rizin

In this release we continued the long-running migration toward the unified RzArch plugin model: the legacy RzAsm struct was dropped from the public API (a compatibility layer remains for the in-progress parts), and ESIL was moved into its own isolated namespace. ESIL remains deprecated and is scheduled for removal, while RzIL continues to grow as its replacement. Sadly, in this release we weren't able to finish the ESIL->RzIL migration yet, but we made a substantial progress in this regard and have working prototype.

On the architecture front several new disassemblers and analysis plugins were added. TMS320C54x joins the TMS320 family (whose C55x/C55x+ RzIL coverage was also greatly extended), classic BPF (cBPF) disassembly was added, SuperH-3 (SH-3) is now selectable via asm.cpu, and new M680X CPU types (RS08, HCS12X) and MCS96 ISA variants (8096/80C196/80C296) are supported. MCS96 got the analysis support. We also moved more plugins onto Capstone v6 (now 6.0.0-alpha9): RISC-V was rewritten on top of Capstone, HPPA (PA-RISC) switched to the Capstone disassembler (dropping its GNU plugin), and M68k ColdFire support was added. Infineon C166 and MIL-STD-1750 support was added as well. DEC VAX was rewritten from scratch and analysis was implemented.

On the RzIL front, uplifting was expanded with scalar x86 SSE/SSE2 floating-point instructions and a full SPARC lifter, and the RzIL VM can now halt on exceptions. Also, the uplifting was implemented for the whole TMS320C5x series. RzIL output is now first-class in the UI: a new pl/plF print path, colorized RzIL in ao, and colors, Unicode and RzIL in the visual bit editor.

The pf format was completely reworked and syntax has changed to support more features and be more consistent. Consult with the doc/pf.md and pf? output for more details.

A major new visualization arrived: statistical/entropy histograms. Rizin can now render per-block χ², index of coincidence, min-entropy and serial-correlation graphs (essential indicators that allow to scrutinize data when simple entropy is uniform), both as vertical (p=) and horizontal (p==) histograms, several with an interactive minimap mode. A new Marks subsystem (the m command family) lets you place, color, comment, name and navigate named locations in the file.

Visual bit editor mode was improved:

A new color theme "underwater" was added:

Binary-format support saw a lot of activity. New loaders/parsers were added for STABS debug info, Lua bytecode (Luac 5.0–5.5) and LuaJIT 2.1, the CaRT container, Amiga hunk, MDT (Qualcomm peripheral images), and PEF (Preferred Executable Format); the NE parser was rewritten and bootimg now understands v1–v4 images. The iH header-structure command was extended to a long list of formats (WASM, DEX, AVR, PYC, bFLT, CGC, Menuet, …), and ELF coredump parsing was added for LoongArch, s390x, RISC-V, PPC64, HP PA-RISC and DEC Alpha. Python 3.14 bytecode is now supported.

The debugger's heap inspection was reorganized into per-allocator namespaces under dmh: dmhg for glibc (renamed from dmh), dmhw for Windows heaps (renamed from dmw), and dmhj for jemalloc (renamed from dmx, with new jemalloc 5.3.0 support). On the analysis side we added value constraints for variables and globals, **C++ devirtualizati

Security fixes

• Fix CVE-2026-22780
• Fix heap-based OOB write in mach0_chained_fixups.c
• Remove unused LE fixups parsing

Miscellaneous

• Various small fixes for Haiku OS port

• Fix tree-sitter's C grammar dependency building
• rz-find: do not print filenames without a match
• Forbid aav analysis step when the architecture is MIPS (fixes misalignment issues)
• Fix izx and iz commands help
• Fix pxf command to print function hexdump
• MIPS: set correct instruction alignment according to the CPU
• Split very large basic blocks
• Fix possible NULL derefence in the RzCrypto

In this release we completed migration of the code to the rzshell - YAML-based commands description language and corresponding APIs.

Another notable refactoring change - a beginning of merging RzAsm and RzAnalysis plugins into RzArch ones, currently incomplete and with compatibility layer. Move RzParse plugins into the RzArch as well. Huge refactoring happened in search commands, to better handle Unicode and regular expressions.

On the RzIL front, new architectures now support uplifting:

• MIPS
• PIC
• MSP430
• Xtensa
• Hexagon
• Tricore uplifting was improved to include all missing floating point instructions.

New architectures were added:

• DEC Alpha
• nanoMIPS (a part of MIPS ISA family)
• LoongArch.

As usual, these architectures were added into the Capstone as well.

ESIL is marked as deprecated and will be removed in the next release.

Analysis behavior slightly changed - now Rizin checks for jumps to function preludes by default.

Added support for parsing PE relocations. Added support for Python 3.11-3.13 bytecode versions.

New and refactored search commands (strings, bytes, cryptographic material) dispatch their work now into threads. Making them faster on large files. This drops support for search modifiers /f, /b etc.

And, as usual, droves of various fixes across the framework.

Show scrolling progress in percent in various interfaces, e.g. in Vv (lower right corner):

New command line options

• rz-find -E to execute a command on every match
• rz-ax - add MS-DOS and Win32 timestamp conversion
• Add linker version to rz-bin -I output

New commands

• dcco - continue until call
• aezsue - step until PC equals given address and output RzIL VM changes
• fdt command to print more information about the flag
• dbtt to print in a table mode
• aLc command to list features and CPUs of an RzArch plugin (and rz-asm -m to do the same)
• /cm to search for cryptographic materials
• /ce and /cef commands for entropy search
• /z command for searching strings (supports now Unicode 16, regex, and many encodings).
• izx data to list strings that are referenced from somewhere else

Removals

• Deprecated APIs
• RAP protocol
• NIOS-II architecture support
• fb command
• dta command
• /w - now handled by /z
• /!
• /b
• /f
• /+
• /cd
• /ca
• /cr
• obr
• rizin -Q flag

Renames:

• avg renamed into avgl, added table mode
• / command became /z
• /e command became either /z or /xr

Configuration variables changes

Removed options

• str.search.max_uni_blocks

Renamed options

• str.search.encoding -> str.encoding - Valid for all string interpretations.
• str.search.max_threads -> search.max_threads - This is a general setting for the search now.
• str.search.raw_alignment -> search.str.raw_alignment
• str.search.min_length -> search.str.min_length
• str.search.buffer_size -> search.str.max_length
• str.search.max_region_size -> search.str.max_region_size
• str.search.check_ascii_freq -> search.str.check_ascii_freq

Dependency

This release adds a dependency on SoftFloat3 library for RzFloat and RzIL floating point operations.

Sponsors

@stephen-fox