chore(deps): update dependency radareorg/radare2 to v6

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
radareorg/radare2	major	5.9.6 → 6.2.2

---

Release Notes

radareorg/radare2 (radareorg/radare2)

v6.2.2

Compare Source

Release Notes

Codename: "infandmore"
Version: 6.2.2
Previous: 6.2.0
AbiDiff: 132-142 (10)
Commits: 388
Contributors: 22

curl -Ls https://github.com/radareorg/radare2/releases/download/6.2.2/radare2-6.2.2.tar.xz | tar xJv
radare2-6.2.2/sys/install.sh

Highlights

More details

Authors

0xf00sec AGhebrea Aayush Khanna Angelo Ayton Bernhard M. Wiedemann Claude Jinbao Chen Kirby Kuehl Kleopatra Poritsi Mohammed Hassan Priyanshu Kumar Ruffalo Lavoisier Vaibhav Srivastava Vectrain51 mmustafasenoglu pancake pancake pancake phix33 phix33 potato root

Changes

abi

• Make RIOBind reads return byte counts
• Deprecate r_bin_is_static as requested by R2_590

anal

• Dont recover fp vars in frame-less functions
• Fix switch ownership when analyzing overlapping blocks
• Add arm64 swift convention for fpu args
• Rename default register arguments once when recovery ends
• Handle subregister arguments on x64
• Fix wrong variadic detection when eax is written before testing al
• Fix calling convention for arm64/swift fpargs
• Refresh VARTYPE metadata after variable renames
• Dont reuse fp args after calls
• Simplify floating-point argument recovery
• Add dyncc floating-point argument registers
• Memoize cc arg counts and skip fp walk on integer ops
• Recover float args from a separate fparg register sequence
• Fix readAhead UB in the function analysis loop
• Remove duplicate counted read bookkeeping
• Fix partial reads in analysis consumers
• Fix jump tables truncated by short reads
• Stop walking pc-relative indirect jumps as jump tables
• Analyze disconnected exception handler blocks
• Fix RAnalOp leaks in the disasm, diff and debugger decode loops
• Fix aeg folding ops without a dfg handler into constants
• Fix the memory leak and quadratic cost of aoj with many opcodes
• Fix dfg esil for goto and cmps
• Fix JSON disassembly architecture hints
• Use function call conventions for afsj arguments
• Fix fp local variable and arm32 reg tracking
• Resolve typed JNI table calls in analysis
• Typed JNI interface tables and indirection
• Materialize typed JNI native methods during analysis
• Add the new jni analysis plugin
• Stop afb and afbi from deleting switch cases that share a target
• Drop a stale arg from the float-formal expectation
• Separate a formal's ABI position from its sdb index
• Place formal parameters that DWARF leaves without a location
• Quiet aavrq to reduce noise in aaa
• Expose more switch details in the json output
• Forward register args through direct tail jumps like calls
• Match forwarded callee args by register instead of argnum
• Include the switch default target in block successor iteration
• Dont treat the returned int as a variadic marker
• Preserve registered types when linking DWARF prototypes
• Link DWARF types only when prototypes match
• Name local plt stubs in x86 retpoline layouts
• Free all flag metadata strings
• Name local plt stubs from their got relocs in aa
• Split the type propagation plugin into libr/anal/p/tp
• Warn for unresolved DWARF function return types
• Test bbstate restore doesnt rewind esil memory
• Bind exact DWARF function prototypes to their address
• Keep loop body register changes after the loop in aaft
• Honor address-linked function signatures
• Drop stale func arg keys when reanalysis recovers fewer arguments
• Fix local/global address detection for opmask in signatures

analysi

• Dont recover fp vars in frame-less functions
• Add arm64 swift convention for fpu args
• Rename default register arguments once when recovery ends
• Handle subregister arguments on x64
• Fix wrong variadic detection when eax is written before testing al
• Fix calling convention for arm64/swift fpargs
• Refresh VARTYPE metadata after variable renames
• Dont reuse fp args after calls
• Simplify floating-point argument recovery
• Add dyncc floating-point argument registers
• Memoize cc arg counts and skip fp walk on integer ops
• Recover float args from a separate fparg register sequence
• Fix readAhead UB in the function analysis loop
• Remove duplicate counted read bookkeeping
• Fix partial reads in analysis consumers
• Fix jump tables truncated by short reads
• Stop walking pc-relative indirect jumps as jump tables
• Analyze disconnected exception handler blocks
• Fix RAnalOp leaks in the disasm, diff and debugger decode loops
• Fix aeg folding ops without a dfg handler into constants
• Fix the memory leak and quadratic cost of aoj with many opcodes
• Fix dfg esil for goto and cmps
• Fix JSON disassembly architecture hints
• Use function call conventions for afsj arguments
• Fix fp local variable and arm32 reg tracking
• Resolve typed JNI table calls in analysis
• Typed JNI interface tables and indirection
• Materialize typed JNI native methods during analysis
• Add the new jni analysis plugin
• Stop afb and afbi from deleting switch cases that share a target
• Drop a stale arg from the float-formal expectation
• Separate a formal's ABI position from its sdb index
• Place formal parameters that DWARF leaves without a location
• Quiet aavrq to reduce noise in aaa
• Expose more switch details in the json output
• Forward register args through direct tail jumps like calls
• Match forwarded callee args by register instead of argnum
• Include the switch default target in block successor iteration
• Dont treat the returned int as a variadic marker
• Preserve registered types when linking DWARF prototypes
• Link DWARF types only when prototypes match
• Name local plt stubs in x86 retpoline layouts
• Free all flag metadata strings
• Name local plt stubs from their got relocs in aa
• Split the type propagation plugin into libr/anal/p/tp
• Warn for unresolved DWARF function return types
• Test bbstate restore doesnt rewind esil memory
• Bind exact DWARF function prototypes to their address
• Keep loop body register changes after the loop in aaft
• Honor address-linked function signatures
• Drop stale func arg keys when reanalysis recovers fewer arguments
• Fix local/global address detection for opmask in signatures

analysis

• Dont recover fp vars in frame-less functions
• Add arm64 swift convention for fpu args
• Rename default register arguments once when recovery ends
• Handle subregister arguments on x64
• Fix wrong variadic detection when eax is written before testing al
• Fix calling convention for arm64/swift fpargs
• Refresh VARTYPE metadata after variable renames
• Dont reuse fp args after calls
• Simplify floating-point argument recovery
• Add dyncc floating-point argument registers
• Memoize cc arg counts and skip fp walk on integer ops
• Recover float args from a separate fparg register sequence
• Fix readAhead UB in the function analysis loop
• Remove duplicate counted read bookkeeping
• Fix partial reads in analysis consumers
• Fix jump tables truncated by short reads
• Stop walking pc-relative indirect jumps as jump tables
• Analyze disconnected exception handler blocks
• Fix RAnalOp leaks in the disasm, diff and debugger decode loops
• Fix aeg folding ops without a dfg handler into constants
• Fix the memory leak and quadratic cost of aoj with many opcodes
• Fix dfg esil for goto and cmps
• Fix JSON disassembly architecture hints
• Use function call conventions for afsj arguments
• Resolve typed JNI table calls in analysis
• Typed JNI interface tables and indirection
• Materialize typed JNI native methods during analysis
• Add the new jni analysis plugin
• Stop afb and afbi from deleting switch cases that share a target
• Drop a stale arg from the float-formal expectation
• Separate a formal's ABI position from its sdb index
• Place formal parameters that DWARF leaves without a location
• Quiet aavrq to reduce noise in aaa
• Expose more switch details in the json output
• Forward register args through direct tail jumps like calls
• Match forwarded callee args by register instead of argnum
• Include the switch default target in block successor iteration
• Dont treat the returned int as a variadic marker
• Preserve registered types when linking DWARF prototypes
• Link DWARF types only when prototypes match
• Name local plt stubs in x86 retpoline layouts
• Free all flag metadata strings
• Name local plt stubs from their got relocs in aa
• Split the type propagation plugin into libr/anal/p/tp
• Warn for unresolved DWARF function return types
• Test bbstate restore doesnt rewind esil memory
• Bind exact DWARF function prototypes to their address
• Keep loop body register changes after the loop in aaft
• Honor address-linked function signatures
• Drop stale func arg keys when reanalysis recovers fewer arguments
• Fix local/global address detection for opmask in signatures

api

• Add R_LOG_HINT which is unset for automatic steps
• Replace system bits packing with generic value packs

arch

• Take the arm32 immediate shift carry from the source register
• Mask the arm32 shifted-operand count to its low byte
• Fix m680x jsr/jmp/bsr and branch targets so calls get xrefs
• Add CIL token resolution and stack ESIL
• Fixes for the Dalvik array, object and memory esil
• Fix Dalvik calls and result register handling
• Fix signed Dalvik operands and branch targets
• Fix sign data bug in dex decoder
• Reroute the capstone v6 ppc overflow-form ids onto their base cases
• Decode the mips.gnu unaligned word loads and stores
• Fix the mips.gnu instruction ids and let it decode at 64 bits
• Initial support for nvidia ptx sass encode/decode/pseudo
• Type ppc bcl 20,31 branch-always forms as jumps that set lr
• Remove the dead colon replacement from the ppc, mips and sparc pseudo parsers

bin

• Support msvc demangling single letter names
• Fix missing null byte when the msvc demangler emits std::nullptr_t
• Add string type suffixes to filter iz and izz output
• Patch aarch64 ET_REL GOT relocs against the import slot
• Place ET_REL NOBITS sections and its import slots
• Compute baddr for elf relocs outside the hot loop
• Patch relocs at their mapped address under a custom baddr
• Fix slow load of mach0 with repeated classes and huge objc lists
• Read the in-place addend for implicit-addend crel relocations
• Patch i386 GLOB_DAT, JMP_SLOT and RELATIVE dynamic relocs
• Stop reading REL targets while listing relocations
• Fix off-by-one array extents when DWARF uses DW_AT_count
• Add RBinSymbol.hsize for header metadata paddings
• Migrate RBin trycatch storage to RVec
• Parse the CLR exception clauses of the dotnet method bodies
• Fix the PE64 SEH scope tables and parse the MSVC C++ exception regions
• Harden the eh_frame trycatch parser and fix the flag fallout
• Parse the Itanium exception regions from the ELF eh_frame
• Generalize the LSDA parser and fix the typed trycatch details
• Keep import GOT relocs at their site when bin.relocs.apply is on
• Expose C++ vtable ownership in class metadata
• Improve C++ class metadata recovery
• Fix Itanium (c++) multiple-inheritance base offsets
• Fix bin base address handling with -m and in threaded loading
• Parse encoded DEX exception handlers
• Fix #​26552 - type relr relocs for the target machine
• Add async and generator flags to symbol JSON
• Add JSON output for try/catch metadata
• Add bytecode argument and return metadata to isj
• Fix #​26546 - stop zeroing relr relocs under bin.relocs.apply
• Fix #​26547 - encode thumb branch relocs instead of a raw word
• Keep non-import ELF relocs at their site when bin.relocs.apply is on
• Parse CLR types, signatures and user strings
• Move the java member descriptor api out of r_bin into shlr/java
• Sideload macho dsym matching arch slice and uuid
• Fix #​25480 - pcap stream selection support
• Fully expand ELF RELR bitmap relocations
• Add support for the android-specific ELF relocations
• Fix JNI symbol detection for ELF only
• Add structured Java and JNI descriptor parsing
• Fix dwo_id truncation in the DWARF5 unit header
• Scan the last 20 bytes of a range for ppc64 ELFv1 eager call stubs
• Recover Swift struct field offsets from type metadata
• Add AArch64 ET_REL relocation patching tests
• Encode AArch64 branch and data relocations instead of an 8 byte write
• Replace RList/RRBTree store of RBinRelocs into RVec
• Unify bounded ELF string table lookups with strtab_str()
• Cap the section-less ELF symtab scan with the stated symbol count
• Only import undefined symbols in the section-less ELF scan
• Bound the section-less ELF dynsym scan at the next dynamic table
• Fix heap out of bounds read in the ppc64 plt stub segment scan
• Scan every code range for ppc64 plt call stubs and accept static-chain loads
• Name ppc64 ELFv1 text call stubs after their plt slot
• Move ELF PLT import resolution into plt.c
• Fix ELF-ppc32 import addresses for fPIC secure-plt call thunks
• Fix ELF-arm64 plt entry stride for pac-plt and bti-plt layouts
• Use bin.lang as default for ic+ metadata
• Detect symbol languages independently of binary format
• Fix field sizes and IBM XL language detection
• Extend ic+ attribute parsing
• Expose class attributes in JSON
• Unify binary metadata in RBinAttr
• Register binary languages during symbol parsing
• Clarify scalar and packed binary language types
• Use value packs for binary languages
• Add mixin/late attributes needed for Dart classinfo
• Load Swift metadata classes from ELF binaries
• Refactor Mach-O Swift class extraction to use shared loader
• Add generic Swift metadata class loader
• Extend Swift demangler for symbolic references and members
• Fix null names and wrong addresses from DWARF5 indexed forms
• Add iccl command to list the langs
• Add CIL classdump output for icc
• Add Dart classdump output for icc

build

• Rebuild shlr objects when the headers they include change
• Reproducible egg xor key via SOURCE_DATE_EPOCH
• Fix wasi tool linkage against libr_java
• Fix JSLinux runtime patching and distribution packaging

ci

• Rewrite lint.sh in python to scan each file only once
• Removes 5-6 jobs + macOS x86_64 leg from PR triggers, restricting them to push-to-master only

cons

• Use RStrBuf instead of global CbPrintf in Stiv
• Faster graphs: 6x (color+utf8) 20x (nocolor+ascii)
• Fix console visual rendering bounds
• Prevent internal pager from scrolling its first page
• Clearline in ^R while typing to avoid glitching the terminal
• Forward mouse-wheel events in JSLinux terminal
• Fix wrong line count in command output

core

• New core plugin command context interface api
• Refactor r_num_math error handling in cmd_seek (Step 2)
• Add support for embedding .r2.js scripts via r2plugin/xps

crasg

• Fix stack overflow in the visual assembler

crash

• Fix msvc demangler string copy null deref
• Fix UAF on bochs.detach with the register cache
• Fix oobread parsing debug.bochs breakpoint list
• Fix stack buffer overflow parsing the bochs stop address
• Fix out of bounds write parsing bochs register replies
• Fix copy_string reporting success after freeing its buffer
• Fix heap buffer overflow in the base91 muta plugin
• Fix integer overflow in the swift demangler bounds check
• Fix gron filter null deref
• Fix #​26600 - Define capability-based bin IO redirects
• Fix null derefs in pdb/tpi parser
• Fix infinite loop parsing fuzzer pe64 exception directory
• Otezip source doublefree in fszipdir
• Fix null assert for unbinded symbols in isj
• Fix xref cleanup ordering
• Fix UAF in fcn callconv
• Fix #​26458 - oobwrite in RBin.NSO and LZ4.decompressBlock
• Fix bound bugs in WinKD io code
• Fix null deref in RBin.attrFromString
• Validate UBIFS node lengths before struct reads
• Share Mach-O bind repeat validation
• Validate threaded Mach-O bind repeats
• Limit malformed Mach-O bind relocation loops

debug

• Fix bochs register profile alignment when segments missing
• Add support for data watchpoints for Haiku
• Handle asynchronous Haiku thread exits
• Fix Haiku debugger exceptions handling
• Add native debugger support for Haiku (x86-32/6)
• More work on the single step for xnu
• Fix single stepping again on macos-arm-64
• Fix Linux RV64 native debugger register profile

disasm

• Don't print a string comment for a relocated pointer slot
• Fix riscv unsigned branch pseudo, add missing branch rows
• Fix heap buffer overflow when truncating the bytes column
• Fix fp based / x29 stack var disasm for arm64
• Show the instruction under a typelink that has no format
• Render arm conditional branches as v conditions in the pseudo output

esil

• Fix shift overflow and ASR sign extension
• Reorganize ESIL op registration and reuse gb nops
• Simplify ESIL string history ring
• Turn the esil stack arena into a ring buffer
• Fix esil F== and F!= to compare exactly and follow IEEE on NaN
• Correct the arm64 float compare flags and immediate width
• Fix nested esil conditionals running the wrong else arm
• Emit balanced esil for the arm64 conditional compares
• Count only jumps and definition nesting toward esil.gotolimit
• Warn on oversized CLZ width and keep plain esil fallbacks
• Document the CLZ and POPCNT esil operations
• Use the CLZ esil operation for the arm count leading zeros
• Model the ppc count leading zeros and popcount forms
• Add the CLZ and POPCNT esil operations
• Rewrite the compound esil ops with REsilDefine instead of C handlers
• Add r_esil_define to implement esil ops as word definitions
• Add the ROT esil op to rotate the third stack element to the top
• Declare the ++ esil op to push one value like --
• Fix esil_peek_some regsize handling and esil_poke_some return value
• Fix CIL equality stack comparisons
• Fix the arm64 bfxil, extr and smulh esil and model the msubl forms
• Extend the arm64 register operands before shifting and mask the uxt forms
• Wrap the esil signed division of INT_MIN by -1 like the hardware
• Model the mips divide, wide multiply and multiply-accumulate forms
• Model the mips sign-extend and byte-swap forms
• Model the mips bitfield extract and insert forms
• Model the mips64 shift and rotate forms and fix the dsra sign fill
• Fill the mips.gnu dsra result from bit 63
• Narrow the mips.gnu sll result to 32 bits
• Emulate the mips.gnu rotr and rotrv as rotates
• Fix the x86 att operand details in capstone, not in r2
• Model PPC XER.OV/SO for the overflow-enabled forms and mfxer/mtxer
• Fix the arm32 shift counts, sign extension and uadd8 esil
• Write back the post-index offset of the arm unprivileged loads
• Assign the arm adc, sbc and rsc result instead of accumulating it
• Model the ppc high multiplies and the rotate-insert forms
• Sign-extend the ppc word multiply and mask the shift counts
• Fix esil that writes a destination aliasing its own source
• Fix the x86 mul, div and movbe esil and model the bit counters
• Merge the addressed bytes in the mips unaligned loads and stores
• Deduplicate the x86 shift emitters and fix their flag ordering
• Take the x86 shift counts from the right operand
• Model the x86 rotates through the carry flag
• Reuse one load macro and one compare block in the mips esil
• Compare and multiply the whole mips64 registers in sltu and multu
• Sign-extend the mips 32-bit results and mask the shift counts
• Skip the x86 shift body when the count masks to zero
• Zero-extend the 32-bit registers the x86 esil writes by hand
• Jump to the right token when the bsf or bsr source is in memory
• Fix bic expression for arm64
• Fix the x86 adjust flag bit position and adc carry propagation
• Compute the sbb overflow correction before the destination write
• Fix the sbb carry, adjust and overflow flags in the x86 esil
• Store to the sbb destination and zero-extend its 32-bit register writes
• Zero-extend every W register the arm64 ESIL writes
• Zero-extend 32-bit register writes on arm64
• Zero-extend 32-bit register writes on x86-64
• Mask the x86 shift count to the operand width

flags

• Make r_flag_get_by_spaces only return flags from the requested spaces

globals

• Stop using RCons.Gprintf from heap api
• Stop using the global RCons.Gprintf in the pdb parser

http

• Fix Windows socket bugs breaking HTTP server mode
• Fix iOS JSLinux offline caching and startup
• Add iOS icon and complete offline JSLinux cache

io

• Fix counted reads backed by the IO cache
• Correct counted reads across IO maps

jslinux

• Font pinch recalculates terminal size
• Ship an optional size-optimized TinyCC
• Add terminal pinch font scaling to

muta

• Use r_base64_decode_dyn in the base64 muta plugin

panel

• Panel model initialized once and alphabetically sorted
• Tabs now appear in the 2nd line

panels

• Panel model initialized once and alphabetically sorted

perf

• Cache IOMap and skip overlapping data metas when flagging relocs
• Half the reloc string allocations, reduces 25% memory

port

• Finish the uefi port and publish artifacts in release

print

• Refuse base91 inputs that don't fit into an int
• Don't size the print block from a pf/pm/pa argument
• Fix psj misclassifying ascii strings with zero padding as wide
• Add entropy edges printing mode

project

• Don't save/load scr.theme in scripts
• Fix project saving error when no changes or prj.new fails
• Reject project notes paths escaping through symlinked directories

projects

• Don't save/load scr.theme in scripts

pseudo

• Resolve pdc goto names on demand instead of collecting labelable addresses
• Print pdc gotos to another function by its name
• Keep each pdc branch's emulated stores from its siblings
• Emulate every pdc block once in CFG order
• Render pdc blocks via r_core_print_disasm not pD
• Keep pdc emulation inside its own io cache layer
• Add pdc.trycatch and make it structured in the ast
• Initial support for trycatch statements in pdc (as comments)
• Render pdcj, pdca and pdc* through the structured pdc too
• Render sparc cmp and conditional branches
• Don't inline function jmps in pdc
• Improve pdc output on dex functions
• Add s390 pseudo parser
• Fix blockers that restricted pdc.structured
• Reduce duplication in the structured pdc renderer
• Resolve flag-named own edges and skip unset case targets in structured pdc
• Render loops and switches in the structured pdc output
• Ignore unset switch default and table addresses in pdc
• Register pdc.structured from the pseudo plugin
• Indent orphan blocks in pdc at the walk depth
• Dont truncate pdc orphan case tags

r2js

• Fix #​26581 - Update to the r2papi 0.5.0

r2pm

• Add portable r2 package platform support
• Gate packages by platform

r2r

• Give valgrind-wrapped leak tests a minimum timeout

search

• Fix regex searches after short reads

shell

• Fix #​23362 - Handle math errors in cmd_seek
• Port b to task-owned command contexts
• Fix 'No session started' on 'd?*'

test

• Add r2r tests for the ppc32 SDA_BASE agree/disagree gp seed
• Add r2r tests for esil F< F<= ordering and compare underflow
• Skip variable analysis in the glibc plt-local tests
• Update the dex symbol golden for the flags field in is.j
• Fix dex and cil test regressions, honor dyncc argcount in call comments

tools

• Fix #​26636 - Dont load global scripts with -N
• Fix #​26431 - Support endian-swapped hex streams in rax2

types

• Fix #​26675 - lstat returns int
• Correctly handle void typedefs when omited
• Add missing POSIX and glibc prototypes to the type database
• Record DWARF DW_AT_byte_size for composite
• Fail closed when a struct names itself in r_type_get_bitsize
• Render void qualifiers (restrict, volatile..) from dwarf
• Save a base type under the spelling that refers to it
• Respect enum size if specified (defaults to 32bit like in C)
• Keep improved type propagation in the goldens
• Follow the declaration name into the jni and dwarf goldens
• Follow the printed declaration name in the signature unit tests
• Hand out the db key a function-name match went through
• Add long type variants for windows base
• Resolve typedefs before measuring pointer width
• Measure typedefs in r_type_get_bitsize
• Size pointer members with the target word width in the type api
• Fix struct/enum roundtrip names
• Fix type db lookups for __-prefixed names and comma-typed args

util

• Make the base91 char lookup static and use memchr
• Handle .r2so as a portable lib extension
• Use RStrBuf instead of memcat to render hexpairs
• Guard empty reloc names, keep bin.prefix on demangled reloc flags and dedup r_str_newf/newvf
• Speed up ASCII display-width calculations
• Grow strbuf pads with the append slack instead of an exact fit

visual

• Bound panel scroll to its contents
• Resize panels with the mouse drag event
• Fix mouse wheel events in panel menus
• Improve JSLinux touch navigation and guest defaults

v6.2.0

Compare Source

Release Notes

Codename: "Febrer Deams"
Version: 6.2.0
Previous: 6.1.8
AbiDiff: 110-132 (22)
Commits: 503
Contributors: 25

curl -Ls https://github.com/radareorg/radare2/releases/download/6.2.0/radare2-6.2.0.tar.xz | tar xJv
radare2-6.2.0/sys/install.sh

Highlights

More details

Authors

AGhebrea Abhi Anton Bolshakov Claude Evgeny Kolmakov Hissssst MiKi Mohammed Hassan Mohammed Hassan OrbisAI Security ProMix Ricardo J. Rodríguez ada-l0velace arhwx dependabot[bot] gogolovefish neil nnguyen609 pancake pancake pancake phix33 phix33 potato ryawa

Changes

abi

• Pahole more structs to drop gaps and reduce struct size
• Make RCons authoritative for command help rendering
• Unify the struct and union member model into RAnalTypeMember
• Use BE bool flag (instead of int le) for utf16->utf8

anal

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Name the stack canary from a register write index instead of trace position
• Fix cc stack arg slot offsets and bound the argslot scans
• Fix the double return-address skip in the callargs stack walk
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Keep fail-only fallthrough edges in the function graph
• Fix arm64 =SN syscall register alias to follow asm.os
• Use stateful decoding in the /r, aea and aespc linear sweeps
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Unify struct and union field picking and simplify the const retype in aaft
• Propagate callee types into struct and union fields during aaft behind types.fields
• Add anal.gpseed to seed a PIC base register during ESIL analysis
• Use r_anal_block_successor_addrs_foreach to build the function graph
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument access patterns (afts)
• Better call clobbered register detection for arm64
• Honor calling convention clobbers in ESIL analysis
• Add r_anal_cc_isclobber API
• Emulate bbs in CFG order for the type matcher
• Add callconv for all archs (updates clobber and preserve info)
• Fix pdb/dwarf union parsing to fill the union member vec
• Add clobber and preserve register for ppc and arm callconv
• Dont pick ppc TOC pointers as function argument registers
• Mark variadic libc functions properly and fix caller arg over-recovery
• Restore arm32 AAPCS register args r0-r3 in calling convention

analysis

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument access patterns (afts)
• Better call clobbered register detection for arm64
• Honor calling convention clobbers in ESIL analysis
• Add r_anal_cc_isclobber API
• Emulate bbs in CFG order for the type matcher
• Add callconv for all archs (updates clobber and preserve info)
• Add clobber and preserve register for ppc and arm callconv
• Dont pick ppc TOC pointers as function argument registers
• Mark variadic libc functions properly and fix caller arg over-recovery
• Restore arm32 AAPCS register args r0-r3 in calling convention

api

• Use the formatted sdb setters
• Use the new formatted SDB getters -200LOC

arch

• Fix opcode decoding and endian selection in the ppc.gnu plugin
• Pseudo for ppc ctr branch
• Add the missing operand count to the PowerPC lfiwax pseudo rule
• Keep every operand in the mips and sparc pseudo fallbacks
• Widen the PowerPC word rotate masks to the full ISA MASK
• Simplify the cr0 and trap helpers in the PowerPC pseudo filter
• Decode hex trap conditions and the folded unconditional trap forms
• Fix the rldicr rotate mask being taken from the rldic rule
• Dispatch the PowerPC pseudo fixups by mnemonic instead of table position
• Keep every operand when no PowerPC pseudo rule matches
• Add the missing isel rule to the PowerPC pseudo table
• Fix PowerPC bclrl link register handling
• Support the capstone v6 PowerPC operand and branch predicate model
• Write LR on the linking conditional branch-to-ctr forms even when not taken
• Workaround ppc.cs UB bug causing random esil test fail (capstone followup)
• Fix x86 rip-relative ptr for zero-displacement destination operands
• Fix PPC mfspr/mtspr decoding, stwu/stdu stack detection and vle archinfo
• Type arm64 flag-setting adds/adcs/subs/ands/bics in ESIL analysis
• Remove capstone v3 support, capstone 4 is the minimum
• Fix the v35 plugin build and stop typing valid arm64 instructions as ILL
• Fix MIPS conditional branch-and-link (bgezal/bltzal) jump target
• Fix arm.gnu Thumb branch and svc/udf imms
• Gate PPC toc_map TOC with RArchOpMask.STATEFUL and wire it into aar
• Early error handling when arch is not initialized
• Fix PPC conditional lr/ctr branch aliases incorrectly decoded as jmp2zero
• Add RArchOpMask.STATEFUL and RArchSession.reset
• Invalidate the toc_map base register on PPC update-form loads and stores
• Invalidate the cached t9 call target on untracked writes and drop the mips.gnu decoder state
• Accept MIPS ISA CPU names

bin

• Fix signed underflow case for ppc elf imports
• Preserve PE section names when COFF strings are unavailable
• Strictier coff magic check
• Gate the ppc64 opd and glink logic by ELF ABI and fix the ELFv2 stub stride
• Fix out-of-bounds read on the SOM dynamic loader string table
• Fix uninitialized .NET stream sizes
• Pack bin vector element structs
• Better DEX header and string validation with less code
• Reject malformed DEX headers before string parsing
• Add v128, ref and reftype support for wasm
• Initial implementation of the rust v0 demangler
• Implement iuo command to open resoUrces inline
• The old iU is now under iu, same goes for rabin2 -u
• Move the rabin2 -u feature into an env var
• Some binfiles require custom resource retrievals
• Add raw resource extraction controls
• Add iU, table output and handle invalid subcommands
• Add support for encoded resources and extraction
• List demangler plugins as part of rbin
• Make RBin demanglers pluggable and selectable
• Handle macho resources on 64bit fat slices too
• Add support for GLib Resources inside ELF files
• Expose macho code signature and certificate as resources
• Add dir.binsdb (from binpath/dirprefix) for PE/MDMP ordinal lookups
• Parse and expose PE/CLR Resources
• Add OS/2 LE/LX resource support
• Add ix command for extract sections, segments and resources
• Rename iR to iU and add iUx extraction
• Implement resource extraction api wired to rabin2
• Fix leak and harden the Java parser to not parse too much garbage
• Better QNX header check
• List and extract QNX LMF resources
• Add resources support for the Pebble
• Expose PE resources from mdmp
• Extract resources with rabin2 -xU
• List resource metadata and paddr
• Deprecate the old sdb metadata for resources
• Preserve generated NE entry symbols (bin.unnamed=false)
• Honor 32bit NE absolute addressing for > 64k tables
• Reject invalid NE resource shifts
• Expose and harden NE binary resources
• Use the generic resource API for iR commands
• Expose PE resources through the generic API
• Add generic binary resource API
• Fix #​23827 - oba not loading bin info from fat macho headers
• Add error if pdb7 root size negative or zero
• Fix PE version string parsing on big-endian hosts
• Utf16 strings in minidumps are always little endian
• Fix infinite loop in the NE fixup parser
• RBinPluginAny is now "null" for consistency and no longer uses LibMagic
• Decode PEF relocs lazily, add more bounds and overflow checks
• Fix AArch64 ELF relocation patching
• Stop parsing invalid PE import libraries
• Fix PE library import deduplication slowdown
• Fix warnings parsing zero-sized PE import directories
• Only do the right PE msvcseh checks for given arch/bits
• Fix bits in arm64 PE
• Name defined dynsym GOT slots in section-less ELFs
• Name global GOT slots to resolve relative GOT loads in mips.gp

build

• Add MiKNix platform support
• Fix #​26312 - Compile against zydis 4.1 ... 5dev
• Improve jslinux build times, linking only the r2blob
• Add docker for dist/jslinux to compile on macOS
• Add dist/jslinux using temu/rv64
• Dont force x86.pseudo on single-arch-non-intel
• Build fixes for empty muta, egg, fs plugin lists
• Fixes for Windows XP
• Add libandroid-spawn to Termux package installation
• Select CS_ROOT after including config-user.mk so configure --with-capstone-next takes effect
• • Add android-sdk script for multiabi toolchain
• Fix #​24090 - Android ARM64 static compilation
• Autodetect NDK from Android Studio in sys/android-*.sh
• Use an alternative windows ci action with newer deps
• Ignore the test_anal_types unit test binary
• Silence nullability extension warnings with GCC

ci

• Publish Android SDK in releases
• Specify ref to checkout testbins
• Dont build for filc in PRs

cons

• Use sorted RVec to store themes
• Update statically compiled color themes
• Detect terminal capabilities with COLORTERM
• Isolate new task command handlers with child consoles
• Isolate consoles and share console state in ctx cloning
• Fix edge cases of the sort comparator
• Make case-insensitive grep modifiers stage-local
• Fix chained grep range and column stage ordering
• Fixed multi-digit $:NN parsing
• Fix sort and uniq grep counts
• Fix ?. after filtered output
• XML formatting leaves a stale buffer capacity
• Expose cancel and failure states for RConsEditor
• Fix editor line-list ownership
• Remove global RConsEditor state
• Fix TAB help prompt redraw

core

• Route task output through parsed command contexts
• Keep task identity local to command execution
• Fix windows build (strset is declared in mingw and msvc string.h)
• Structure only natural loops in the pdc region AST
• Select core.pseudo in all plugin profiles that keep pdc
• Build a region AST for pdc with a pdct debug dump
• Move the pdc pseudo decompiler into a core plugin
• Fix #​26245 - Handle waitpid failures in r_sys_cmd_str_full()
• Report invalid analysis subcommands

crash

• Memory exhaustion bug parsing malformed kernelcaches
• Fix #​26390 - Bound HFS+ btree records and catalog names
• Fix #​26390 - ASAN OOBR when namelen > 30 in hsfplus
• Fix #​26374 - Stack oobread in print_insn_tic6x
• Fix oobread in ELF’s PN_XNUM
• Fix UAF in oc -;oc -
• Use dynamic base64 encoding in command callers
• Reject empty r2agent HTTP auth tokens
• Fix OOB reads in ropchain/pxb/ptb/px3 print commands
• Fix OOB reads in print commands and Apple cache parsers
• Fix OOB reads in dyldcache dep carving
• Fix #​26343 - heap OF using _dyn variants in ?b64[-]
• Fix stack overflow, offbyone, UB and leaks in the visual mountpoint code
• Fix #​26342 - stack overflow in tinycc include
• Fix pxd8 and pxu8 short-buffer reads
• Fix off-by-one in the http socket api
• Fix #​26325 - NULL realname dereference in disasm flag comments
• Prevent pipe and redirect injection after escaped quotes
• Fix r2agent authentication fallthrough
• Fix 1 byte oobwrite bug in the gdbclient
• Fix heap over-read at buffer end when parsing gdb regs
• Fix oobwrite in gdb register bounds
• Fix OOM crash in the gdbserver xml register
• Fix stack exhaustion gdbserver in xi:include href=self.xml
• Fix oobread in vFile pread gdbserver responses
• Same oobread for the P register packet parsing
• Fix oobread in gdbserver p/P register handlers
• Fix oobread in gdbserver p/P register handlers
• Fix #​26255 - heap overflow write in our gdb server
• Fix #​26258 - punycode encoder oobread
• Refactor and harden LE/LX page decoding
• Harden LE/LX section and relocation parsing
• Validate uleb128 parsing in the DEX debug-local operands
• Fix #​26240 - egg include parser buffer underflow
• Fix #​26241 - null deref on dex memory exhaustion
• Fix #​26243 - Handle REgg initialization failure
• Fix #​26246 - fdleak when pipe(2) fails in lang_pipe_run
• Detect NE relocation chains infinite loops
• Bound NE counted string parsing
• Harden lua parser fixing many oobreads
• Fix Lua function parser OOB reads
• Fix oobread in Mach-O protocol list pointer parsing
• Fix Swift Mach-O invalid type metadata parsing
• Fix Swift Mach-O member metadata bounds check
• Fix Swift Mach-O field metadata bounds check
• Fix null+1 bug in afvt parsing
• Fix bplist Unicode string conversion
• Fix oobwrite by one (final null byte) in RStrStore
• Always null terminate utf16->utf8 strings
• Validate Mach-O LC_DATA_IN_CODE ranges
• Fix oobread when skipping subtests in softmagic match
• Fix segfault in malformed dwarf
• Fix malformed pyc refs crash and discarded ELF reloc leak
• Fix oobread in ELF PN_XNUM phdr count handling
• Validate dmp64 page counts against dump size
• Fix pyc marshal interned ASCII handling and validate code object section sizes
• Fix heap write overflow in Python loader
• Reject truncated PEF relocation tables

debug

• Fix windows build and debugstop on unix
• Implement dcut command to continue until time
• Fix getreg/setreg on wxp
• Fix ptrace requests on NetBSD
• Fix the FreeBSD build of the syscall trace mask
• Fix typo in desil exprmatchreg == handling
• Fix wrong size used in realloc
• Handle arv as a mirror of drv, to handle vector registers
• dc calls aec when cfg.debug is false
• Initialize subprocess env when not available for nix-ld

disasm

• Derive emu comment stack args from the calling convention layout
• Resolve stack-located format strings and scalar call args in emu comments
• Unify pd/pi/pdj backward walk and align the map-start window
• Harden backward disasm corner cases near file start and blocksize
• Fix #​26262 - backward pdi/pdj drift when the window contains invalid instructions
• Add asm.cmt.invalid to comment invalid instructions
• Fix #​26262 - pdj and pdi with negative count on aligned archs
• Expand printf-family varargs from the format string in emu call comments

esil

• Fix mips.gnu REGIMM branch targets and unconditional link
• Fix MIPS bgezal/bltzal to always write the link register
• Fix mips.gnu jal ESIL empty jump target
• Set cr0 on PPC record-form instructions and fix sraw/srawi word sign extension in ESIL
• Fix mips.gnu add/mult decode fallthrough and add missing hi/lo registers
• Fix mips signed mult high word and add srav ESIL
• Add arm64 BICS ESIL and type BIC as AND
• Fix mips.gnu slt-family ESIL dstreg and signed comparison
• Fix x86 SHL/SAL and NEG condition flags in ESIL (incl. memory destinations)
• Fix arm32 CMN flags and MOVT top-halfword replacement in ESIL
• Fix arm64 sbc ESIL carry sense and add sbcs/ngc/ngcs with NZCV flags
• Fix NZCV flags for arm64 flag-setting ops and carry-in for adc/adcs in ESIL
• Fix PPC extsb/extsh/extsw ESIL to always sign-extend into the destination
• Encode full-width compare results in the PPC cr ESIL model
• Apply the delayed branch when the delay slot op emits no ESIL
• Fix arm halfword and byte load widths in ESIL
• Fix ppc64 ld ESIL to not update the base register
• Propagate stop reason for esil debugging
• Stop ESIL continue at unmapped PC

graph

• Point switch case graph edges at the case jump target

http

• Improve the launcher webui style
• Prevent stale WebUI assets
• Fix HTTP browser launcher selection
• Update the Material WebUI from latest radare2-webui
• Empty lines in http auth file let pass any password
• Protect with auth the r2agent web sessions spawns

io

• Initial io.ebpf for Linux-x64,arm64,rv64
• Fix #​26411 - oobwrite in io.gprobe
• Preserve permissions in io.xattr

lang

• Avoid null language plugin lookups

magic

• Run text magic rules after binary misses
• Fix #​26164 - libfile 5.47 deprecated regex/c

port

• Add dist/netbsd to boot r2 in the browser

project

• Fix new project script for meta, hint and var
• Add 'prj list' subcommand
• Complete Ct commands and project persistence
• Lossless Ct base64/json serialization

projects

• Fix new project script for meta, hint and var
• Add 'prj list' subcommand
• Lossless Ct base64/json serialization

pseudo

• Convert only whitespace-preceded semicolons to comments in pdc
• Bring back the orphan block in pdc
• Fix zero-width pdcj annotation ranges in the pseudo decompiler
• Use strbuf padding for pdc indentation instead of a fixed buffer
• Return NULL instead of false in the dalvik pseudo parser
• Fix #​26392 - oobread in asm_filter
• Initial h8300 pseudo decompilation
• Emit structured if/else in pdc
• Implement pdc* comment output

r2pm

• Add R2_LIBS with the library flags from R2_LDFLAGS

search

• Fix #​26294 - Search stops on 0xffffffff data when io.cache is enabled
• Fix disassembly regex parsing and validation
• Preserve instruction boundaries across disassembly search blocks
• Apply search alignment to disassembly hit starts
• Global search.maxhits in disassembly search (not reset after each map)
• Fix multi-regex disassembly sequence search
• Make text magic scan optional with /mt

shell

• Check r2p in basename for r2pipe calls
• Cleanup dollar files apis
• Iterate command aliases directly in the hashtable
• Port echo to task-owned command contexts
• Fix #​26377 - rm command silently ignoring -r and -rf flags
• Change b64: command behaviour and add b64:'
• Fix -j? and wire subcommands to js
• Accept parenthesis in temporal heading seek expressions
• Implement the heading @ syntax support
• Bring back the command substitution execution
• Improve cmd syntax test coverage and fix separator bugs
• Keep command substitution output opaque
• Support raw calls inside command substitutions
• Support literal commands after && and ||
• Normalize raw calls at command boundaries
• New CtxOnly RCmd API callbacks and add generic subcommands helpers
• Use the new cmdapi in the agD plugin
• Validate raw call addresses and faster quote strip
• Remove the deprecated double-quote raw call
• Preserve shell preprocessing and internal pipe chains
• Unify r2 and system shell command boundaries
• Support && and || command short-circuiting
• Add lazy argument slices to command contexts
• Add contexts for the new command handlers
• Keep command dispatch results structured internally
• Implement the new cmd api for trie based commands
• Make inline double quotes transparent before dispatch
• Preserve literal escapes in echo pipelines
• Fix the use of ', " and \ with lots of tests
• Prevent command injection in quoted spans
• Fix grouped grep after json format
• Fix subcommand parsing + help for z-
• Fix parsing /ad search subcommands modifiers
• Handle ed/-E errors and both behave equally
• Sync buffer length to avoid unnecessary strlens
• Respect cursor position in Tab, and autocomplete afvn varnames
• Fix exact autocomplete lookup for command arguments

sync

• Support thread conds on Windows 95/XP
• Add timeout support for r_th_cond_wait

test

• Avoid shared .tmp directory races between parallel tests
• Escape colon in count greps now that ~? honors line ranges
• Split the struct synthesis tests out of the overgrown types test file
• Add r2r test proving pdb unions survive the anal base-type path

tests

• Avoid shared .tmp directory races between parallel tests

tools

• Show -Os in 'r2 -v' for size optimized builds
• Add more vars for r2 -H
• Slurp raw stdin before converting it with rax2 -S
• Fix #​24090 - Android toolchain reuse across architectures
• Centralize rcfile path construction and update -E/ed doc
• Document r2 -E flag
• Make rasm2 -L exit 0 like r2 -L and rafind2 -L

types

• Regenerate c2 golden files and test in CI
• Accept multiline function signature definitions
• Parse function pointers within function parameters
• Store variadic args as both forms
• Fix ctypes argument store for fnptr members and (void) prototypes
• Remove redundant null checks before free in the C types parser
• Expose type signedness and variadic checks in the r_type api
• Type the variable receiving the malloc'd pointer in afts
• Resolve the type matcher arg location and slot offset from one lookup
• Resolve stack arg slots via the cc argslot API in the type matcher
• Synthesize allocator return objects in afts
• Report size-function provenance in aftsj sizehints
• Cleanup the size-fn harvesting code in anal_tp
• Harvest object sizes from memset-style call sites
• Support long return types with > 64chars
• More comma based types support for structs, surviving sizeof, pf and tsc
• Support member fields with types containing commas
• Parse hex array dimensions in struct and union members
• Unify struct/union sdb serialization between the C parser and base types
• Expose and use real type size and field alignment details
• Strip wrapping quotes from the afvt type argument
• Struct redefinitions replace the saved members
• Preserve struct member array counts through the base-type sdb roundtrip

util

• Add non-recursive thread lock support for Windows
• Preserve partial stdin reads and remove dead newline code
• r_stdin_readline: correct EOF handling
• Add RSys.open(), a reusable system opener API
• Fix duplicate separators in r_file_root paths
• Fix r_num_units integer check for 80bit long doubles
• Disable log colors on legacy Windows consoles
• Implement strict vs tolerant base64 parsing modes
• Fix #​26359 - out-of-range shifts and rotates in RNumMath
• Fix hex string escape decoding
• Document tolerant base64 decoding
• Initial import of the Trie data structure
• New r_sys_exepath and more portable pidpath api
• Add r_str_filter_file API for project names
• Fix #​26244 - Prevent r_sys_cmd_str_full pipe hangs
• Fix dominator tree construction and add unit tests
• Add r_str_printfmt and the pfp command to map printf formats to vararg types
• Preserve callback RNum errors in math parser
• Fix math tokenizer race condition in RNum
• Add the new RStrPnlen for printable length strings
• Match unstripped function names in type guesser so afs protos resolve
• Optimize strbuf with less strlen and better weakref uses
• Format large strbuf appends in place

visual

• Implement scr.drag to click+drag to scroll in disasm/hex/graph
• Fix null dereference on prompt exit in visual find
• Fix visual disassembly scrolling across middle boundaries
• Fix disasm scroll bug over metadata
• Lock horizontal scroll in hexdump/disasm with scr.wheel.hscroll
• Fix visual disasm reverse scroll over metadata rows
• Fix visual disasm scroll stuck inside metadata

windows

• Add dist/reactos to create live web images for r2
• Fix debugger bugs for w32 (io read, attach and maps listing)
• Parse more ansi escape codes for non-vt terminals
• Disable more ansi codes on non-vt terminals
• Fix RCons.clearLine performance on legacy w32

zignatures

• anal: fix zignature drop for functions with empty-typed vars or varargs

v6.1.8

Compare Source

Release Notes

Codename: "Exploit Twist"
Version: 6.1.8
Previous: 6.1.6
AbiDiff: 107-110 (3)
Commits: 236
Contributors: 18

curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.8/radare2-6.1.8.tar.xz | tar xJv
radare2-6.1.8/sys/install.sh

Highlights

More details

Authors

Abhi Evgeny Kolmakov Jon Palmisciano Kevin Stubbings Lazar Aleksic Luisss003 Nitan Alexandru Marcel Ole André Vadla Ravnås ada-l0velace bdunahu dependabot[bot] pancake pancake pancake phix33 phix33 potato randomjack94dev

Changes

abi

• The sdb_remove has been deprecated as dupe for sdb_unset

analysis

• Keep duplicate single-instruction import trampolines distinct on name collision
• Autoname import call stubs after the imported function
• Don't create string metadata at addresses inside analysed functions
• Add pebble script for stub scans
• Optimize SDB key renames in analysis metadata
• Ship the syscall tabl

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.