radare2

Release Notes

Codename: "The Magnetician" Version: 6.2.4 Previous: 6.2.2 AbiDiff: 142-152 (10) Commits: 453 Contributors: 18

curl -Ls https://github.com/radareorg/radare2/releases/download/6.2.4/radare2-6.2.4.tar.xz | tar xJv
radare2-6.2.4/sys/install.sh

Highlights

Authors

Abhi Angelo Ayton Ch1p Jon Palmisciano Mustafa Senoglu Priyanshu Kumar Suyun curoky dependabot[bot] kisnner mmustafasenoglu pancake pancake pancake phix33 potato sid xXAbieGamingXx

Changes

abi

• Eliminate the CbPrintf calls from RDebug
• Eliminate CbPrintf from RAnal
• Use RVec in RFlag

anal

• Avoid repeated CFG walks when chopping noreturn blocks
• Keep landing pads when chopping at a noreturn call
• Restore the stack depth when sp is set from bp
• Cache decoded ops to speedup backtracking type matching
• Stop function walks at symbols hidden behind class flags
• Run aae with just VAL, no more OPEX hacks
• Cache clobbered regs from dyncc profiles (20% faster)
• Cache calling convention lookups
• Take a split block's entry depth from the function walk
• Track stack frames larger than 8 KiB
• Add golang cc
• Default Swift binaries to the swift calling convention
• Fix the arm32 swift cc self, error and argument registers
• Keep swift self and error names through type propagation
• Fix opcode mask bit order and invalidating bits
• Analyze and emulate A64 consistent conditional branches
• Add A-key pointer authentication function preludes
• Don't register partial xrefs with aae
• Silence the noisy aae hints
• Fix microMIPS invalid instruction recovery in both backends
• Fix #21246 - Keep microMIPS instruction boundaries in pdf
• Fix #13850 - Recover stack strings passed to char pointer arguments
• Fix stack array indices across stack adjustments
• Read swift self and error roles from the linkage name
• Give the swift cc the platform clobber and preserve sets
• Rewind stack types with the bytes on a bbstate restore
• Rewind the stack with the registers on a bbstate restore
• Optimize trycatch analysis using binary metadata
• Resolve ARM64 stub island branches with a:sixi
• Use the active ARM configuration for pointer scans
• Restore incremental analysis after writes
• Fix Thumb ESIL scan alignment after skipped instructions
• Cache calling-convention argument locations per function
• Invalidate cached function ref counts with an xref generation counter
• Keep the other xrefs of an address when deleting one it does not have
• Recover small register arguments from shared operand metadata
• Share stack variable recovery and x86 access construction
• Fix #26760 - Refresh inferred x86-16 arguments
• Fix typed frame recovery and preserve renamed prototypes
• Preserve function prototypes during variable recovery
• Add fpret register names in callconvs
• Refer an arm64 load through the last adrp to the slot it reads
• Fix ARCompact branch conditions and immediate decoding
• Fix arm64 DWARF variable locations against sp and x29
• Resolve fcncc when assigned
• Fix arg class homing for spills, scanf and aliases
• Home each arg on the next free register of its class
• Resume switch tables from the walk instead of recursing into the

Release Notes

Codename: "infandmore" Version: 6.2.2 Previous: 6.2.0 AbiDiff: 132-142 (10) Commits: 388 Contributors: 22

curl -Ls https://github.com/radareorg/radare2/releases/download/6.2.2/radare2-6.2.2.tar.xz | tar xJv
radare2-6.2.2/sys/install.sh

Highlights

Authors

0xf00sec AGhebrea Aayush Khanna Angelo Ayton Bernhard M. Wiedemann Claude Jinbao Chen Kirby Kuehl Kleopatra Poritsi Mohammed Hassan Priyanshu Kumar Ruffalo Lavoisier Vaibhav Srivastava Vectrain51 mmustafasenoglu pancake pancake pancake phix33 phix33 potato root

Changes

abi

• Make RIOBind reads return byte counts
• Deprecate r_bin_is_static as requested by R2_590

anal

• Dont recover fp vars in frame-less functions
• Fix switch ownership when analyzing overlapping blocks
• Add arm64 swift convention for fpu args
• Rename default register arguments once when recovery ends
• Handle subregister arguments on x64
• Fix wrong variadic detection when eax is written before testing al
• Fix calling convention for arm64/swift fpargs
• Refresh VARTYPE metadata after variable renames
• Dont reuse fp args after calls
• Simplify floating-point argument recovery
• Add dyncc floating-point argument registers
• Memoize cc arg counts and skip fp walk on integer ops
• Recover float args from a separate fparg register sequence
• Fix readAhead UB in the function analysis loop
• Remove duplicate counted read bookkeeping
• Fix partial reads in analysis consumers
• Fix jump tables truncated by short reads
• Stop walking pc-relative indirect jumps as jump tables
• Analyze disconnected exception handler blocks
• Fix RAnalOp leaks in the disasm, diff and debugger decode loops
• Fix aeg folding ops without a dfg handler into constants
• Fix the memory leak and quadratic cost of aoj with many opcodes
• Fix dfg esil for goto and cmps
• Fix JSON disassembly architecture hints
• Use function call conventions for afsj arguments
• Fix fp local variable and arm32 reg tracking
• Resolve typed JNI table calls in analysis
• Typed JNI interface tables and indirection
• Materialize typed JNI native methods during analysis
• Add the new jni analysis plugin
• Stop afb and afbi from deleting switch cases that share a target
• Drop a stale arg from the float-formal expectation
• Separate a formal's ABI position from its sdb index
• Place formal parameters that DWARF leaves without a location
• Quiet aavrq to reduce noise in aaa
• Expose more switch details in the json output
• Forward register args through direct tail jumps like calls
• Match forwarded callee args by register instead of argnum
• Include the switch default target in block successor iteration
• Dont treat the returned int as a variadic marker
• Preserve registered types when linking DWARF prototypes
• Link DWARF types only when prototypes match
• Name local plt stubs in x86 retpoline layouts
• Free all flag metadata strings
• Name local plt stubs from their got relocs in aa
• Split the type propagation plugin into libr/anal/p/tp
• Warn fo

Release Notes

Codename: "Febrer Deams" Version: 6.2.0 Previous: 6.1.8 AbiDiff: 110-132 (22) Commits: 503 Contributors: 25

curl -Ls https://github.com/radareorg/radare2/releases/download/6.2.0/radare2-6.2.0.tar.xz | tar xJv
radare2-6.2.0/sys/install.sh

Highlights

Authors

AGhebrea Abhi Anton Bolshakov Claude Evgeny Kolmakov Hissssst MiKi Mohammed Hassan Mohammed Hassan OrbisAI Security ProMix Ricardo J. Rodríguez ada-l0velace arhwx dependabot[bot] gogolovefish neil nnguyen609 pancake pancake pancake phix33 phix33 potato ryawa

Changes

abi

• Pahole more structs to drop gaps and reduce struct size
• Make RCons authoritative for command help rendering
• Unify the struct and union member model into RAnalTypeMember
• Use BE bool flag (instead of int le) for utf16->utf8

anal

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Name the stack canary from a register write index instead of trace position
• Fix cc stack arg slot offsets and bound the argslot scans
• Fix the double return-address skip in the callargs stack walk
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Keep fail-only fallthrough edges in the function graph
• Fix arm64 =SN syscall register alias to follow asm.os
• Use stateful decoding in the /r, aea and aespc linear sweeps
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Unify struct and union field picking and simplify the const retype in aaft
• Propagate callee types into struct and union fields during aaft behind types.fields
• Add anal.gpseed to seed a PIC base register during ESIL analysis
• Use r_anal_block_successor_addrs_foreach to build the function graph
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument acce

Release Notes

Codename: "Exploit Twist" Version: 6.1.8 Previous: 6.1.6 AbiDiff: 107-110 (3) Commits: 236 Contributors: 18

curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.8/radare2-6.1.8.tar.xz | tar xJv
radare2-6.1.8/sys/install.sh

Highlights

Authors

Abhi Evgeny Kolmakov Jon Palmisciano Kevin Stubbings Lazar Aleksic Luisss003 Nitan Alexandru Marcel Ole André Vadla Ravnås ada-l0velace bdunahu dependabot[bot] pancake pancake pancake phix33 phix33 potato randomjack94dev

Changes

abi

• The sdb_remove has been deprecated as dupe for sdb_unset

analysis

• Keep duplicate single-instruction import trampolines distinct on name collision
• Autoname import call stubs after the imported function
• Don't create string metadata at addresses inside analysed functions
• Add pebble script for stub scans
• Optimize SDB key renames in analysis metadata
• Ship the syscall tables for PebbleOS
• Render array stack var element accesses as name[i] in disasm
• Shadow phantom stack vars overlaid by an array-typed variable's extent
• Optimize a:six and add more tests for it
• Fix afv mislabeling DWARF register locals as args by honoring isarg
• Fix PPC bctrl losing CALL type under capstone6 via BCCTR/BCCTRL alias ids

arch

• Harden PPC64 TOC tracking by invalidating toc_map on register clobber, call and return
• Invalidate the PPC TOC register cache on function return
• Validate asm.cpu against plugin CPU list
• Default cpu for avr is now ATxmega128a4u
• Fix PIC disassembler on big endian hosts
• More ARM big endian fixes
• Update capstone v5/next, bigendian, m68k and x64 fixes

asm

• Apply the pseudo filter only once in rasm2 and pad

bin

• Fix obf reload stacking duplicate bin objects and io maps
• Autoresolve anal.gp for ppc32 via small-data
• Handle as cyclic memory the raw string map address wraparounds
• Honor paddr in raw strings
• Fix raw string rebasing for non-VA sections
• Fix #10722 - Respect mapaddr on raw strings
• Optimize dyldcache local symbol matching
• Fix #26079 - Local symbols missing in dyldcache
• In ftab/gns1 use segment tags for proper archinfo
• Harden GNS1 loader
• Add FTAB extractor plugin
• Improve GNS1 detection to solve dyldcache false positives
• Require spaced arguments for iz+
• Fix dyldcache local symbol offset matching
• Add R_DYLDCACHE_NO_DEPS option for shallow filtering
• Auto-resolve PPC64 TOC base (anal.gp) for ET_REL and ELFv2
• Fix fuzzed PE timeout bug, clamping vsize
• Reduce false positives in the PL PEs id
• Add Rust and D demanglers
• Add new C++ demangler
• Add IBM XL demangler
• Add ARM ABI demangler
• Add ldmap.r2.js script to load sourceline from ldscript map files
• Fix more bigendian parsing bugs for PE
• Fix kernelcache parsing on bigendian
• Fix SFC parsing on big endian
• Fix big endian parsing bug for MDT
• Implement idd command
• Apply PPC64 TOC16 relocations to addis/ld immediates on ET_REL
• Clean LE endian-safe parser
• Detect ppc32 e500/e500mc cpu from .PPC.EMB.apuinfo note
• Fix memory leaks in the mdmp parser
• Fix misaligned PPC ET_REL REL24/REL14 relocation targets

build

• Fix riscv_cs cap