Authors

Aaron Thomas Adam - Zyph. Tech. Ali Ahmet Memiş Andrei Bacescu Andrei Bacescu Angelo Ayton Bhavay Goyal Francesco Tamagni Huzaifa Iftikhar HuzaifaChaudary Jay Hemnani Kayyo321 Kirby Kuehl Kisnner Obando Kushagra Mar Marcel Alexandru Nitan Matt Fulghum Mluo2011 Mohammed Hassan Nathan Chandrasekar Noah1 Ole André Vadla Ravnås Priyanshu Kumar SAIREX Yashvardhan Thanvi aeonframework arxhr007 astralia bdunahu condret dependabot[bot] h4ck-u jayhemnani9910 kaii-k mfulghum pancake pancake pancake phix33 potato qiyuhuating 祈雨

Changes

abi

• Completely eliminate CbPrintf from RBin

anal

• Look up bin symbols at rebased addresses by their file vaddr
• Don't give C main and C++ helpers Swift self/error args
• Count stack frames of 8 KiB or more in aat
• Keep array declarators whole in c2 function args
• Fix slow analysis of wasm and pyc functions declaring huge argument counts
• Remember DWARF location list picks and bound .debug_loclists reads per load
• Cap DWARF multidimensional DWARF types to stop blowing up the memory usage
• Drop cons+core dependency from rtti_itanium recover_all
• Cap Itanium VMI base classes at 64 and make avrr interruptible
• Walk DWARF children through a per-unit sibling table to stop quadratic time on nested DIEs
• Bound JNI method table scanning and cap Java descriptors at 255 argument slots
• Fix #14078 - Mask AVR jump targets with the flash byte-address width
• Shrink fcn/bb structs and cache block order
• Bound and trim gopclntab names to reduce memory usage
• Use RVec (instead of RList) for RAnalFunction->bbs
• Add types.maxtrace to bound the type propagation trace per function
• Use sanitized names for the class rename lookups and keys
• Skip unmapped gaps to fix DoS in aav/V
• Compare sanitized base names when deduplicating class bases
• Keep three-operand esil ops in the aeg dataflow graph
• Walk MIPS delay slots before branch arg recovery
• Fix leaked break frame in 64-bit MSVC RTTI base class parsing
• Fix O(n^2) renaming DWARF local names
• Clear stale zignature collisions when zac runs again
• Accept za C so z* output reloads its collisions
• Report the inline function attribute in aflj
• Fix RH850 ELF CPU detection and V850 CI regressions
• Fix V850 analysis boundaries and wrapped branch targets
• Describe and test Xtensa hardware loop setup conditions
• Fix xtensa stack frames, register roles and illegal ops
• Classify arm64 structure accesses and account for their SP writeback
• Drop stale clobber and preserve sets when redefining a cc
• Skip C++ vtable analysis in aaa for golang binaries
• Add afia command to list and set function attributes
• Add is_inline function attribute to RAnalFunction
• Include interrupt handlers in function graph export
• Store zignature collisions as one string per item
• Fix z/ renames on offset-only matches and slow collisions
• Fix zignature collision intersection in z/ matching
• Expose V850 branch predicates and correct pseudo address arithmetic
• Add IAR V850 calling convention and track movhi definitions
• Model V850 stack frames and dispose transfers correctly
• Name the read,write op direction instead of casting it
• Recover V850 scalar arguments and stack variables
• Fix default Thumb stack variable widths
• Distinguish unknown return types in afsj JSON
• Use register widths for Thumb argument recovery
• Fix duplicate java switch successors in afb
• Add the swift cc to 16-bit ARM analysis
• Fix arm16 cc args and preserve set in the 32-bit arm db
• Fix STM8 memory access metadata and pseudo AND
• Keep all argument registers in profile calling conventions
• Use the argument-structure ABI for i386 old mmap
• Record Linux syscall clobbers and the MIPS error register
• Parse the numeric IPv4 immediate hint as base 32
• Correct MIPS o32 syscall numbers and add socket calls
• Describe Linux syscall argument conventions across architectures
• Expose syscall arity and argument formats in asj
• Preserve delay slot in noreturn functions
• Expose int hints in analbytes
• Keep traversing successors after a missing basic block
• Correct PYC code permissions and MZ header virtual size
• Fix analysis section checks in physical address mode
• Stop analysis at non-executable sections
• Fix MIPS analysis continuing past invalid instructions
• Fix call-clobbered stack varnames for negative offsets
• Fix C++ function signatures with callable types for dwarf analysis
• Centralize function renaming to sync aan results
• Fix quadratic aav rescans of overlapping sections
• Optimize cubic time noreturn propagation in block automerge
• • (17min -> 23s)
• Expect the ARM64 switch recovered by larger prelude reads
• Use a configurable 64 KiB read buffer for prelude searches
• Stream prelude hits in address order with RSearch mode flags
• Scan all function preludes together with RSearch
• Analyze aap's prelude hits from the lowest address up
• Fix global registration with nonzero flag bases
• Reject conflicting global variable registrations
• Keep aea emulating an instruction past an access to unmapped memory
• Keep one read-ahead cache for each function walk
• Respect byte extents in ESIL function and block access scans
• Fix afsj address selection and failure status
• Recover IPA-RA arguments from cached register writes
• Use the caller cc at a direct call to an unanalysed target
• Ignore vector reads of a preserved register after a call
• Use the callee convention for copied FP argument widths
• Type arm64 float args by the width of their first read
• Fix global array sizes and type propagation
• Autoload API types through a library and OS dependency index
• Add GLib, GObject and GIO API type databases
• Add the gettext codeset function prototype
• Fall back to the target convention for unavailable function conventions
• Declare the ObjC runtime functions as objc4 does
• Support remaining ARM64 checked pointer arithmetic
• Analyze ARM64 tagged pointer subtraction
• Stop type propagation at constant argument assignments
• Preserve fixed-width integer types during signed inference
• Restore global flagspaces and exclude Dalvik metadata from globals
• Fix ARM64 code coverage across checked pointer arithmetic
• Add global type propagation and field inference in TP
• Add global discovery and typing from code accesses
• Fix reference scan tails and chunk alignment
• Fix x86 signed and floating access metadata
• Fix #26945 - Register and type globals automatically
• Recover arm64 args read by fp arithmetic and conversions
• Point relocated ARM xrefs at Thumb entries
• Keep pair slots on their access side, first src in aat/aht
• Find both stack slots of arm64 paired loads and stores
• Follow more sp restores: lea, arm32 writeback, typed zero
• Seed cleanup pads and mark the unwinder resume noreturn

analysis

• Look up bin symbols at rebased addresses by their file vaddr
• Don't give C main and C++ helpers Swift self/error args
• Count stack frames of 8 KiB or more in aat
• Keep array declarators whole in c2 function args
• Fix slow analysis of wasm and pyc functions declaring huge argument counts
• Remember DWARF location list picks and bound .debug_loclists reads per load
• Cap DWARF multidimensional DWARF types to stop blowing up the memory usage
• Cap Itanium VMI base classes at 64 and make avrr interruptible
• Walk DWARF children through a per-unit sibling table to stop quadratic time on nested DIEs
• Bound JNI method table scanning and cap Java descriptors at 255 argument slots
• Fix #14078 - Mask AVR jump targets with the flash byte-address width
• Shrink fcn/bb structs and cache block order
• Bound and trim gopclntab names to reduce memory usage
• Use RVec (instead of RList) for RAnalFunction->bbs
• Use sanitized names for the class rename lookups and keys
• Sk...

Authors

Abhi Angelo Ayton Ch1p Jon Palmisciano Mustafa Senoglu Priyanshu Kumar Suyun curoky dependabot[bot] kisnner mmustafasenoglu pancake pancake pancake phix33 potato sid xXAbieGamingXx

Changes

abi

• Eliminate the CbPrintf calls from RDebug
• Eliminate CbPrintf from RAnal
• Use RVec in RFlag

anal

• Avoid repeated CFG walks when chopping noreturn blocks
• Keep landing pads when chopping at a noreturn call
• Restore the stack depth when sp is set from bp
• Cache decoded ops to speedup backtracking type matching
• Stop function walks at symbols hidden behind class flags
• Run aae with just VAL, no more OPEX hacks
• Cache clobbered regs from dyncc profiles (20% faster)
• Cache calling convention lookups
• Take a split block's entry depth from the function walk
• Track stack frames larger than 8 KiB
• Add golang cc
• Default Swift binaries to the swift calling convention
• Fix the arm32 swift cc self, error and argument registers
• Keep swift self and error names through type propagation
• Fix opcode mask bit order and invalidating bits
• Analyze and emulate A64 consistent conditional branches
• Add A-key pointer authentication function preludes
• Don't register partial xrefs with aae
• Silence the noisy aae hints
• Fix microMIPS invalid instruction recovery in both backends
• Fix #21246 - Keep microMIPS instruction boundaries in pdf
• Fix #13850 - Recover stack strings passed to char pointer arguments
• Fix stack array indices across stack adjustments
• Read swift self and error roles from the linkage name
• Give the swift cc the platform clobber and preserve sets
• Rewind stack types with the bytes on a bbstate restore
• Rewind the stack with the registers on a bbstate restore
• Optimize trycatch analysis using binary metadata
• Resolve ARM64 stub island branches with a:sixi
• Use the active ARM configuration for pointer scans
• Restore incremental analysis after writes
• Fix Thumb ESIL scan alignment after skipped instructions
• Cache calling-convention argument locations per function
• Invalidate cached function ref counts with an xref generation counter
• Keep the other xrefs of an address when deleting one it does not have
• Recover small register arguments from shared operand metadata
• Share stack variable recovery and x86 access construction
• Fix #26760 - Refresh inferred x86-16 arguments
• Fix typed frame recovery and preserve renamed prototypes
• Preserve function prototypes during variable recovery
• Add fpret register names in callconvs
• Refer an arm64 load through the last adrp to the slot it reads
• Fix ARCompact branch conditions and immediate decoding
• Fix arm64 DWARF variable locations against sp and x29
• Resolve fcncc when assigned
• Fix arg class homing for spills, scanf and aliases
• Home each arg on the next free register of its class
• Resume switch tables from the walk instead of recursing into their cases
• Walk function blocks with an explicit stack instead of C recursion
• Dirty epoch for functions and types
• Fix float args from int regs home
• Record stack allocation, red zone and return mechanism per calling convention
• Number repeated DWARF locals
• Add the gettext family to the type database
• Track ARM64 switch address provenance and selected index bounds
• Recover complete ARM64 switches at their branch instruction
• Recover proven local ARM64 branch targets without fallthrough
• Keep unresolved indirect exits from implying noreturn
• Update instruction counts after noreturn block chopping
• Add DW_OP_call_frame_cfa location kind instead of faking a bp offset
• Respect anal.in bounds for bbwalk
• Br ends bbs even in jumptables
• Mov into bp is required to define frames
• Keep a variable's width when a signedness fact retypes it
• Keep a pointer's spelling instead of collapsing it to uint32_t
• Only type a variable as a pointer when the return is stored through it
• Chop a noreturn call that ends its block
• Don't invent new vars when accessing inside others
• Drop recovered variables inside a declared aggregate

analysis

• Avoid repeated CFG walks when chopping noreturn blocks
• Keep landing pads when chopping at a noreturn call
• Restore the stack depth when sp is set from bp
• Cache decoded ops to speedup backtracking type matching
• Stop function walks at symbols hidden behind class flags
• Run aae with just VAL, no more OPEX hacks
• Cache clobbered regs from dyncc profiles (20% faster)
• Cache calling convention lookups
• Take a split block's entry depth from the function walk
• Track stack frames larger than 8 KiB
• Add golang cc
• Default Swift binaries to the swift calling convention
• Fix the arm32 swift cc self, error and argument registers
• Keep swift self and error names through type propagation
• Fix opcode mask bit order and invalidating bits
• Analyze and emulate A64 consistent conditional branches
• Add A-key pointer authentication function preludes
• Don't register partial xrefs with aae
• Silence the noisy aae hints
• Fix microMIPS invalid instruction recovery in both backends
• Fix #21246 - Keep microMIPS instruction boundaries in pdf
• Fix #13850 - Recover stack strings passed to char pointer arguments
• Fix stack array indices across stack adjustments
• Read swift self and error roles from the linkage name
• Give the swift cc the platform clobber and preserve sets
• Rewind stack types with the bytes on a bbstate restore
• Rewind the stack with the registers on a bbstate restore
• Optimize trycatch analysis using binary metadata
• Resolve ARM64 stub island branches with a:sixi
• Use the active ARM configuration for pointer scans
• Restore incremental analysis after writes
• Fix Thumb ESIL scan alignment after skipped instructions
• Cache calling-convention argument locations per function
• Invalidate cached function ref counts with an xref generation counter
• Keep the other xrefs of an address when deleting one it does not have
• Recover small register arguments from shared operand metadata
• Share stack variable recovery and x86 access construction
• Fix #26760 - Refresh inferred x86-16 arguments
• Fix typed frame recovery and preserve renamed prototypes
• Preserve function prototypes during variable recovery
• Add fpret register names in callconvs
• Refer an arm64 load through the last adrp to the slot it reads
• Fix ARCompact branch conditions and immediate decoding
• Resolve fcncc when assigned
• Fix arg class homing for spills, scanf and aliases
• Home each arg on the next free register of its class
• Resume switch tables from the walk instead of recursing into their cases
• Walk function blocks with an explicit stack instead of C recursion
• Dirty epoch for functions and types
• Fix float args from int regs home
• Record stack allocation, red zone and return mechanism per calling convention
• Number repeated DWARF locals
• Add the gettext family to the type database
• Track ARM64 switch address provenance and selected index bounds
• Recover complete ARM64 switches at their branch instruction
• Recover proven local ARM64 branch targets without fallthrough
• Keep unresolved indirect exits from implying noreturn
• Update instruction counts after noreturn block chopping
• Add DW_OP_call_frame_cfa location kind instead of faking a bp offset
• Respect anal.in bounds for bbwalk
• Br ends bbs even in jumptables
• Mov into bp is required to define frames
• Keep a variable's width when a signedness fact retypes it
• Keep a pointer's spelling instead of collapsing it to uint32_t
• Only type a variable as a pointer when the return is stored through it
• Chop a noreturn call that ends its block
• Don't invent new vars when accessing inside others
• Drop recovered variables inside a declared aggregate

arch

• Stop treating arm64 sub to a non-sp register as a stack reset
• Fix arm64 shifted immediates in stack and value analysis
• Count only mips sp-to-sp add immediates as stack adjustments
• Count only immediate sp-to-sp v850 add/sub as stack deltas
• Fix the m68k link frame size for link.l and the pushed An
• Fix MIPS analysis for capstone 6
• Add CHKFEAT support to the A64 fallback
• Add GCSB DSYNC support to the A64 fallback
• Add CLRBHB support to the A64 fallback
• Add PACM support to the A64 fallback
• Fix A64 fallback and prelude instruction endianness
• Fix PAuth LR authentication with xzr operands
• Replace the GPL-copied bpf headers with an LGPL rewrite
• Relabel the v850 and stm8 arch plugins as GPL
• Relicense the snes pseudo plugin from MIT to LGPL-3.0-only
• Relicense binutils-derived arch plugins to GPL
• Enable BookE on 64-bit ppc with capstone 6
• Silently translate FEAT_PAuth_LR instructions
• Fix PPC analysis with capstone 6
• Fix SPARC analysis with capstone6
• Fix Capstone6 BPF analysis for BPF/JA and long jumps...

Authors

0xf00sec AGhebrea Aayush Khanna Angelo Ayton Bernhard M. Wiedemann Claude Jinbao Chen Kirby Kuehl Kleopatra Poritsi Mohammed Hassan Priyanshu Kumar Ruffalo Lavoisier Vaibhav Srivastava Vectrain51 mmustafasenoglu pancake pancake pancake phix33 phix33 potato root

Changes

abi

• Make RIOBind reads return byte counts
• Deprecate r_bin_is_static as requested by R2_590

anal

• Dont recover fp vars in frame-less functions
• Fix switch ownership when analyzing overlapping blocks
• Add arm64 swift convention for fpu args
• Rename default register arguments once when recovery ends
• Handle subregister arguments on x64
• Fix wrong variadic detection when eax is written before testing al
• Fix calling convention for arm64/swift fpargs
• Refresh VARTYPE metadata after variable renames
• Dont reuse fp args after calls
• Simplify floating-point argument recovery
• Add dyncc floating-point argument registers
• Memoize cc arg counts and skip fp walk on integer ops
• Recover float args from a separate fparg register sequence
• Fix readAhead UB in the function analysis loop
• Remove duplicate counted read bookkeeping
• Fix partial reads in analysis consumers
• Fix jump tables truncated by short reads
• Stop walking pc-relative indirect jumps as jump tables
• Analyze disconnected exception handler blocks
• Fix RAnalOp leaks in the disasm, diff and debugger decode loops
• Fix aeg folding ops without a dfg handler into constants
• Fix the memory leak and quadratic cost of aoj with many opcodes
• Fix dfg esil for goto and cmps
• Fix JSON disassembly architecture hints
• Use function call conventions for afsj arguments
• Fix fp local variable and arm32 reg tracking
• Resolve typed JNI table calls in analysis
• Typed JNI interface tables and indirection
• Materialize typed JNI native methods during analysis
• Add the new jni analysis plugin
• Stop afb and afbi from deleting switch cases that share a target
• Drop a stale arg from the float-formal expectation
• Separate a formal's ABI position from its sdb index
• Place formal parameters that DWARF leaves without a location
• Quiet aavrq to reduce noise in aaa
• Expose more switch details in the json output
• Forward register args through direct tail jumps like calls
• Match forwarded callee args by register instead of argnum
• Include the switch default target in block successor iteration
• Dont treat the returned int as a variadic marker
• Preserve registered types when linking DWARF prototypes
• Link DWARF types only when prototypes match
• Name local plt stubs in x86 retpoline layouts
• Free all flag metadata strings
• Name local plt stubs from their got relocs in aa
• Split the type propagation plugin into libr/anal/p/tp
• Warn for unresolved DWARF function return types
• Test bbstate restore doesnt rewind esil memory
• Bind exact DWARF function prototypes to their address
• Keep loop body register changes after the loop in aaft
• Honor address-linked function signatures
• Drop stale func arg keys when reanalysis recovers fewer arguments
• Fix local/global address detection for opmask in signatures

analysi

• Dont recover fp vars in frame-less functions
• Add arm64 swift convention for fpu args
• Rename default register arguments once when recovery ends
• Handle subregister arguments on x64
• Fix wrong variadic detection when eax is written before testing al
• Fix calling convention for arm64/swift fpargs
• Refresh VARTYPE metadata after variable renames
• Dont reuse fp args after calls
• Simplify floating-point argument recovery
• Add dyncc floating-point argument registers
• Memoize cc arg counts and skip fp walk on integer ops
• Recover float args from a separate fparg register sequence
• Fix readAhead UB in the function analysis loop
• Remove duplicate counted read bookkeeping
• Fix partial reads in analysis consumers
• Fix jump tables truncated by short reads
• Stop walking pc-relative indirect jumps as jump tables
• Analyze disconnected exception handler blocks
• Fix RAnalOp leaks in the disasm, diff and debugger decode loops
• Fix aeg folding ops without a dfg handler into constants
• Fix the memory leak and quadratic cost of aoj with many opcodes
• Fix dfg esil for goto and cmps
• Fix JSON disassembly architecture hints
• Use function call conventions for afsj arguments
• Fix fp local variable and arm32 reg tracking
• Resolve typed JNI table calls in analysis
• Typed JNI interface tables and indirection
• Materialize typed JNI native methods during analysis
• Add the new jni analysis plugin
• Stop afb and afbi from deleting switch cases that share a target
• Drop a stale arg from the float-formal expectation
• Separate a formal's ABI position from its sdb index
• Place formal parameters that DWARF leaves without a location
• Quiet aavrq to reduce noise in aaa
• Expose more switch details in the json output
• Forward register args through direct tail jumps like calls
• Match forwarded callee args by register instead of argnum
• Include the switch default target in block successor iteration
• Dont treat the returned int as a variadic marker
• Preserve registered types when linking DWARF prototypes
• Link DWARF types only when prototypes match
• Name local plt stubs in x86 retpoline layouts
• Free all flag metadata strings
• Name local plt stubs from their got relocs in aa
• Split the type propagation plugin into libr/anal/p/tp
• Warn for unresolved DWARF function return types
• Test bbstate restore doesnt rewind esil memory
• Bind exact DWARF function prototypes to their address
• Keep loop body register changes after the loop in aaft
• Honor address-linked function signatures
• Drop stale func arg keys when reanalysis recovers fewer arguments
• Fix local/global address detection for opmask in signatures

analysis

• Dont recover fp vars in frame-less functions
• Add arm64 swift convention for fpu args
• Rename default register arguments once when recovery ends
• Handle subregister arguments on x64
• Fix wrong variadic detection when eax is written before testing al
• Fix calling convention for arm64/swift fpargs
• Refresh VARTYPE metadata after variable renames
• Dont reuse fp args after calls
• Simplify floating-point argument recovery
• Add dyncc floating-point argument registers
• Memoize cc arg counts and skip fp walk on integer ops
• Recover float args from a separate fparg register sequence
• Fix readAhead UB in the function analysis loop
• Remove duplicate counted read bookkeeping
• Fix partial reads in analysis consumers
• Fix jump tables truncated by short reads
• Stop walking pc-relative indirect jumps as jump tables
• Analyze disconnected exception handler blocks
• Fix RAnalOp leaks in the disasm, diff and debugger decode loops
• Fix aeg folding ops without a dfg handler into constants
• Fix the memory leak and quadratic cost of aoj with many opcodes
• Fix dfg esil for goto and cmps
• Fix JSON disassembly architecture hints
• Use function call conventions for afsj arguments
• Resolve typed JNI table calls in analysis
• Typed JNI interface tables and indirection
• Materialize typed JNI native methods during analysis
• Add the new jni analysis plugin
• Stop afb and afbi from deleting switch cases that share a target
• Drop a stale arg from the float-formal expectation
• Separate a formal's ABI position from its sdb index
• Place formal parameters that DWARF leaves without a location
• Quiet aavrq to reduce noise in aaa
• Expose more switch details in the json output
• Forward register args through direct tail jumps like calls
• Match forwarded callee args by register instead of argnum
• Include the switch default target in block successor iteration
• Dont treat the returned int as a variadic marker
• Preserve registered types when linking DWARF prototypes
• Link DWARF types only when prototypes match
• Name local plt stubs in x86 retpoline layouts
• Free all flag metadata strings
• Name local plt stubs from their got relocs in aa
• Split the type propagation plugin into libr/anal/p/tp
• Warn for unresolved DWARF function return types
• Test bbstate restore doesnt rewind esil memory
• Bind exact DWARF function prototypes to their address
• Keep loop body register changes after the loop in aaft
• Honor address-linked function signatures
• Drop stale func arg keys when reanalysis recovers fewer arguments
• Fix local/global address detection for opmask in signatures

api

• Add R_LOG_HINT which is unset for automatic steps
• Replace system bits packing with generic value packs

arch

• Take the arm32 immediate shift carry from the source register
• Mask the arm32 shi...

Authors

AGhebrea Abhi Anton Bolshakov Claude Evgeny Kolmakov Hissssst MiKi Mohammed Hassan Mohammed Hassan OrbisAI Security ProMix Ricardo J. Rodríguez ada-l0velace arhwx dependabot[bot] gogolovefish neil nnguyen609 pancake pancake pancake phix33 phix33 potato ryawa

Changes

abi

• Pahole more structs to drop gaps and reduce struct size
• Make RCons authoritative for command help rendering
• Unify the struct and union member model into RAnalTypeMember
• Use BE bool flag (instead of int le) for utf16->utf8

anal

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Name the stack canary from a register write index instead of trace position
• Fix cc stack arg slot offsets and bound the argslot scans
• Fix the double return-address skip in the callargs stack walk
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Keep fail-only fallthrough edges in the function graph
• Fix arm64 =SN syscall register alias to follow asm.os
• Use stateful decoding in the /r, aea and aespc linear sweeps
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Unify struct and union field picking and simplify the const retype in aaft
• Propagate callee types into struct and union fields during aaft behind types.fields
• Add anal.gpseed to seed a PIC base register during ESIL analysis
• Use r_anal_block_successor_addrs_foreach to build the function graph
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument access patterns (afts)
• Better call clobbered register detection for arm64
• Honor calling convention clobbers in ESIL analysis
• Add r_anal_cc_isclobber API
• Emulate bbs in CFG order for the type matcher
• Add callconv for all archs (updates clobber and preserve info)
• Fix pdb/dwarf union parsing to fill the union member vec
• Add clobber and preserve register for ppc and arm callconv
• Dont pick ppc TOC pointers as function argument registers
• Mark variadic libc functions properly and fix caller arg over-recovery
• Restore arm32 AAPCS register args r0-r3 in calling convention

analysis

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument access patterns (afts)
• Better call clobbered register detection for arm64
• Honor calling convention clobbers in ESIL analysis
• Add r_anal_cc_isclobber API
• Emulate bbs in CFG order for the type matcher
• Add callconv for all archs (updates clobber and preserve info)
• Add clobber and preserve register for ppc and arm callconv
• Dont pick ppc TOC pointers as function argument registers
• Mark variadic libc functions properly and fix caller arg over-recovery
• Restore arm32 AAPCS register args r0-r3 in calling convention

api

• Use the formatted sdb setters
• Use the new formatted SDB getters -200LOC

arch

• Fix opcode decoding and endian selection in the ppc.gnu plugin
• Pseudo for ppc ctr branch
• Add the missing operand count to the PowerPC lfiwax pseudo rule
• Keep every operand in the mips and sparc pseudo fallbacks
• Widen the PowerPC word rotate masks to the full ISA MASK
• Simplify the cr0 and trap helpers in the PowerPC pseudo filter
• Decode hex trap conditions and the folded unconditional trap forms
• Fix the rldicr rotate mask being taken from the rldic rule
• Dispatch the PowerPC pseudo fixups by mnemonic instead of table position
• Keep every operand when no PowerPC pseudo rule matches
• Add the missing isel rule to the PowerPC pseudo table
• Fix PowerPC bclrl link register handling
• Support the capstone v6 PowerPC operand and branch predicate model
• Write LR on the linking conditional branch-to-ctr forms even when not taken
• Workaround ppc.cs UB bug causing random esil test fail (capstone followup)
• Fix x86 rip-relative ptr for zero-displacement destination operands
• Fix PPC mfspr/mtspr decoding, stwu/stdu stack detection and vle archinfo
• Type arm64 flag-setting adds/adcs/subs/ands/bics in ESIL analysis
• Remove capstone v3 support, capstone 4 is the minimum
• Fix the v35 plugin build and stop typing valid arm64 instructions as ILL
• Fix MIPS conditional branch-and-link (bgezal/bltzal) jump target
• Fix arm.gnu Thumb branch and svc/udf imms
• Gate PPC toc_map TOC with RArchOpMask.STATEFUL and wire it into aar
• Early error handling when arch is not initialized
• Fix PPC conditional lr/ctr branch aliases incorrectly decoded as jmp2zero
• Add RArchOpMask.STATEFUL and RArchSession.reset
• Invalidate the toc_map base register on PPC update-form loads and stores
• Invalidate the cached t9 call target on untracked writes and drop the mips.gnu decoder state
• Accept MIPS ISA CPU names

bin

• Fix signed underflow case for ppc elf imports
• Preserve PE section names when COFF strings are unavailable
• Strictier coff magic check
• Gate the ppc64 opd and glink logic by ELF ABI and fix the ELFv2 stub stride
• Fix out-of-bounds read on the SOM dynamic loader string table
• Fix uninitialized .NET stream sizes
• Pack bin vector element structs
• Better DEX header and string validation with less code
• Reject malformed DEX headers before string parsing
• Add v128, ref and reftype support for wasm
• Initial implementation of the rust v0 demangler
• Implement iuo command to open resoUrces inline
• The old iU is now under iu, same goes for rabin2 -u
• Move the rabin2 -u feature into an env var
• Some binfiles require custom resource retrievals
• Add raw resource extraction controls
• Add iU, table output and handle invalid subcommands
• Add support for encoded resources and extraction
• List demangler plugins as part of rbin
• Make RBin demanglers pluggable and selectable
• Handle macho resources on 64bit fat slices too
• Add support for GLib Resources inside ELF files
• Expose macho code signature and certificate as resources
• Add dir.binsdb (from binpath/dirprefix) for PE/MDMP ordinal lookups
• Parse and expose PE/CLR Resources
• Add OS/2 LE/LX resource support
• Add ix command for extract sections, segments and resources
• Rename iR to iU and add iUx extraction
• Implement resource extraction api wired to rabin2...

Authors

Abhi Evgeny Kolmakov Jon Palmisciano Kevin Stubbings Lazar Aleksic Luisss003 Nitan Alexandru Marcel Ole André Vadla Ravnås ada-l0velace bdunahu dependabot[bot] pancake pancake pancake phix33 phix33 potato randomjack94dev

Changes

abi

• The sdb_remove has been deprecated as dupe for sdb_unset

analysis

• Keep duplicate single-instruction import trampolines distinct on name collision
• Autoname import call stubs after the imported function
• Don't create string metadata at addresses inside analysed functions
• Add pebble script for stub scans
• Optimize SDB key renames in analysis metadata
• Ship the syscall tables for PebbleOS
• Render array stack var element accesses as name[i] in disasm
• Shadow phantom stack vars overlaid by an array-typed variable's extent
• Optimize a:six and add more tests for it
• Fix afv mislabeling DWARF register locals as args by honoring isarg
• Fix PPC bctrl losing CALL type under capstone6 via BCCTR/BCCTRL alias ids

arch

• Harden PPC64 TOC tracking by invalidating toc_map on register clobber, call and return
• Invalidate the PPC TOC register cache on function return
• Validate asm.cpu against plugin CPU list
• Default cpu for avr is now ATxmega128a4u
• Fix PIC disassembler on big endian hosts
• More ARM big endian fixes
• Update capstone v5/next, bigendian, m68k and x64 fixes

asm

• Apply the pseudo filter only once in rasm2 and pad

bin

• Fix obf reload stacking duplicate bin objects and io maps
• Autoresolve anal.gp for ppc32 via small-data
• Handle as cyclic memory the raw string map address wraparounds
• Honor paddr in raw strings
• Fix raw string rebasing for non-VA sections
• Fix #10722 - Respect mapaddr on raw strings
• Optimize dyldcache local symbol matching
• Fix #26079 - Local symbols missing in dyldcache
• In ftab/gns1 use segment tags for proper archinfo
• Harden GNS1 loader
• Add FTAB extractor plugin
• Improve GNS1 detection to solve dyldcache false positives
• Require spaced arguments for iz+
• Fix dyldcache local symbol offset matching
• Add R_DYLDCACHE_NO_DEPS option for shallow filtering
• Auto-resolve PPC64 TOC base (anal.gp) for ET_REL and ELFv2
• Fix fuzzed PE timeout bug, clamping vsize
• Reduce false positives in the PL PEs id
• Add Rust and D demanglers
• Add new C++ demangler
• Add IBM XL demangler
• Add ARM ABI demangler
• Add ldmap.r2.js script to load sourceline from ldscript map files
• Fix more bigendian parsing bugs for PE
• Fix kernelcache parsing on bigendian
• Fix SFC parsing on big endian
• Fix big endian parsing bug for MDT
• Implement idd command
• Apply PPC64 TOC16 relocations to addis/ld immediates on ET_REL
• Clean LE endian-safe parser
• Detect ppc32 e500/e500mc cpu from .PPC.EMB.apuinfo note
• Fix memory leaks in the mdmp parser
• Fix misaligned PPC ET_REL REL24/REL14 relocation targets

build

• Fix riscv_cs capstone mode detection for all capstone versions
• Move Nix stuff into dist/nix
• switch to rev for sdb
• Bump softprops/action-gh-release from 3.0.0 to 3.0.1
• update zydis subproject url for nix
• Add Nix flake and dev shell support
• Use #ifdef CS_VERSION_PRE_RELEASE instead of CS_NEXT_VERSION version guard for riscv_cs capstone mode
• Fix subproject updates
• Meson use_sys_zydis: find library as capital "Zydis"
• Detect system zydis without pkgconfig + ppc fixes

cons

• Use RStrConstPool for RConsMark names
• Fix console context races and UAF when running background tasks
• Fix bluy theme color for swi/new instructions
• Fix #25984 - Support negative internal grep columns
• Reset terminal with RCons in a portable way

core

• Fix numvar reference math state handling

crash

• Fix HFS+ filename UTF-8 buffer sizing
• Fix null deref when RBinInfo callback is null
• Fix p= sparse map allocation crash
• Fix len multiply overflow in r_str_utf16_encode
• Fix len multiply overflow in r_str_escape_utf
• Fix len multiply overflow in escape_utf8
• Fix sz multiply overflow in r_str_escape_raw
• Fix #26047 - allocation size overflow in r_str_word_get0set
• Fix count overflow in x examine command
• Fix blocksize multiply overflow in pfb command
• Fix integer overflow in pxAv print command
• Fix signed overflow and null deref in pv print command
• Fix #26048 - integer overflow in pb
• Fix #26051 - oobread on truncated mdmp files
• Fix #26049 - cmd.load descriptor UAF in bin load
• Fix #26045 - r_str_append signed length overflow
• Fix #26044 - UAF in pde, regprofile changing inside the loop
• Fix more OOB read bugs in the java parser
• Fix #26043 - 2 byte oobread bug in RBinJava line number table parser
• Fix #26042 - Fix aos opcode count overflow
• Fix #26046 - Harden and optimie RStr.replace for irreal 2 milion length strings cases
• Fix #26035 - Oobsfaults in omba, ombd and ombg commands
• Fix more empty buffer issues in bin2strdup callers
• Fix assert with 0 length quoted strings in w

debug

• Fix cons push leak in RDebugIo reg profile
• Open self with api instead of commands in r2preload
• Fix GDB register cache bounds and ownership checks

diff

• Use RCons.printf in core/gdiff

disasm

• Support hexdump/disasm addresses in octal base
• Unify asm.addr.base10/36 into asm.addr.base
• Fix overlapped strings length using RAnalOp.ptrSize
• Apply the pseudo filter only once in the disasm pipeline
• Preserve spaces in constructed string comments

esil

• Model PPC XER.CA ESIL for add/subtract-with-carry and algebraic shift-right
• Isolate ESIL registers for type link propagation
• Use local ESIL for type link propagation
• Unify ESIL constructors behind an REsilOptions struct
• Use core ESIL step-back for dsb
• Consolidate ESIL step-back history and tests
• Report ESIL step-over stop status
• Improve stepover and more aeso tests
• Print ESIL cmd handler values in hexadecimal
• Honor esil.iotrap in core ESIL stepping
• Rewrite ESIL stepping around core single step
• Get rid of esil.verbose
• Use ESIL voyeurs to track refs
• Reload core ESIL callbacks on arch changes
• Fix PPC indexed load/store, shift/rotate/divide and sign-extend ESIL
• Add ESIL for PPC scalar floating-point load/store/arith/convert ops
• Fix floating point emulation bug on 32bit
• Fix error handling in esil poke
• Fix esil poke on big endian hosts
• Add ESIL for PPC integer/logical/rotate/mod ops and fix subfze/nor/nand
• Add ESIL for the PPC isel conditional-select instruction
• Pass ESIL instances to arch callbacks
• Use local ESIL stats for ROP classification
• Tighten core ESIL step and trap handling
• Clean up core ESIL config and interface plumbing
• Treat unreadable pin PCs as handled in core ESIL
• Fix ESIL alias voyeurs seeing updated registers
• Add core ESIL lifecycle and stepback support

fs

• Fix HFS+ catalog filename conversion
• Avoid heap allocation in HFS+ catalog key compare
• Expose addrline dwarf info in the r2 virtual filesystem
• Fix ntfs utf16 filenames on bigendian

http

• Fix prefix and www root fallbacks

io

• The dsc io plugin is not a block device
• Fix memory leak in io.self on close
• Fix windows block device identify

muta

• Fix endian bugs in the serpent

print

• Implement pFJ for JWT token decoding
• Add the CLd for source baked decompiler command
• Add RTableOptions.wrap and more markdown improvements
• Extend all p-/p= with json and better bounds
• Fix #26034 - pf beyond blocksize prints zeros

pseudo

• Simplify pdc helpers and remove redundant null checks
• Refactor pdc line emission and loop goto filtering
• Resolve pdc global folds from analysis metadata
• Recover varnames with gp relative globals for pdc signatures
• Hold asm.addr.base for pdc too
• Reset asm.addr.relto in pdc to not break pseudo disasm
• Fold resolved TOC global loads into flag names in pdc

r2r

• Fix token test terminal reset expectation

refactor

• Use r_read_ble32 in rtti_msvc

reg

• Document lowercase register roles for dyncc

search

• Use isolated ESIL VM for gadget search
• Use local ESIL in search commands
• Preserve gadget class details
• Unify gadget class storage
• Fix legacy ROP classification correctness

shell

• Add r2vsql in the fallback command handler
• Shorten alias help messages
• Fix 'join' command argument parsing

socket

• Fix PTY dynapi initialization in socket redirection

tests

• Improve and document REQUIRE in r2r
• Some tests require zydis

tools

• Fix binary number parsing in rasm2
• Rafs2 wasnt included in binr/blob

types

• Fix type lookups for long function names
• Add 'tsn' to lookup struct names by size
• Add ten command for enum lookup by numeric value
• Support union offsets in type member lookup

util

• Optimize RStrBuf.slice - 30% faster
• Render inline markdown ...

Authors

AGhebrea AGhebrea Abhi Claude Dirk Mueller Dirk Mueller Hinotobi Mattia Galuppi Michał Mnich Ole André Vadla Ravnås Priyanshu Kumar WearyTraveller42 aviciano condret davidpolverari dependabot[bot] orbisai0security pancake pancake pancake phix33 phix33 potato randomjack94dev s-zaizen

Changes

abi

• Add command file string API
• Migrate RBinSymbols from RList to RVec
• Get rid of the backward compat r_core_cmd_calls (Use r_core_call)

anal

• Rename anal.flagstop to .flagbounds and clarify diff w/ anal.flagends
• Add anal.flagstop function boundary option
• Fix PPC positive conditional branches
• Fix garbage upper bits in xref/heap table size columns (ut64 casts)
• Add and test static x86 clobber cc metadata
• Add static x86 calling convention preserve metadata
• Add static x86 calling convention stack cleanup metadata
• Improve static and indirect call convention analysis
• Improve static x86 calling convention stack cleanup
• Stabilize register index ordering
• Honor calling convention register clobbers
• Track callee-popped stack arguments
• Resolve dynamic calling conventions lazily
• Add dynamic calling convention parser
• Generalize calling convention location accessors
• Use dyncc calling convention for isvm archs
• Add tests for static calling convention multi-return
• Fix static calling convention argument lookup
• Handle two-operand imul and idiv
• Use indexed return registers in calling conventions
• Initial support for multireturn in calling conventions
• Recover ObjC inheritance in analysis classes
• Better default fcn names, respect symbols
• Extend RBinMeta for Java/Dalvik/MSIL dynamic callconvs
• Stack based dynamic calling convention fix for Java
• Support dynamic calling conventions for Java and Dalvik
• Fix switch analysis for latest DEX
• Show branch cases in afbtj
• Speed up function basic block lookup a bit
• Keep SwitchOp.dependency ops in afbt, Vc and pdc
• Reduce type propagation churn and false positives
• Simplify type propagation backtrace state
• Tighten type trace access matching
• All public var apis use RVec now
• Configurable jumptable maxcases
• Fix stale Rust jump table bounds
• Fix x86 jump table autosizing for Rust niche switches
• Refactor jump table decoding and case analysis
• Clamp switch case counts and borrow register names
• Fix afbt script output and sparse zero entries
• Redesign and extend the jump/switch table API and commands
• Rename afj to afbt and add a test
• Fix arch value handling for stack operations
• Tighten x86 stack operand analysis
• Populate Xtensa value metadata for stack analysis
• Populate RISC-V stack value metadata
• Populate MIPS value metadata for stack analysis
• Fix ARM stack variable substitution
• Populate ARM value metadata for stack analysis
• Rewrite stack variable extraction around values
• Stop using ESIL in function analysis
• Fix MIPS register argument recovery
• Fix bug in 'as command' not showing the right syscall
• • The afbc forces the address to be the first of the basic block if any
• ArenaPushPop uses CoW optimization
• Fix infinite loop in the codemeta
• Support pining functions with custom emojis
• Fix CID 1654963,1654964,1654965 - check r_esil_get_parm_strs retval in set_mem dfg
• Fix CID 1654968 - check r_esil_get_parm_strs retval in esil_dfg
• Add missing anal.plugins.pre config var

analsys

• Rename anal.flagstop to .flagbounds and clarify diff w/ anal.flagends

analysis

• Add anal.flagstop function boundary option
• Fix PPC positive conditional branches
• Add and test static x86 clobber cc metadata
• Add static x86 calling convention preserve metadata
• Add static x86 calling convention stack cleanup metadata
• Improve static and indirect call convention analysis
• Improve static x86 calling convention stack cleanup
• Stabilize register index ordering
• Honor calling convention register clobbers
• Track callee-popped stack arguments
• Resolve dynamic calling conventions lazily
• Add dynamic calling convention parser
• Generalize calling convention location accessors
• Use dyncc calling convention for isvm archs
• Add tests for static calling convention multi-return
• Fix static calling convention argument lookup
• Handle two-operand imul and idiv
• Use indexed return registers in calling conventions
• Initial support for multireturn in calling conventions
• Recover ObjC inheritance in analysis classes
• Better default fcn names, respect symbols
• Extend RBinMeta for Java/Dalvik/MSIL dynamic callconvs
• Stack based dynamic calling convention fix for Java
• Support dynamic calling conventions for Java and Dalvik
• Fix switch analysis for latest DEX
• Show branch cases in afbtj
• Keep SwitchOp.dependency ops in afbt, Vc and pdc
• Reduce type propagation churn and false positives
• Simplify type propagation backtrace state
• Tighten type trace access matching
• All public var apis use RVec now
• Configurable jumptable maxcases
• Fix stale Rust jump table bounds
• Fix x86 jump table autosizing for Rust niche switches
• Refactor jump table decoding and case analysis
• Clamp switch case counts and borrow register names
• Fix afbt script output and sparse zero entries
• Redesign and extend the jump/switch table API and commands
• Rename afj to afbt and add a test
• Fix arch value handling for stack operations
• Tighten x86 stack operand analysis
• Populate Xtensa value metadata for stack analysis
• Populate RISC-V stack value metadata
• Populate MIPS value metadata for stack analysis
• Fix ARM stack variable substitution
• Populate ARM value metadata for stack analysis
• Rewrite stack variable extraction around values
• Stop using ESIL in function analysis
• Fix MIPS register argument recovery
• Fix bug in 'as command' not showing the right syscall
• • The afbc forces the address to be the first of the basic block if any
• ArenaPushPop uses CoW optimization
• Fix infinite loop in the codemeta
• Support pining functions with custom emojis
• Fix CID 1654963,1654964,1654965 - check r_esil_get_parm_strs retval in set_mem dfg
• Fix CID 1654968 - check r_esil_get_parm_strs retval in esil_dfg
• Add missing anal.plugins.pre config var

api

• Move markdown rendering code into a separate file

arch

• Add OpType/ESIL for PPC dword shifts, X-form ld/st, cntlz, mulh, CR moves
• Fix signed/endian branch-target analysis in vax, dalvik, xap, arm.gnu and java
• Fix sparc.gnu endian disassembly
• Fix capstone v5 M68K patch application
• More BE fixes even for capstone
• m68k big endian capstone bug patch
• More arch goodies for virtual regs
• Update wasm3 support for try/mmx ops
• Fix aarch64 big endian be8
• Update capstone v5/next for the x86 perf boost
• Fix STM8 pointer offset operands and jump targets
• Add opt-in Zydis x86 arch plugin
• Optimize the cs_len_prefix_opcode helper for x86
• Add RArchInfo.WODST for archs with write-only destination operands
• Stack allocate insn to avoid malloc/free in arm.cs
• V850 ESIL: Fix flags, sign-extension, bit ops, shifts
• Fix v860 esil sign, bit ops like shifts and update flags

asm

• Cleanup ppc.nz handlers and emit_ppc comments
• Add ppc.nz r_asm encoder plugin
• Refactor r_num_math error handling in asm
• Fix memory leak in x86_nz parseOpcode error paths

bin

• Add remove class ..field/:inheritance info with ic[+-]
• Fix per-section reloc cap dropping relocs on multi-section ET_REL objects
• Fix signed-char Swift super-class and field-type parsing in mach0
• Fix iS/iSS flags column showing garbage upper bits
• Emit dynamic calling conventions from bin metadata
• Implement RBinPlugin.getCc for dotnet,java,dex,python and wasm
• Parse valid wasm sections 12 and 13 (datacount + tag)
• RBinStrings are now stored in a vector
• Speed up COFF bigobj loading
• Preallocate flag storage from cbin
• Store flag names in arena and fix DEX leaks
• Keep trimmed RBinString.length sync
• Fix objc/macho/swift parsing bugs on big endian
• Dettach reloc_fixups from load_unnamed
• Migrate RBinSection store from RList to RVec
• Invalidate addr2klassmethod when ic- removes a method
• Use RVec for Mach-O reloc fixups
• Add r_bin_class_add_method and surface class methods
• Use chained fixup page size for mach0 swizzle chunks
• Fix Coverity static analysis findings
• Avoid stale COFF relocation symbol pointers
• Fix integer overflows in dex_parse_class_method_addrline
• Add bin.meta config var to permit disabling the codemeta info
• Lazy-load DEX addrline debug info
• Extend 'ies'...

Authors

0xf00sec AGhebrea Abhi Adam LaPoint Adam Satko Ahmethan G. Claude Jake Lamberson Ole André Vadla Ravnås Quentin Buathier awlapoint-afk buzzer-re condret jro-calif jwntree pancake pancake pancake phix33 potato

Changes

analysis

• Use dash for callargs modifier and support rnum expressions
• Rework aCe/aCf to support plaintext, JSON and r2 output modes
• Improve scoring strategy for the function autoname
• Fix arm64 jmptbl detection for multi-LEA dispatchers
• Fix leak, dead branch and int overflow in jmptbl code
• Fix some possible command injection analysis scripts
• Fix afv* for afvr variants
• Extend RAnalPlugin to hook preanalysis commands if elligible
• Add r_anal_xrefs_setf to avoid fcn lookups for a 3% speedup
• Better conditional return instructions support (z80, arm, nds32)
• Remove redundant zeroing in RAnalOp.init
• Refactor autoname into analysis plugin (a:autoname)
• Performance improvements in arch and analysis
• Add RAnalPlugin.thumb to scan code for mode-switch hints
• Resolve PPC64 ELFv1 TOC-relative address chains in
• Add more binary magic signatures to is_bin() in data
• Remove r_anal_archinfo in favor of r_arch_info
• Use R_ANAL_DATA_TYPE_ZERO for zero-filled data instead of INVALID
• Implement wide string length measurement in is_string()
• Import the C rewrite of the gopcintab plugin by @AsherDLL
• Materialize switch cases through core analysis
• Expose typed function context with params, stack slots, and base types

arch

• Fix a bunch of logic bugs for v850 esil
• Improve pseudo for nds32
• Refactor the nds32 esil cooker from O(n) to O(1)
• Support inline function calls for NDS32 via ESIL
• Cache capstone options in x86/arm/mips arch plugins
• Improve ESIL for v850
• Fix satsub disasm text for v850
• Refactor nds32 ESIL argument handling for O(1) access and safer parsing
• Extend nds32 optype and esil support
• Use encoder fallback in arch session encode

asm

• Initial generic support for camel syntax
• Use the RArch api from RAsm instead of the anal callbacks

bin

• Fix a couple of boundary checks causing minor oobreads in the dmp parser
• Fix logic bugs, cleanup and simplify the PDB parser
• Fix memory leaks, endian issues and major cleanup for WAD
• Fix logic bugs, memory leaks and cleanup in the OMF parser
• Fix logic bugs, memory leaks and cleanup in the mach0 parsers
• Fix logic bugs, type mismatches and missing bounds checks in the ELF parser
• Cleanup and fix logic bugs in the DEX parser
• Fix memleak, off-by-one and unchecked init failure in the XCOFF64 parser
• Fix wrong type and unchecked read in PE section parsing
• Fix UB reads in the XBE parser
• Fix OOB loops in resize_section, del_rpath and segment_perms for elfwrite
• Segment permission patching for mach0s
• Implement rabin2-OP to patch segment permissions (Op is for sections)
• Improve elf write via rabin2 -O to patch segment permissions
• Use API (instead of cmd) and check for double redirects for bclass
• Add support for nds32 elf relocs
• Limit Swift demangler substring appends to 255 bytes
• Improve special hint symbols for ARM (elf/macho)
• Support more v850 relocs
• Extend Swift demangler with more abbreviation tables and conforms
• Improve class name extraction from demangled Swift symbols
• Fix ppc64be imports, symbols and entrypoint addresses
• Fix #25715 - wrong string vaddrs in kernelcache plugin for fat Mach-O binaries
• Entorce bclass sanitize right before use in core
• Fix #25707 - slow iOS kernelcache loading by bulk-reading into memory
• Fix memory leaks and unnecessary checks for dyldcache
• Fix memory leaks in the DEX parser
• Fix memory leaks in the PE parser
• Fix ELF versioninfo bounds and dynstr guards
• Fix clear deinits, memleaks and a heap overflow in mach0
• JNI_* symbols must be listed as entry-symbols via ies
• Autoload JNI types when loading
• Fix #24453 - Remove fixed flagName size
• Fix mdmp loop count underflow in bounds check
• Maxbound strings to 512 chars
• Clean up PE delay import parsing
• Fix PE delay import directory parsing
• Fix bin.limit consistency in Mach-O and .NET
• Fix memory leak when using RBinLimit with DEX
• Respect RBinLimit for PE too
• Respect RBinLimit in DEX
• Make bin.limit consistent across bin listings
• Respect RBinLimit when preallocating arrays in ELF and MACHO

build

• Install to lib64 on Fedora/RHEL/SUSE
• Fix quarantine related build error with scmangle
• Fix compilation in illumos

ci

• Add github actions for radare2
• Compile with FilC and ship the artifacts

cons

• Fix tv_usec overflow in r_cons_readchar_timeout for msec >= 1000
• Fix OOB write and underflow in winutils __fill_tail
• Fix overlapping strncpy in dietline kill-to-start handlers
• Fix cursor restore and OOB read in w32 xterm size probe
• Fix width clipping arithmetic in r_cons_print_at
• Fix rainbow buffer realloc and zero-size handling in r_cons_rainbow_new
• Shorter codepath for color2rgb
• Performance improvements in grep, dietline and canvas
• Fix parsing bold ansi colors to html

core

• Rename RCore.cmdCall to RCore.call
• Clarify cfg.sandbox.grain help text
• Fix endianness handling in cmd_write_inc
• Fix @@c parsing regression in @dp/@dr handling
• Rename R_CORE_LOADLIBS_ALL to R_LIB_LOAD_ALL
• Introduce R2_PLUGINS_ORDER to specify locations

crash

• Fix UAF when loading the same r2js script twice
• Fix some more integer overflows in NSO TE PE NE
• Extra check for boundary checks in the kernelcache
• Fix partial read bug in truncated kernelcache files
• Fix some integer overflows causing undersized allocations resulting in oobwrites
• Fix ubread in io.maps=bin.sections
• Fix invalied underflow state in the rbtree
• Fix integer underflow in the wfs command
• Fix overflowed array index in the rap server
• Avoid reading tainted phnum in ELF and cache a valid one once
• Harden winkd packet parsing against malformed KD/KDNet input
• Harden PDB parser against malformed TPI/DBI streams
• Fix multiple OOB reads and overflows in PDB parser
• Fix infinite loop and uninitialized free in PDB DBI module parser
• Fix r2 script injection via DWARF filenames in idL* output
• Fix oobread bug in r2k-linux and major cleanup
• Fix several oobread/oobwrite issues in shlr/gdb
• Fix several oobread/oobwrite issues in shlr/qnx
• Fix #25786 - heap buffer overflow in qnxr_read_memory
• Fix nds32_init_args crash + other side bugs spotted in the process
• Fix null deref in r_flag_tags_list when sdb is corrupted
• Refactor MSVC RTTI name reader and fix unchecked read loop
• Fix non-null terminated and zerosize file slurp bugs
• Fix OOB write and underflow in winutils __fill_tail
• Fix double-free and silence OOB warnings in r_cons_canvas_resize
• Fix OOB pointer arithmetic in regex p_bracket lookahead
• RFile.new can now take null as root without crashing
• Fix use-after-free and silent truncation in lines cache init
• Fix uaf in the elf parser
• Fix buffer overflows in xtensa disassembler
• Fix buffer overflows in tms320 disassembler
• Fix buffer overflow in m68k disassembler
• Fix buffer overflows in cris disassembler
• Fix buffer overflows in arc disassembler
• Limit ASN.1 hex string expansion to prevent memory exhaustion
• Fix GNS1 segment bounds checks to avoid overflow
• Avoid copying partial or overflowed ansi codes in rcons
• Fix uaf in r_asm_from_string
• Fix buffer overflow in dietline gcomp_line copy operations
• Use r_config_set API instead of r_core_cmdf for anal.cc
• Fix heap-buffer-overflow in macho parse_import_stub
• Fix OOM in mdmp parser due to unsigned underflow in safe_loop_count
• Fix integer overflow in parse_symbol_table() (CID 1646630)
• Fix integer overflow in parse_symbol_table
• Fix memleaks and heap-overflow in ELF parser for duplicate sections
• Fix heap overflow in egglang using 4096 variables
• Remove dead code, off by one and a null check in the esil analisis loop
• Harden SOM string-table bounds checks
• Fix r_str_wrap allocation sizing
• Fix #25650 - Command injection in curl PDB download
• Fix oobread bugs in the dotnet header parser
• Fix SSL crash in r_socket_connect: goto success instead of return true
• Fix #25636 - Oobwrite in the xtr.sep64 parser
• Fix webserver uaf based on @as0ler PR
• Fix pd-- heap overflow on long offsets
• Fix checkpoint snapshot ownership double free
• Fix seven charset decode buffer overflow
• Fix .hex directive odd-length parsing overflow
• Validate .cfloat bit sizes to prevent negative byte lengths
• ...

Authors

AGhebrea Adam Satko Antoni Viciano Armin Weihbold David Given Dennis Goodlett Priyanshu Kumar condret dependabot[bot] pancake pancake pancake pancake potato satk0

Changes

analysis

• Preserve anal.timeout across and iterators
• Add APIs to get/set function signatures and other attributes
• Fix selection of overlapped functions in pdc
• Unify invalid code checks and stop filler-prefix blocks early
• Dont crash when reaching large bb limits, defaults to 64KB
• Improve the jmptbl bb isvalid checks
• Shrink the default max basicblock size from 512K to 8K
• Refuse to accept invalid jmptbl blocks
• Add anal.vars.maxframe and anal.vars.maxbbsize
• Fix esil-computed refs without losing type propagation information
• Implement the 'ah=' command to copy instruction details into hints
• Optimize isString logic for anal.strings reducing heap allocations
• Minor optimization on a function called a lot of times in aae

api

• Remove all the filetype related apis from librmagic
• Remove r_name_filter_print function

arch

• Fix Thumb label resolution for b/bl
• Fix #23536 - Changing arch.endian affects cfg.bigendian
• Initial implementation of the Python pseudo plugin
• Fix overlapping registers in the dalvik profile
• Honor endian settings for the or1k disassembler
• Add ex9patch script for nds32

arm

• • Fix overlapping function selection and pdc boundary crossing on arm64 kernelcache

asm

• Use RArch instead of RAnal for consistent settings
• Fix the .fill directive wrongly using sizeof multiplier
• Add bf.pseudo plugin

bin

• Avoid redundant ELF uncaps scans in get_stripped
• Fix the ELF phdr parsing beyond symtab
• Add RBinInfo.uncaps to expose non-encapsulated symbols
• Improve stripped detection on MACHO binaries
• Improve stripped detection on ELF binaries
• Refactor and cleanup the PEF and PDB parsers
• Fix PDB parser cleanup on failed parses
• Handle empty XTAC names safely
• Pass around RBinFile in dwarf. instead of using bin->cur
• Fix Mach-O redacted symbol scanning in NUL-separated string tables
• Harden Mach-O entitlement bounds checks
• Optimize the RBinFilter code for section names
• Clamp nindirect count saves 7GB parsing corrupted macho
• Fix tons of memory leaks in the DEX parser
• Fix memory leaks in the microsoft demangler
• Fix infinite loop in walk_codesig by using blob offsets
• Fix kernelcache nested Mach-O symbol parsing under rebased IO
• Local LE optimization for the macho parser
• Speedup RBin.XnuKernelCache parser
• Improve icc's objc output to be more correct
• Fix ObjC instance/class method types when dumping via icc
• Simplify the macho header parsing to extract endianness
• Clamp code signature slots and simplify parsing checks
• Add missing CSSLOT code signature types for macho
• Refactor Mach-O bind parser to reduce nested code and improve bound checks
• FIx #25482 - Improved macho bound to avoid unparseable allocations
• Fix 'isv' error message and other code cleanups in cmd_info

build

• Support v6 as an alias for capstone-next for meson
• Fix #25607 - arm64 disassembler wasn't available for capstone-next
• Remove shlr/capstone leftovers
• Do not use LTO for static builds by default
• Zig toolchain for debian/i386 crosscompilations
• Add docker and scripts for testing on i386
• Initial bootable dist/iso machinery

ci

• Pub the r2r json artifacts for the asan jobs
• Use -j4 in a windows build instead of -j1
• Improve the wasi build machinery

cons

• Preserve cons.timeout across context stacks
• Add missing keys in color themes
• Hardened nullable context cloning

core

• Fix RConfigSet bug creating keys when storage is locked
• Defer autocomplete and envprofile setup in non-interactive startup
• Initial support for $$..XXX addressing
• Rename anal.types. config vars to be just types.

crash

• Memory ownership improvements for the http webserver
• Fix nullable outputs in r_flag_zone_around
• Fix use-after-free in bin_any filetype detection
• Fix pcap buffer unref on parse failure
• Fix 3 critical bugs in the regex engine
• Use RStrBuf in librmagic to fix two vfprintf bugs
• Add more safety bound checks in dotnet
• Fix oobread in dotnet parser
• Fix assert in '?e je|!cat' writing 0 bytes
• Fix null deref in the PEF parser
• Fix oobread exposed in the new psp tests
• Fix invalid mem free when one DIE has two or more DW_AT_name attributes
• Fix SIGCHLD deadlock for r2r 32bit systems
• Fix race condition in Linux's system causing random r2r failures
• Bound Mach-O SuperBlob count before allocation
• Fix infinite loading times for a fuzzed macho file
• De-recurse bbtree walks abusing stack usage in wasm/asan
• Fix UAF in the dotnet metadata parsing
• Clamp utf8 decode length for truncated null terminate inputs
• Fix deinitialization segfault in the background webserver

doc

• Document r2r tests in the manpage

dwarf

• Find dwarf attr DW_AT_frame_base once outside the hot loop

egg

• Inline assignments, block bodies, no empty frames and fastcall handling
• Refactor arm emitter, memory access, branch logic
• Refactor arm64 load/store helpers
• Fix fastcall declaration parsing and add a test
• Fix arm thumb emitter for frame, string, getvar and load
• Some arm64 egg emitter fixes (string, jmp, 8byte alignment, stp/ldp)

esil

• Dont run aeim in esil analysis related commands
• Push a zero into the esil stack when dividing by zero

fs

• Fix HFS+ extent overflow search key initialization

graph

• Add graph.bb.maxsize option to limit basic blocks size in graphs

io

• Speed up dyldcache rebase backtracking in io.dsc
• Fix memory leak, zip creation in readonly and other minor bugs in zip
• Do not corrupt files when using zip://

lib

• Refactor DRY user plugins load logic

muta

• Simplify the transposition muta plugins

print

• Merge pz and p= subcommands capabilities
• Support utf8 dots on truncated text with the new r_print_ellipsis
• Simplify cmd_print string helpers and drop null guards
• Fix utf8 checks for invalid and overlong encoding

projects

• Add prj.new config to use the new prj formats

r2js

• Implement more r2js variants for r2pipe2

r2r

• Fix r2r temp diff file handling
• Run iH for all the fuzzed binaries

ragg

• Fix memory leak in ragg2

remote

• Expose URI instead of basename for r2agent sessions

sandbox

• Do chdir("/") after chroot(".") to avoid sandbox escapes

search

• Use block buffering for faster anal search
• Optimize /az reading blocks and use minopsz and opalign

shell

• Fix #25556 - Internal grep with macros
• Support copying to directory and handle errors in cp

snslydid

• Run data-flow reference analysis to cmd_anal_all for consistent behavior witha aa

test

• Fix null/len checks to please the fuzz suite
• Add fuzz loop scripts
• Introduce the new indent suite

tests

• Add fuzz loop scripts

tools

• Add r2r -1 as an alias for -j1
• Fix formatting braced stuff like enums
• Reuse RCons in rafs2 interactive shell
• Fix SIGSEGV in rafs2 interactive mode
• Add support for user plugins in rafs2

types

• Lazy-load and cache types to speed startup
• Merge OS-specific types in RAnal.setOS
• Use sdb_set instead of sdb_query to store data after parsing
• Support parsing vararg in function pointers
• Support parsing forward structs declaration
• Include line number and type name when parsing fails
• Implement the tf- command to delete function definitions
• Add anal.types.xrefs for the tv commands
• Show xrefs for function signature definitions in tfv
• Implement tfv command to view function arguments and its offsets

util

• Add a larger regex testsuite and fix a couple of bugs

visual

• Add TV as an alias for TV
• Improve quality in the treemap '?em' code

Authors

Abhi Ahmethan G. Alberto Marnetto Antoni Viciano Carl Smedstad Charloitte Daniel Nakov Hakal Ignacio Sanmillan Marc R. Oblivionsage Oblivionsage Priyanshu Kumar Quentin Kaiser Zhichen Wu astralia aviciano condret dnakov pancake pancake pancake potato satk0

Changes

abi

• Reimplement RBufRef on top of RRef
• Fix the RLibDelHandler api

analysis

• Delete stale JAY code. wasnt used in 10 years
• Use invalid_page in aap, fixes another slow CI test
• Improve the invalid page check to speedup /azs
• Break aac when io fails or its not even executable
• Make use of the cmp value for jmptbl size, this was dead code before
• Better integration of plugins in the analysis pipeline
• Use RRef instead of custom refcounting in RAnalBlock -26LOC
• Add anal.jmptbl.split option to experimentally solve the missing cases
• Fix infinite loop in the jump table with shared basic blocks
• Fix #5136 - Add anal.jmp.pair to flatten consecutive inverse branch antidisasm tricks
• Add time_t type definition with size specification
• Handle CS_AC_READ_WRITE in the x86 cs plugin
• Honor op.ptr references in /re for x86 only
• Add plugin to import traces from DRCOV logs
• Rewrite RCore.seekOpForward for the better
• Better autoname filtering chars with RName apis
• Introduce afnq refactor afn into a separate helper
• Improve better fastpath function autoname
• Rewrite RCore.seekOpBackward for the better
• • Rewrite RCore.seekOpBackward for the better
• Move core.sixref plugin to anal.six
• RAnalCmd now returns a string instead of bool

api

• Add the new RNum.getErr helper
• Enforce non-null compile-time check for R_NEW and R_NEW0
• Single RConsVisual.readline helper used everywhere
• Introduce the new R_QUIET_FAIL for fast path asserts

arch

• Update from binutils the ARC disassembler from 2009 to 2026
• Use RStrBuf instead of the unsafe sprintf in the rv disassembler
• Use refcounted RArchSession
• Fix incorrect plugin references in RLibStruct structures
• Dont use strcpy/strcat or globals in xap disassembler
• Fix typos in the java opcode tables

asm

• Implement the asm.pseudo plugin for dotnet's CIL
• Add support for camelcase disasm syntax
• Add ARC pseudo plugin and update opcode descriptions
• Fix #25232 - x86asm for sil,dil,spl,bpl
• Fix x86 assembler accepting invalid register names like r1

bin

• Extend iH to return a string and permit multiple formats
• Import function signatures and types definitions from DWARF
• Fix arch hints for cil/x64 binaries and its tests
• Extend the CIL detection for Mono exe/dll
• There's no need for a PE to have a certificate
• Fix resource leaks in NE format parser
• Implement iz. izj. and izq. to show string in current address
• Add izzc and izzzc commands to count raw strings
• Fix leaks and other bugs in the LE format parser
• Implement izjq and its alias izqj
• Add bounds check for MDMP comment stream size
• Disable the xtr.dyldcache, fix a crash and other XXX in xnu.kernelcache
• Count and pagination of iz strings listing commands
• Add iz+ command
• Extend iz- command to accept length and type
• Fix endian-unsafe struct read in LE reloc parsing
• Add support for ARM64's GLOB_DAT ELF reloc types
• Fix code_length bounds check in Java class parser
• Replace eprintf with R_LOG in Java class parser
• Use actual data_size for MDMP comment streams
• Expose RTM revision version information from minidumps (mdmp)
• Fix #25382 - Open Limit chained fixup loop iterations in le reloc parsing
• Expose macho imports as vectors
• Use RVec for the ELF imports
• Priorize the use of RVec for RBinImports
• Ten times less memory use when loading DEX
• Fix some other bugs and memory leak in izz
• Remove deprecated addrline storage and fallback code paths
• Clamp MZ sections with file size
• Fix #25209 - Ensure we have enough data to read in mdmp
• Generalize imports cache for performance
• Support the Apple C4000 Baseband firmware (gns1)
• Fix memory leak in zimg plugin
• Fix memory leak in bflt plugin
• Zero copy string handling in swift demangler and remove one global
• Cache the has_nx value in the elf to parse it once
• Extract NX information for QNX ELF binaries
• Fix memory leak in PE parser
• Fix #25277 - oobread by one in the OMF parser
• Rework bin.xtac to fix tainted, memleaks and BE
• Fix memory leaks in Java binary parser
• Fix memory leaks in MDMP plugin and RBinMem
• Fix memory leaks in the som parser
• Fix #25248 - memory leak in MDMP parser
• Fix memory leaks in QNX binary parser
• Fix memory leak the SOM import parser
• Optimize symbol loading
• CUBINs are ELF based on EM_CUDA
• Lazily compute the PE autentihash once + add missing muta hash plugins
• Use RMutaBind in the PE plugin
• Use RMutaBind in RBin too, replace r_hash calls in macho
• Rename r_bin_command to r_bin_cmd
• Refactor the bflt code, more cleanup and minor reloc improvements
• Support non-arm bflt executables
• Fix reloc native types for mach0
• Expose more native reloc types
• Expose the reloc type for REL binaries
• Add support for records and invoke dynamic in java
• Add support for ACC_HIDDEN Java classes

build

• Cydia builds use rootless prefix and target arm64
• Inform the user about the command to run as sudo in sys/install.sh
• Fix to meson without any zip dependency, not even otezip
• Specify arm64e to please Sileo packages
• Fix r2_fortunes path inconsistency in meson.build
• Initial support for third party plugins
• Move shlr/ar into libr/io/p/ar
• Replace bundled libzip+zlib with otezip (-55kLOC)
• The csnext job now tests libuv and no-undefined
• Disable debug log statements in release builds

ci

• Fix #25179 - Merge the csnext and ssl jobs

cons

• Fix #17391: preserve UTF-8 in graph output
• Remove repeated spaces in hud lines
• Fix the color palette propagation problems via rcorecmdstr

core

• Add more guards to make background tasks more predictible
• Fix #25374 - Convert RLib->plugins_ht to a per-type array of hashtables

crash

• Fix a double free in r_str_replace_icase
• Fix stale pointer used when temporal blocksize changes
• Fix overflows array oobread index in intervaltree
• Fix negative index used in *r_anal_function_get_var
• Fix overflows return value in io.dsc
• Fix another integer overflow in bin_pelf
• Fix oobread caused by integer overflow in kernelcache
• Fix integer bug in dotnet getname causing oobread
• Fix two oobwrite bugs in canvas_resize
• Fix two integer overflows in RCore.getBoundariesProt
• Fix untrusted loop bound, integer overflow and oobread bugs in bin_pef.c
• Fix uaf in /m
• Fix integer overflow in the wfs command with large files
• Fix zero and size_t multiplication overflow UB issues in rvec
• Fix oobwrite in visual write commands and oobread pascal demangler
• Fix UB cast in container_of macro
• Sanitize function names in afl* to avoid command injection
• Fix UAF in RBin.ELF.fini
• Sanitize callconv in fcn_print_detail output
• Fix iter page underflow in le parser
• Fix integer overflow bug in r_cons_print and r_cons_write
• Fix #25338 - Out-of-bounds read in the NSO parser
• Fix #25336 - integer underflow in QNX parser
• Fix use-after-free in LE/LX reloc parsing
• Fix possible argument injection vuln in the swift demangler
• Fix #25290 - ELF extended phnum allocation check
• Sometimes the webserver calls this function with null command
• Fix otezip UB and incorrect java boundary check
• Fix heap buffer overflow in SPP processor
• Fix core plugin initialization order
• Fix #25212 - oob read in r_str_len_utf8
• Fix potential overflows in snprintf for cmd_mmc according to codescan
• Fix potential uaf in gdbclient/responses.c
• Fix the space for the null byte in seven.c

debug

• Fix #2079: Add source line breakpoints
• Implement native breakpoints support for XNU/ARM64
• Use RMutaBind in RDebugSnap
• Implement print fpu registers for linux-arm/arm64

diff

• Resolve 6 TODO comments from xpatch

disasm

• Support overlapped strings in the disassembly listing
• Do not emit Color_RESET in disasm loop when scr.color=0
• Improve auto-string comments in disasm
• Honor RMeta string size in 'str' flags
• Fix #680 - Keep :NN suffix in symbol substitution

esil

• Extend emulation support for x86 FPU

fs

• Fix #16396 - add mlx to list deleted files only for FAT
• Fix #19411 - Handle r2 alias for 'open'
• Move shlr/grub into libr/fs/p/grub

hash

• Fix #13937: rahash2 -R sdb output

http

• Fix the webserver when sandbox is enabled

io

• Fix #15699 - Add SREC file format su...

Authors

Copilot Francesco Tamagni Ole André Vadla Ravnås Ole André Vadla Ravnås dependabot[bot] pancake pancake pancake potato qz satk0

Changes

abi

• Migrate r_vector to RVec in core, anal, io, and other components

analysis

• Unify redundant state vars in type propagation
• Use faster data structures for caching data for type propagation
• Remove anal.a2f and the a2f core plugin, it's in anal already
• Conver the blaze analysis from core into an analysis plugin
• Make the leading double lowerdash in symbols irrelevant
• Fix aaef corrupting files in write mode by routing ESIL writes to IO overlay
• Fix analysis command plugin listing 'a:?'
• Add test for type propagation after manual aei
• Move and improve type propagation as a plugin
• Compute with memoization the amount of refs in functions
• Fix null asserts in the 'ap' command and handle prelude binmask
• Resolve gp-relative jump tables for MIPS
• Fix function arg name counting

arch

• Fix #25037 - Support to assemble the 'enter' instruction for x86
• Support AT&T syntax in x86 disassembly and ESIL generation
• • Simplify x86 operand handling by removing find_*op helpers
• Heavily refactor and improve the z80 plugin
• Fix bugs in the z80 assembler and disassembler
• Expose rbin metadata for dotnet in disasm
• Initial support for CIL disassembler and assembler
• Execute delay-slot instructions in branch instructions and fix gp alignment

bin

• Fix support for Java class loading
• Add kernelcache test and simplify rbuf reference issues
• Emit demangled class names even if demangled is disabled
• Remove rvector calls away from the elf
• Use RVec in machos
• Remove globals from the python plugins
• Fix the swift demangling tests with trylib=false
• Discard unaligned strings with bin.str.align option
• Use the arena allocator and fix memory leaks in the dwarf parser
• Fix demangling bombs honoring the maxsymlen option
• Fix xrefs in apk:// rebase getoffset() with RBinFile.getVaddr()
• Implement .types for the PDB plugin
• Fix multidex apk:// rebasing
• Add rbinplugin types (experimentally used only for dotnet)
• Set RBinClass origins where possible
• Add the class origin field
• Fix #24989 - ARM RPI2 PE identification
• Fix leaks, rm globals and other cleanups for PDB
• Improve the objc parser boundary checks, find more refs
• Mark cil methods with anal arch hints
• Improve AARCH64 relocation support for ELF
• Initial working support for .NET PE assemblies
• Implement the RBin.pdb plugin
• Fix partial ARM instructions relocs for ELF
• Properly inform about why an ELF is not stripped

build

• Also use -Oz in sdk-common.sh
• Omit third-party asserts during SDK builds
• Build SDKs without runtime checks
• Update the rpm package
• Build xcframework with frameworks
• Fix libr.dylib exports on Apple OSes
• Fix and tune the xcframework sdk
• Improvements on the SDK compilation for apple targets
• Fix sys/install.sh for busybox environments

ci

• Build less wasis in PRs
• Use ./configure -qV instead of sys/version.py
• Add XCFramework builds in the release pipelines
• Switch to macos15 because older ci runners are not available

cons

• Make the bluy theme really bluish
• Refresh palete when needed only, fix 'ec' calls from RCore.cmdStr
• Better color limit checks with TERM
• Respect the TERM envvar, only for colors for now
• Reset command switch the terminal mode to ASCII

core

• Improve abiversion warning messages

crash

• Fix uaf bug in apple kernel/dyld-caches spotted by scan cov
• Fix off by one write in the set regprofile function
• Fix oobread in dmh with glibc and uaf in magic command
• Fix UAF in the pdb deinit process
• Fix a couple of recent integer overflows in PE
• Fix oobwrite segfault in dotnet parser
• Fix oobwrite in r_strbuf_append_n
• Dont depend on global cons instance for win_is_vtcompat
• Avoid rbinfiles to UAF if the rbin plugin associated is unloaded
• Fix oobread crash in dotnet parser
• Fix null deref in the p9 parser
• Check for abiversion before loading plugins
• Fix buffer overflow in PE parsing imports and symbols
• Fix UB overlapped memcpys in iomaps
• Fix infinite loop in the mach0 relocs parser
• Fix near-infinite loop in the objc parser eating lots of memory
• Fix infinite loop in r_core_anal_type_match
• File paths with the curl backend must escaped as TMPDIR poisoned for command injection
• Fix an OOB by one in the rap server and better error checking
• Fix system command injection via RSocket.get/post headers when using curl
• Use RSocket.download from idld to fix command injection
• Check the vec reserve before emplacing it back

debug

• Fix radare2 gdb remote debugging support and add test
• Detect and warn when setting overlapped breakpoints
• Implement 'dga' to coredump all maps
• Fix r_str_scanf parsing bug and dg coredump on linux-x64

disasm

• If arch isvm lower varmin to zero
• Implement the scr.rainwbow.regs option
• Fix scr.color.regs when scr.color.ops is false
• Fix colorized ops with byte colors when scr.color.ops=false
• Add register rainbow coloring support
• Add asm.cmt.strings to disable aop.ptr strings

esil

• Replace chevron operators with LSL, LSR, ASR, ROL

fs

• Sort apfs files by name instead of randomly depending on a hashtable
• Implement support for reading files in apfs mountpoints
• Retrieve the file sizes in the apfs filesystem
• Add support for BSD DiskLabel partitions
• Initial support for the Apple FileSystem
• Add support for APM (PMAP) Apple Classic partitions
• Add support for EBR partitions (keep MBR support)
• Initial support for GPT partition tables

hash

• Fix r_hash_tostring using update/end properly

http

• Add APIs to register sessions

io

• Implement the tap:// io plugin for simh tape images
• Enable rawio by default
• Add support for pipe fifo files with 'r2 <(uname)'

muta

• Port all charsets from r_charset to rmuta via charset plugins

panels

• Fix multiple layout settings

perf

• One more strbuf reserve and unnecessary uses of it
• Reduce strbuf drains by removing the slack area

print

• Removing pf, pf2 is the new pf
• • Refactor print formatting to improve handling of structs, arrays and pointers
• Refactor print formatting to improve handling of structs, arrays and pointers

shell

• Implement the @@@m:perm foreach operator
• Fix column width in 'ls'
• Fix column width in 'ls' output
• Load fortune messages from directories
• Fix #24914 - Refactor and improve 'sf' command
• Add support for ${pal:} themed colors in scr.prompt.format

socket

• Handle SOCKET_HTTP_MAX_REDIRECTS in the curl codepath
• Support binary data downloads via RSocket.get
• Implement RSocket.download as a wrapper for get+dump

tests

• Add SKIPONASAN option for r2r to avoid a dmh test to fail
• Display short test paths if possible
• Check and display libr version with r2, r2r and rasm2 are the same bin with libs

tools

• Honor R2_COLOR env var from rabin2
• Implement -hh for rabin2 and rasm2
• Include abiversion in -v and -V
• Add JSON support to rafs2
• Add R2_DOCDIR and R2PM_DOCDIR variables
• Add missing rahash2 in blob/main
• Implement rasm2 -LL to list the parse plugins
• Fix error code for 'rasm2 -a invalid nop'

types

• Update scanf and wscanf function signatures to reflect variadic arguments
• Implement typedef union and enum parsing in KVC parser

util

• Fix RBuf design lifetime issues
• Improve r_str_rwx to parse the shar bit
• Sperm bit handled in the helper
• Use logaritmic capacity grows in strbuf
• Continue improving the arena api

visual

• Colorize perm field in iS, dm, dmm and om
• Some better organization sub-visual modes (TAB)
• Add scr.vprompt.format

wasm

• Update to use the latest wasi-sdk-29.0
• Add wasi-browser using wasm-imports