
• Remove globals from the python plugins
• Fix the swift demangling tests with trylib=false
• Discard unaligned strings with bin.str.align option
• Use the arena allocator and fix memory leaks in the dwarf parser
• Fix demangling bombs honoring the maxsymlen option
• Fix xrefs in apk:// rebase getoffset() with RBinFile.getVaddr()
• Implement .types for the PDB plugin
• Fix multidex apk:// rebasing
• Add rbinplugin types (experimentally used only for dotnet)
• Set RBinClass origins where possible
• Add the class origin field
• Fix #24989 - ARM RPI2 PE identification
• Fix leaks, rm globals and other cleanups for PDB
• Improve the objc parser boundary checks, find more refs
• Mark cil methods with anal arch hints
• Improve AARCH64 relocation support for ELF
• Initial working support for .NET PE assemblies
• Implement the RBin.pdb plugin
• Fix partial ARM instructions relocs for ELF
• Properly inform about why an ELF is not stripped

build

• Also use -Oz in sdk-common.sh
• Omit third-party asserts during SDK builds
• Build SDKs without runtime checks
• Update the rpm package
• Build xcframework with frameworks
• Fix libr.dylib exports on Apple OSes
• Fix and tune the xcframework sdk
• Improvements on the SDK compilation for apple targets
• Fix sys/install.sh for busybox environments

ci

• Build less wasis in PRs
• Use ./configure -qV instead of sys/version.py
• Add XCFramework builds in the release pipelines
• Switch to macos15 because older ci runners are not available

cons

• Make the bluy theme really bluish
• Refresh palete when needed only, fix 'ec' calls from RCore.cmdStr
• Better color limit checks with TERM
• Respect the TERM envvar, only for colors for now
• Reset command switch the terminal mode to ASCII

core

• Improve abiversion warning messages

crash

• Fix uaf bug in apple kernel/dyld-caches spotted by scan cov
• Fix off by one write in the set regprofile function
• Fix oobread in dmh with glibc and uaf in magic command
• Fix UAF in the pdb deinit process
• Fix a couple of recent integer overflows in PE
• Fix oobwrite segfault in dotnet parser
• Fix oobwrite in r_strbuf_append_n
• Dont depend on global cons instance for win_is_vtcompat
• Avoid rbinfiles to UAF if the rbin plugin associated is unloaded
• Fix oobread crash in dotnet parser
• Fix null deref in the p9 parser
• Check for abiversion before loading plugins
• Fix buffer overflow in PE parsing imports and symbols
• Fix UB overlapped memcpys in iomaps
• Fix infinite loop in the mach0 relocs parser
• Fix near-infinite loop in the objc parser eating lots of memory
• Fix infinite loop in r_core_anal_type_match
• File paths with the curl backend must escaped as TMPDIR poisoned for command injection
• Fix an OOB by one in the rap server and better error checking
• Fix system command injection via RSocket.get/post headers when using curl
• Use RSocket.download from idld to fix command injection
• Check the vec reserve before emplacing it back

debug

• Fix radare2 gdb remote debugging support and add test
• Detect and warn when setting overlapped breakpoints
• Implement 'dga' to coredump all maps
• Fix r_str_scanf parsing bug and dg coredump on linux-x64

disasm

• If arch isvm lower varmin to zero
• Implement the scr.rainwbow.regs option
• Fix scr.color.regs when scr.color.ops is false
• Fix colorized ops with byte colors when scr.color.ops=false
• Add register rainbow coloring support
• Add asm.cmt.strings to disable aop.ptr strings

esil

• Replace chevron operators with LSL, LSR, ASR, ROL

fs

• Sort apfs files by name instead of randomly depending on a hashtable
• Implement support for reading files in apfs mountpoints
• Retrieve the file sizes in the apfs filesystem
• Add support for BSD DiskLabel partitions
• Initial support for the Apple FileSystem
• Add support for APM (PMAP) Apple Classic partitions
• Add support for EBR partitions (keep MBR support)
• Initial support for GPT partition tables

hash

• Fix r_hash_tostring using update/end properly

http

• Add APIs to register sessions

io

• Implement the tap:// io plugin for simh tape images
• Enable rawio by default
• Add support for pipe fifo files with 'r2 <(uname)'

muta

• Port all charsets from r_charset to rmuta via charset plugins

panels

• Fix multiple layout settings

perf

• One more strbuf reserve and unnecessary uses of it
• Reduce strbuf drains by removing the slack area

print

• Removing pf, pf2 is the new pf
• • Refactor print formatting to improve handling of structs, arrays and pointers
• Refactor print formatting to improve handling of structs, arrays and pointers

shell

• Implement the @@@m:perm foreach operator
• Fix column width in 'ls'
• Fix column width in 'ls' output
• Load fortune messages from directories
• Fix #24914 - Refactor and improve 'sf' command
• Add support for ${pal:} themed colors in scr.prompt.format

socket

• Handle SOCKET_HTTP_MAX_REDIRECTS in the curl codepath
• Support binary data downloads via RSocket.get
• Implement RSocket.download as a wrapper for get+dump

tests

• Add SKIPONASAN option for r2r to avoid a dmh test to fail
• Display short test paths if possible
• Check and display libr version with r2, r2r and rasm2 are the same bin with libs

tools

• Honor R2_COLOR env var from rabin2
• Implement -hh for rabin2 and rasm2
• Include abiversion in -v and -V
• Add JSON support to rafs2
• Add R2_DOCDIR and R2PM_DOCDIR variables
• Add missing rahash2 in blob/main
• Implement rasm2 -LL to list the parse plugins
• Fix error code for 'rasm2 -a invalid nop'

types

• Update scanf and wscanf function signatures to reflect variadic arguments
• Implement typedef union and enum parsing in KVC parser

util

• Fix RBuf design lifetime issues
• Improve r_str_rwx to parse the shar bit
• Sperm bit handled in the helper
• Use logaritmic capacity grows in strbuf
• Continue improving the arena api

visual

• Colorize perm field in iS, dm, dmm and om
• Some better organization sub-visual modes (TAB)
• Add scr.vprompt.format

wasm

• Update to use the latest wasi-sdk-29.0
• Add wasi-browser using wasm-imports

Release Notes

Codename: "sixseven" Version: 6.0.7 Previous: 6.0.6 AbiDiff: 39-39 (0) Commits: 4 Contributors: 2

curl -Ls https://github.com/radareorg/radare2/releases/download/6.0.7/radare2-6.0.7.tar.xz | tar xJv
radare2-6.0.7/sys/install.sh

Highlights

Authors

pancake pancake

Changes

shell

• Fix parsing r2 -H$(VARNAME) without a space

Release Notes

Version: 6.0.6 Previous: 6.0.4 AbiDiff: 24-39 Commits: 331 Contributors: 28

curl -Ls https://github.com/radareorg/radare2/releases/download/6.0.6/radare2-6.0.6.tar.xz | tar xJv
radare2-6.0.6/sys/install.sh

Highlights

Authors

0verflowme Abhi Edoardo Mantovani Eduardo Novella Ignacio Sanmillan Luc Schrijvers MiKi Miquel S. Nikesh Chavhan Pau RE Priyanshu Kumar Quentin BUATHIER Quet Zal Sagittarius-a Sverker Sverker Berggren System Administrator astralia dependabot[bot] dominikfhnw google-labs-jules[bot] gum3t pancake pancake pancake potato qz vicky-dx

Changes

abi

• The old RStr.pad() is now replaced by pad2

analysis

• Use code/call/data refs to find shortest flow path
• Improved support for anal.timeout
• Handle more arm64 jump tables
• Expose the ptrsize on more arm LOADS
• Handle more cjmp instructions for loongson
• Fallback to recursive esil for too sparse functions
• Dont change blocksize when running afva
• Properly expose the ADD imm on arm64
• Some more consistency fixes for arm
• Fill the op.val on arm64 CMP instructions
• Fix #24712 - p8fm mask size mismatch for instructions longer than 8 bytes
• Add comprehensive ROP gadget tests for ARM32/ARM64/x86-64
• Fix duplicate xrefs in axff output
• RThreads use 8MB of stack instead of 1MB

analysys

• Expose the LOAD size for arm64 LDR ops

api

• Implement simple arena memory allocator
• CoreBind getI must resolve ut64
• RCoreHelp should take a const string as argument

arch

• Fix wasm opsize read issue
• Assemble msub, str and stur ARM64 instructions
• Support encoding ex9.it, ifret and ifcall nds32 instructions
• Add register alias names for nds32
• Throw more ESIL and pseudo for nds32 instructions
• Add support for v1/v2/v3 sBPF bytecode standards
• Describe all instructions for the COSMAC architecture
• Support assembling the 'notrack' r{jmp|call} prefix for x86-64
• Implement x86 assembler for pushfq/popfq and fix cwde
• Fixed registers name for NDS32
• Initial import of the hppa pseudo parser
• Add HPPA disassembler database with instruction descriptions
• Add the instructionset documentation for nds32
• Initial import of the nds32 pseudo parser
• Fix #17637 - ARM64 variable substitution in address calculation instructions
• Fix #15947 - Compound assignments for the ARM64 pseudo
• Support asm.pseudo for the x86 BMI1 instructions
• Assemble the BMI1 instructions for x86-64
• Fix pseudocode for arm64 movk instruction
• Add more arm32 instruction descriptions
• Assembler movsz and movzx for x86-64
• Add support for ghost nops for x86-{32,64}

asm

• Fix #24824 - Use asm.imm.base for ATT syntax
• Custom float directives for rasm2
• Add Floating Point profiles for VAX, CRAY, IBM370 and more
• Support signed and unsigned directives in rasm2
• Initial support for the .db .dw .dd .dq rasm2 directives
• Eliminate RAsmOp and just use RArchOp
• Unify asm_massemble and add asm.spp into asm_assemble
• Implement r_asm_plugin_remove
• Fix #19171 - movaps assembly with xmmword size specifier

bin

• Expose sBPF version via asm.cpu and support rebaseable relocations
• Keep up parsing TPI leaves and support PDBs larger than 64KB
• Initial support for HPPA / SOM binaries
• Fix parsing TLS entrypoints in PE64
• Fix swift demangling on Linux
• Add missing e_machine EM_486
• Support large fat machos > 4GB
• Add the eeprom category for symbols
• Fix stripped detection for some ELFs

build

• Remove static builds from release
• Remove arm64 linux crosscompile
• Cancel old workflow executions
• Make pkgConfig unnecessary with R2_CFLAGS|R2_LDFLAGS to r2/r2pm -H

cons

• Fix null deref in windows when process received ^C
• Fix multi-byte character support in panels and graphs
• Clean some code and fix visual wrap regression
• Fix blinking prompt on windows dietline
• Refactor the drain csi escape codes logic
• Fix dietline bug on Windows causing SUPR key to quit
• Replace fixed line limit with adaptive page-based limit
• Fix #1973 - line counting for large output
• Fix hud large filter, resize refresh, fix ansi text wrap
• RCons.less should act as cat in non-interactive mode

core

• Initial redesign of the RCoreTasks to support fork and thread jobs

crash

• Fix oobwrite bugs spotted by clang-analyzer
• Fix buffer ovf at r_str_scale
• Fix null deref in '?$' and '$o' when no RBinObject
• Fix null format in 'fa' command
• Prevent the :::infinite but interruptable command
• Fix #24813 - null deref in xnu kernelcache
• Fix oobread in the command parser
• Fix two DoS bugs in the iso9660 parser from grub
• Fix assert on windows when opening a file that doesnt exist
• Fix race condition in thread_kill
• Ignore bad bin plugins with null section/symbol names
• Fix recurive r2ai calls with failed rc
• Fix #24748 - Avoid double free in pyc parser
• Fix null deref in rasm2
• Fix #24737 - NULL pointer dereference in r_anal_extract_rarg
• Fix null deref crash reported by @astralia during the nn training
• Fix #24661 - null deref in dsc loader
• Fix #24660 - Null deref in NE parser

debug

• Avoid mach exceptions to slip breakpoints by accident
• Add :tls command in mach:// to print the thread info address (not the tls)
• Add :tls command for the w32dbg io plugin
• Fix dd filename handling and add seek reset test
• Add cfg.regnums (false by default) to read register values via rnum
• Fix #14715 - Validate pid argument in cmd_debug_continue function
• Implement extended support for custom floating-point formats in the register subsystem
• Honor special chars in more rsocket profiles
• Fix fuzzy backtrace to show complete call stack with correct SP values
• Add name field to breakpoint JSON list

dev

• Ship the .clang-format file INSIDE the clang-format-radare2 script
• Update for the code-format tooling (introducing clang-format-radare2)
• Introduce the new radare2-format script

disasm

• Fix #17637 - Don't substitute variables while in stack frame setup
• arm32 workaround for resolving function arguments
• Fallback to callconv reg when argument is invalid

doc

• Improve the manpage to markdown parser
• The "man" r2 command now loads other categories
• Install man(3) pages

egg

• Fix #14765 - Include rasm version of the shellcodes and verify them

esil

• Honor cmd.esil.trap when running TRAP or invalid code
• Implement ESIL for the ANDN instruction

flags

• Add fzs for seeking

fs

• Initial support for the BeOS Filesystem (BFS)
• Fix 'mc' for filenames with spaces
• Add automagic detection for more filesystem types
• Audo mount ubifs and make it available for meson
• Miknight Commander improvements (mouse support et al)
• Add Miknight Commander (mmc) dual-panel file manager for r_fs and local filesystem
• Implement get64, set and set64 commands in the fs.shell
• Implement the mkdir command in the fs:shell
• Fix double fs.cwd bug in the "mw" command
• Add 'md+' command to create directories
• Add the new temporal filesystem
• Add new API r_fs_mkdir
• Add rafs2 - radare2 filesystem tool
• Implement filesystem details command (mn) for mounted
• Add test suite for UBIFS filesystem plugin
• Fix #23463 - Add support for UBIFS, add prgr and mis commands
• RFSPlugins expose the cmd interface for m:

io

• Fix and optimize support for blockdevice
• Fix and enable rawio by default (use mmap:// otherwise)
• Fix io.cache truncation bug

json

• Fix bug in pj and another in json_parser when using arrays of raws

lang

• Handle ^C and show stacktrace in RLang.qjs

print

• Add cfg.newpf to run pf2 instead of pf
• Handle help in pp subcommands, fix ppf, refactor pd and add tests
• Make clippy capable of emojis
• Add utf8_display_width api
• Fix #2953 - Handle functions in pxa (not just flags)
• Add support for bf16 in rax2 and pf

projects

• Minor improvements and code cleanup for the old

pseudo

• Implement minimal pseudo for evm

r2pm

• Warn when the package database is older than 2 weeks

rarun2

• Disable read timeout for connect sockets in rarun2

search

• Fix #24812 - JSON output for Rabin Karp
• Fix JSON output for Rabin Karp
• Support JSON output for /s command
• Use 1024 as maximum valid string

shell

• Fix grep in quoted commands
• Add ${relto} and \s handlers for scr.prompt.format
• Handle ${e:EVAR} variables for the scr.prompt.format
• Add vaddr, paddr, r:reg and use corehelp in prompt.format
• Revert "Revert "Parse -h and -H flags before RCore
• Add rc+value in scr.prompt.format
• Handle more help messages for u subcommands
• Initial implementation of scr.prompt.format
• Handle ^D in -j to leave the r2js repl
• Fix 'h?' help message
• Add scr.clippy to select the model
• Add help for clippy command ?E?
• Revert "Parse -h and -H flags before RCore
• Parse -h and -H flags before RCore is instantiated for performance reasons
• Implement the r2-E flag and -E,ed! commands
• Add wvg and cfg.float to write custom float values
• Handle the new 'pd:' subcommands, using r2ghidra-git for now
• Use Core's SDB to hold the command based suggestions
• There's no sense to use r_config_eval in r2 -e
• Handle 'pdc.' to list all the decompilers installed. Like 'e cmd.pdc=?'
• Fix al and aF subcommand handling
• Show proper help for the 'ex' subcommands and implement 'export'
• Fix #24658 - Better conditional commands (?eq/ne/ge/le)
• Fix r2pm inside r2
• Help quote help with '?
• Revamped flagzone commands after 9 years
• Make rafs2 accessible from inside radare

shell"

• Revert "Revert "Parse -h and -H flags before RCore
• Revert "Parse -h and -H flags before RCore

shell""

• Revert "Revert "Parse -h and -H flags before RCore

socket

• Use RSocketTimeout(0), reindent and add _fini method
• Allow to disable timeouts in sockets and forbid negative time

test

• Handle R2_DEBUG_FUZZ to crash instead of breakpoint on assert
• Use clang18 in test/fuzz, add C-types fuzzer and make orchestrator
• Respect r2r to pick an alternative r2 binary
• Add r2r -q for quiet testing

tests

• Respect r2r to pick an alternative r2 binary
• Add r2r -q for quiet testing

tools

• Add r2 -H R2_ABIVERSION
• Show if arch plugin supports pseudo disasm in 'rasm2 -L'

types

• Refactoring and cleanup of the C preprocessor
• Properly parse static functions
• Fix parsing C functions without argument names, improved vararg

util

• Initial implementation for the custom floating point api
• Revert "Fix the bug in r_str_wrap taking sometimes one less char
• Fix the bug in r_str_wrap taking sometimes one less char
• Fix empty output on r_sys_cmd

util"

• Revert "Fix the bug in r_str_wrap taking sometimes one less char

visual

• Handle mouse clicks in graph
• r2slides are now using the .r2.md extension
• Fix scr.wheel.speed regression
• Fix another glitch in the hud filtered selection
• Clippy now supports multiline and long text

wasm

• Use rasm2 main from r2 in wasi only for now
• Use 8MB stack size in WASI builds

windows

• In the preoconfigure add the windows debugger toolkit in the PATH

zignatures

• Use RStrBuf instead of calling cb_printf many times in the flirt parser

Release Notes

Version: 6.0.4 Previous: 6.0.2 Commits: 202 Contributors: 18

curl -Ls https://github.com/radareorg/radare2/releases/download/6.0.4/radare2-6.0.4.tar.xz | tar xJv
radare2-6.0.4/sys/install.sh

Highlights

Authors

Ignacio Sanmillan Jassim Bahmida Juho Kuisma Murphy Neil Macneale V Ole André Vadla Ravnås Pau RE Sergey Fedorov Takumi Matsuura dependabot[bot] ksen-lin pancake pancake pancake plague-spreader qz simexce simexce

Changes

24517

• Fix

abi

• Remove unused field in RCoreCmd and cfg.newtab

agent

• Register remote sessions when using the r2agent
• Add r2agent -L to list current sessions

analysis

• Simplify string processing in the anal.sbpf plugin
• If target arch is vm-based we may disable nopskip
• Initial import of the a:path plugin
• Fix #23554 - Handle agD subcommands
• Implement sBPF analysis plugin for Rust string resolution
• Add support for dynamic function prefixes
• Pave the road to support dynamic function prefixes
• Index __objc_msgrefs xrefs and parse last ss_selrefs
• Fix objc parsing on 32bit binaries
• Masquerade class bits in objc selector refs
• Handle argument in afci command

api

• Eliminate R_STR_DUP. just use strdup

arch

• Build the analysis plugin in default plugin and other goods for sBPF
• Fix Capstone's SBPF relative jump disasm syntax
• Initial import of the snes.pseudo asm plugin
• Add vax, snes and sbpf instruction definitions
• Add pseudocode plugin for VAX
• Improve the 6502 pseudo disassembler
• Integrate the bpf assembler in the capstone plugin and add tests
• Add support to assemble extended bpf64 instructions
• Implement support to assemble ST/LD classic bpf instructions
• Implement support for ldm/stm for arm32 assembler
• Implement support for 'pld' prefetch load for arm32
• Support umlal and more msr constructions for arm32 asm
• Implement crc32, rdrand and rdseed for x86 assembler
• Add support for lzcnt, tzcnt and popcnt x86-64 assembler
• Fix #7366 - Implement support for shlr/shrx/sarx for x86-64
• Implement support for the 'mrs' instruction in armass
• Fix #10038 - arm32 assembler affected by spaces
• Fix #21211 - support in the assembler more m68k instructions
• Make the m68k assembler available from the gnu plugin too
• Fix #20743 - Assembler for 'bsr eax, dword [4]' on x86_32
• Fix #11611 - Assemble 'call dword[mem32]' for x86_32
• Implement support for bpf pseudocode (alias sbpf)
• Fix arm64 assembler for 'stp x3, x3, [x0, 0x10]'
• sBPF minor fixes and better handling of Solana syscalls in ESIL
• Fix #24520 - Fix arm64 assembler for ldr x0,[x27,0x100]'
• Add one arm16 prelude shared with the gnu plugin
• Initial implementation of the pseudo plugin for msp430

asm

• Use bpf instructions descriptions for sbpf

bin

• Implement reloc 21 for VAX on ELF
• Store rawname in RFlagItem and expose it from RBinName
• Fix the RTTI-specific demangler and add more tests
• Use the quoted r2 commands for perf and avoid command injection
• Fix elf parser hang on malformed PT_DYNAMIC entry
• Fix #24572 - Detect sBPF binaries avoiding early symbol deps
• Enlarge symbol name limits aligned to flag sizes
• sBPF: Add better ESIL modelling and fix R_BPF_64_32 reloc
• Fix XNU kernelcache pointer undecoration logic
• Implement support sBPF ELF binaries
• The _selrefs and _msgrefs are not mandatory to parse objc metadata
• Remove global variable from the ninds plugin
• Remove global state in the RBin.mbn plugin
• Fix #14879 - Initial support for MobiCore MCLF
• Implement XNU IOKit class carving
• Fix JSON encoding of class addresses
• Add RBinClass instance size and type name fields
• Use R_FLAG_NAME_SIZE for class/methods flags

build

• Refactor meson build dependencies
• Initial work towards building for UEFI
• • Fix #22956 - Update acr to adjust the macppc triplet
• Fix preconfigure.bat for some setups
• Add brew recipe in dist/brew

ci

• Bump softprops/action-gh-release from 2.3.2 to 2.3.3

cons

• Respect ROWS/COLUMNS environment variables if defined
• Fix EOF when Control+Backspace is pressed
• Fix the invalid key.f15 error when pressing control+return
• Lookup table for the runes

core

• Initial real thready Core tasks support

crash

• Fix code injection bug in TAB from help
• Fix recent UAF when modifying rawname
• Fix infinite recursion in pvm://

debug

• Fix #24186 - Properly support Aarch64 FPU registers

disasm

• Fix
• Fix #24417 - Add asm.imm.base config variable

doc

• Third round reviewing and updating libr manpages
• Teach AGENTS.md about the laws in r2land
• Reviewing half of the libr manpages
• Autogenerate manpages for all the libraries

egg

• Use the decrypted shellcode wrapper and properly compute its size
• Initial work towards shellcode mangling
• Move all shellcodes into a subdirectory for processing purposes
• Make openbsd shellcode endian safe

flags

• Consider ~ a char to be replaced with "_"
• Initial implementation of autoflagspaces
• Add 'fsr' to the help message
• Implement the r_flag_closest_with_prefix api
• Add API to find the nearest flag inside a flagspace

fs

• Use :lsj/:mdj in the fs.io to pick file size info

http

• Add support for r2pipe client apis over http-post
• Support POST on /cmd
• Webserver config changes happen on every command

io

• Implement the R_IO_SEEK_HOLE
• Fix 'wcf' command for non disk usecases
• One more uri handler check for the double open cfile issue
• Initial import of the process_vm IO plugin

json

• Fix tfj empty object and trailing comma problems

lang

• Disable the vlang plugin, until ready to be updated

projects

• Use the right NUL device on Windows for rvc.git
• Save and restore bit and imm hints in the new projects

r2pm

• Fixed r2pm -ci r2ghidra not running on Windows 11

r2r

• Blind fix for the multi fail handling procedure in r2r

shell

• Add help for the ps subcommands
• Fix percentage in cf logs always showing 0% or 100%
• Bring back the 'is*' command
• Handle '?' in many f subcommands
• Fix #24325 - Another proposal to address this resize loop issue
• Show help for the ? in /a subcommands
• Add r2 -H R2_MANDIR
• Add R2_DEBUG_NOLANG variable to avoid loading RLang plugins
• Autocomplete flags after "f name="
• Add new math operators and sub-expression support for negation operators
• Fix warning in "is,"
• Alias fg/bg/jobs to ease core task usage

tools

• Fix rabin2 -D help like iD help works
• Deprecate -l and update manpage
• Load plugins with r2 -i too (not just scripts)

types

• Ignore include and var args definitions from type deletion
• Refine the core IOKit types
• Add core IOKit types
• Improved function pointer sdb storage and kv parser
• Implement tfc command without arguments listing them all

util

• Implement r_str_pad2 to avoid using the tls
• Clamp udiff scores, align_table allocations and remove dupped code

visual

• More vmatrix wishes pleased
• Fix scrollbar boundaries in vsharp
• Initial import of the vmatrix mode

wasm

• Avoid wasm builds from using long doubles

zignatures

• Implement support for mangled/demangled names