Authors

Alex Bender Apkunpacker Azox Davide Pizzolotto Dennis Goodlett Enshin Andrey Ilya Trukhanov László Vaskó Maijin Murphy Paul I RHL120 Royos90 Sylvain Pelissier aemmitt-ns gogo hot3eed lasek0 pancake pancake

Changes

anal

• Properly stringify the RAnalOP.type field
• Implement aaff command and improve aaf? help message
• • Extend afj command to handle all jump table parameter options
• Implement 'afs*' command to export function signature info in r2 commands
• Fix afsj, taking signature args instead of fcnargs in json
• Initial import of the arm64v35 disassembler and analysis plugins
• Optimize infinite loop on non-quantum computers
• Avoid assert on avr's null cmpreg test
• Finish the tolowering of anal.noNULL
• Fix aef and aaef to actually find xrefs at least

asm

• Fix #18813 - Cannot assemble cmp w26, 0 in arm64
• Fix #18876 - Check imm bounds for some instructions in the x86.nz assembler
• Add pushf/popf instructions to x86.nz
• Use RAnalBind in RAsm to reuse RAnalPlugins to disassemble
• Update ARM64 arm.sdb.txt opcode descriptions from documentation
• Update the VAX disassembler from binutils

assembler

• Fix #18872 - New command 'wan' to write and nop affected instructions

bin

• Fix #18783 - Support ELFs with phnum > 0xFFFF
• Allow RBinPlugins to use RBinFile at check()
• Initial support for the TIC-80 Fantasy Computer cartridges
• Replace SDB with HtPU in RBin.filter_name()
• Put archinfo.{minopsz,maxopsz,align} in the output of i
• Implement ELF relocs for VAX

build

• Add portability support for Vinix
• Add meson support for the anal.arm.v35 plugin
• Add preconfigure/configure/make batch scripts for Windows
• Initial import of ./preconfigure for packaging purposes
• Improve the macOS packaging scripts
• Import radare2-win-installer files into dist/windows
• Fix meson build and proper use of cgen
• Fix system() on arm64 macOS targets (#18877)
• Initial support for capstone-less compilations
• Build and publish the ZIP with the WASI bins
• Add initial support for building r2 on WASI

ci

• Version the artifacts

cons

• Dont check out of bounds last chars
• Honor faster ^D on interactive execution path
• Fix arrow handling after fixing mouse clicking glitches

core

• Honor bool in io.va, scr.interactive, scr.prompt and cfg.fortunes
• Optimize and improve r_name_filter calls
• Add &w command to wait and run for queued commands
• Implement &: for queue commands
• Implement @@== foreach word iterator operator

debug

• Fix the windows debugger and make it more stable
• Add tests for the improved signal handling messages
• Change the way wait events are handled in the unix-debug backend
• Add 'sigstr' to the 'di' output for verboser stop reasons
• Add RSignal.toHuman() and improve RDebugReason.toString()
• Use DRX APIs to handle breakpoint recoils only on x86-64

disasm

• Support arch.* namings for the parse plugins
• Better x86.pseudo and varsub for strings
• Fix r_str_ansi_len() causing unaligned 'unaligned' words
• Improve invalid address and string parameter issues in emu.str and pd comments
• Improve x86.parse for asm.pseudo

esil

• Fix emulation for AARCH64 ldr,str,stp,ldp instructions
• Fix #18860 - mul and imul for *dx operands and 64 bit widths
• Bring back pins to esil land
• Fix POPF POPFD POPFQ not increasing stack pointer
• Add wide and math instr esil for dalvik, pac esil for arm64
• Initial implementatil of ESIL macros

fs

• Add mwf command to write local files into remote targets

io

• io.plugin.lseek -> .seek for portability (wasi related) (#18840)

panels

• Add xX key descriptions in the help message

print

• Improve the pdc output to allow recompilation
• Initial implementation of the pdo esil2c output

projects

• Dont save projects when no project is used
• Exclude files of nested rvc repos from repo_files()
• Use r_sys_whoami as the author name for r_vc_commit
• rvc add r_vc_find_rp
• Rework r_vc_checkout and fix some mem leaks
• Rework the rvc_commit functions
• Take advantage of prj.vc.type and merge rvc & git
• Fix r_vc_commit and other functions
• Major rvc api refactor to use sdb

rvc

• Fix memory leak and infinite loop in r_vc_find_rp

search

• Implement /ck command to search for crypto constant tables
• Rename /cu UDS CAN table search to /ru command
• Add PGP search for signature and RSA encrypted private keys (#18961)
• Add /cg command to search for GPG artifacts
• Update tests and add /a[?]q for quiet-legacy mode
• Use pdi in /ad output
• Initial implementation of spp, snp, /bp and /pp to find next/prev preludes
• Add /ab to find backward jumps (mostly loops) and handle ^C

shell

• Autocomplete :. command
• wv1,2,4,8 accept many space-separated numbers now
• Remove other useless and incomplete treesitter leftovers and get +400 new commands in the recursive help
• Remove colons in "?" number conversion output
• Honor < and > comparison operators in RNumMath
• Use RNum.math in "?b" to make '?b 1<<1' work
• Add scr.hist.filter to toggle the filtered history up/down search
• Improved reverse-search in command history
• Faster ^D (leave r2 without freeing the core)
• Completely eliminate the deprecated backslash command
• Add some help and better parsing for the anal hints

signatures

• Add r_sign_metric_search to r_sign.h
• Fix bug in zaf creating zignspace
• Expand r_sign API
• • Use r_sign in rasign2
• Support FLIRT v5 file format compression

tools

• Rename rvc2 to ravc2 to follow the ra*2 pattern
• Add rasm2 -LL to list anal plugins loaded

vc

• Integrate rvc in projects and add a default commit message

visual

• Add context in visual xrefs
• Fix #18843 - Implement Vx[+-] to add/delete xrefs
• Fix glitches when clicking in the hud
• Fix asm.hint.imm keystrokes ignored
• Fix #18292 - Clarify the use of Vdn/Vdr and rename VdR to VdX
• Handle 'o' key for options in panels
• Initial implementation of ~.... for hudline prompt
• Add Vi+ Vi- keys for visual insert byte inc/dec
• Add Vi: keystroke to run commands on insert mode

windows

• Use dynamic api resolution on windows builds for better portability

Changes

anal

• Improve aaaa log messages and avoid aaef to run in debugger mode
• Fix many zero cases in some jump table analysis
• Fix disasm alignment of data words in s390x disassembler plugins
• Fix s390.gnu disassembly and add test for 6 byte instructions
• • Better debug messages instead of r_warn in jmptbl analysis
• Better debug messages instead of r_warn in jmptbl analysis
• Use gperf on anal/d and improve build and checks
• Implement afxm command to show an call refs map
• Apply fix in sixref plugin to be in sync with the latest xref
• Type added: "char**" to SDB, ref #18633 (#18636)
• Fix boundary check in aao to parse more refs
• Fix 'Cannot find return type for' calling convention issues when saving a project (#18638)
• Fix 13482 - Remove anal.jmp.after variable (#18629)
• Improved type propagation analysis
• Fix #18323 - honor anal.calls in aa

asm

• Fix #18619 - Wrong assembly generated for: "add x0, x0, 1, lsl #12" (ARM64)
• Fix rasm2 -w in termux (honor R_SYS_ARCH)
• Fix rasm2 -w in termux (honor R_SYS_ARCH)
• Handle je and jne as aliases for jz and jnz in wao
• Rename sysz to s390 and add the s390.gnu plugin from binutils 2.36
• Update sdb and use of SdbGperf in asm.d
• Switch to Capstone5 as default

bin

• Dont trust the unaligned rich PEs
• Add initial toy IBM S390 Object File Format parser
• Fix #18724 - Use RCharset in rabin2 -z
• Always load bin types as pf. format strings
• Add WAD file parsing (#18659)
• Fix #18679 - UAF when parsing corrupted pyc files
• Fix #18667 - division by zero in the macho parser
• Speedup dwarf loading when no files are found in disk

build

• Fix #12335 - ignore system-installed r2 includes
• Add use_cgen meson option
• Add support for acr/musl-gcc static builds
• Improve the xxhash system library detection
• Make meson compatible with older versions (RHEL8 meson 0.49) (#18684)
• Fix --with-rpath and add CI tests (#18668)
• Collapse all opcode_*.c files into opcode_all.c

charset

• Implement IBM EBCDIC 0037 character encoding

cons

• Fix grep cmd with neg (#18763)

debug

• Add missing =SN and zf for the darwin-arm64 native debugger reg profile
• Fix infinite loop in r2 -c 'ood;ood' -
• Fix dmha output after ood (#18710)
• Fix cast issue in ptrace call, waitpid fix
• Show string version of the stop reason in di

diff

• Add byte signature diff zd

disasm

• Fix #18427 - Sort flags by [sections,formats][other][regs]
• Fix multiline comments in 'pd' with asm.cmt.right=0 and 1
• Avoid the use of sscanf, better parsing and error checking, handling negative switch cases
• Fix #16677 - Honor asm.sub.jmp in pd
• Fix #13200 - Honor anal hints in asm.meta=0
• Swap xref and flag comments as suggested in #18427
• Implement asm.hint.imm and integrate it in visual

emu

• Add arm16 ldrd esil tests
• Implement aeis to initialize argc, argv and envp for emulation

esil

• Fix emulation for ARM's ldrd
• Add 'aev' as an alias for VbE and improve esil debugger
• Fix #18736 - Eliminate REPEAT ESIL command, fix BSF/BSR x64 expressions

hash

• Fix #18727 - Support more hashes in ph

io

• Implement socket:// plugin, inspired by radare1
• Rename tcp:// to tcp-slurp:// and improve help message
• Add io.cache.nodup to not write the same bytes in the cache

lang

• Add GO rlang plugin (#18646)

p…

• Properly report error when trying to use an invalid pd subcommand

print

• Fix empty lines in hexdump with multiple comments in one line
• Support multiline comments in px
• Fix #18309 - Better error messages for the pf command
• Fix #18308 - Fix pf parsing issues and support write on enums and bitfields
• Add help messages for pde pdr pdp
• Implement 'px--' context hexdump command
• Remove assertion in pFA
• Fix #4903 - Handle 'w' in x/
• Improve error message in pa command
• Honor cfg.charset in px and support escaped encoding
• Support null bytes in r_print_raw
• Fix oob crash in 'pri' command

projects

• Fix #18641 prevent overwriting projects with Ps

r2pipe

• Add ===errmsg to support the new r2pipe side

search

• Fix rafind2 issue with small or negative blocksize
• Reset certificate search properly (#18664)

shell

• Fix autocompletion for 'e ' and handle cfg.charset=
• Fix #16674 - Kill ' and \ commands, use ':' for the only alias of =!
• Implement @@@e and @@@E to iterate over entries and exports
• Handle aliased files in wff and wtf commands
• Remove tree-sitter and the r2-shell-parser

signatures

• Consider collision
• Fix bug in graph matching
• Create function when z/ finds byte
• Add R_SIGN_BYTES to metric search (#18703)
• Support zignature collisions with the new zac command
• Fix bugs in mergeItem zignatures
• Refactor output and serialization of signatures
• Make z/ search sigs seen in z*
• Refactor signature matching
• Add byte signature diff zd

tools

• Add rafind2 -L to list IO plugins (same as r2 -L)

types

• Fix #16687 - Handle multiple colon separated paths in dir.types

util

• Add r_rbtree_cont_node_{first/last} (siol_eternal)
• Add size parameter to r_magic_load_buffer

visual

• Fix v;! in sync with V;!
• Check if target is writeable in Vc+-
• Add scr.optimize with experimental optimization ansi routine
• Better v!!!!!!! behaviour
• Add noflush guards to fix visual debugger mode

write

• Implement wcf command to patch file with cache changes into a new file

Alexandr Alexandr Alexis Ehret Alucowie Basstorm Dennis Goodlett Florian M"arkl Francesco Tamagni Khairul Azhar Kasmiran Lars Wrenger Murphy Pamplemousse Paul I RHL120 Reviakin Evgeny Roman Valls Guimera Sylvain Pelissier Taggggy condret el-goe gogo gogo2464 intruder-kat ivan tkachenko meme mio mrglm murphy pancake ramikg soroosh-chabi temp1337 valdaarhun wargio

**anal**

• Use =RS 8 for avr
• Add =RS directive in reg profiles to define default value
• Fix jump table analysis issue for r2ghidra.v850 (#18550)
• Test for pcdelta ARM ldr fix
• Fix pcdelta for ARM esil LDR
• V850 jmptable fix, cmpval is almost always -1 and slows anal to a crawl (#18498)
• Add missing v850 calling convention definition file
• Remove unused type FcnTreeIter
• Fix oobread ppc plugin
• handleMidFlags: Reset ds->midflags on entry
• asm.flags.middle: Don't split bb instruction
• aae: Realign on fcn start if not in bb
• Fix duplicate vtable entries after 'aaa'
• af-*: Remove function flags too
• Fix cX command and minor cleanup
• Fix PSW register bits definition for v850
• Add support for jump tables on v850
• Fix #18284 (json command returning empty string)
• Cd1 Cd2, Cd4, Cd8 are aliases for Cd[1248]
• Fix SN register value for linux-arm64
• Improve reg profile parsing and error handling
• Detect shift for the first switch case
• • Fix gcc 9.2.0 kind of x86_64 jumptables
• New command: aaw, flag all words pointing to known flags

android

• Add r_file_binsh() and avoid hardcoding /bin/sh for Termux

api

• Remove some exit() calls in libr
• Rename r_cons_memcat to r_cons_write
• ABI/API break. RAnnotationCode->RCodeMeta
• Use more r_str_ncpy and improve it to not alloc beyond nullbyte
• Add r_vector_flush()
• Apply desired lifecycle of esil syscall and interrupt handlers in esil_dummy plugin
• Add r_anal_esil_{syscall/interrupt}_{get/del}

bin

• Parse the symbols from the ELF .gnu_debugdata section
• Support x86_64 and macOS dyld caches (#18570)
• Fix wrong demangling of tiff swab16 bit data
• Use r_bin_import_free() as cb for imports list (#893)
• Improve python disassembler and binary parser
• Fix large loading times when parsing encrypted/fuzzed macho
• Do not consider ELFs with .gnu_debugdata section as stripped
• Fix Mach-O related coverity issues
• Fix coverity issues in xnu kernelcache
• Fix ASAN crash when allocating more relocs than the filesize
• Fix long time analyzing oob objc data
• • Fix long time analyzing oob objc data
• Fix asan crash found in r2_hoobr_dex_loadcode
• Fix oobread bug in r_str_(ndup|nlen) APIs spotted by ASAN in SMD parser
• Fix UAF in rz_bin_reset_strings()
• Fix assert in iSj for invalid size sections
• Minor ELF cleanup, using more size_t and ut64.max instead of 0
• Add Support for new CoreSymbolication element format
• Unset io.cache when not needed after bin.cache
• Fix warning message when loading files with relocs

build

• Move shlr/tcc into libr/parse/c
• Fix meson build issues related to grub (#18554)
• Fix the failure in finding the executing user's ID during install (#18508)
• Add the nogpl meson option
• Fix version not being updated after running sys/termux.sh
• Update doc/license for more clarifications
• Add plugins=nogrub option for meson
• Improve sys/termux.sh checks
• Do not run sys/ldconfig on Android
• Add missing use_fork and use_dylink to meson
• Fix #18397 - Be less strict when running sys/install.sh as root
• Fix debian32 in CI
• Allow custom CFLAGS for Debian packaging
• Add meson -Dplugins=a,b,c to build only the specified plugins
• Fixes to make the r2blob shine again
• Add 32bit Debian packaging and bonus CI fixes
• Add use_ssl meson option to be in sync with acr behaviour

charset

• Implement ps, psz, psj and psj with charset support
• Support multi-byte input in charset
• Add more runes to pokered

ci

• Fix linux-static pub action

cmd

• Sync om and omj output

cons

• Fix Ctrl-J issue and remove redundant code in 'Ctrl-J' block
• Implement RConsPixel and RBraile APIs
• Fix #16254 - grep expression parse improvement
• Fix null derefs on RCons when no context is provided

core

• Fix #18412 - Add R2_IGNVER variable to load plugins ignoring the version
• Remove asm.bb (asm.bb.line -> asm.lines.bb, asm.bb.middle -> asm.bbmiddle)

crypto

• Update to use keys that can be programmed onto a CPS2

debug

• Implement drcq and show it in visual debug/emu
• Fix #18502 - dangling pointers issues in dbm
• Revert "dmi commands handle symbols, exports, main, entries too
• dmi commands handle symbols, exports, main, entries too
• Implement dmis command as an alias for .dmi*
• Workaround the dmi issue by using rabin2 in macOS for now
• Add dbg.maxsnapsize to avoid snapping huge maps

debug"

• Revert "dmi commands handle symbols, exports, main, entries too

decompiler

• Detect retdec decompiler (pdz) in cmd.pdc

diff

• Add abstract Levenshtein dist
• Abstract r_diff_levenshtein_path
• Add Levenshtiend path API to

disasm

• Honor asm.cpu for asm.arch=ppc.gnu
• Fix #18511 - Add dwarf info in pdj
• Add the m68k.gnu disassembler plugin
• Show overlapped flags if requested and show them differently (#706)
• Honor cfg.debug in asm.section using dmi.
• Improve asm.meta=false for 16, 32 and 64 words
• Fix #17761 - Do not trim the "ptr " when asm.syntax=masm
• Add pi+ and pi- commands as aliases for 'pi +' and 'pi -'
• Fix asm.lines.bb with asm.sections set

dwarf

• Implement CLj command and improve CL output

emu

• Apply desired lifecycle of esil syscall and interrupt handlers in esil_dummy plugin
• Add dummy interrupt and syscall handlers

esil

• Add r_anal_esil_{syscall/interrupt}_{get/del}
• Boolify all the ESIL callbacks
• Fix some asserts and nullderef spotted on arm64
• Esil plugin management APIs
• • Add r_anal_esil_{get/del}_op
• • Fix deactivating plugins on r_anal_esil_free
• • Add local getter for active esil plugins

fs

• Fix absolute paths and add r_return guards
• Fix fs.posix.cat and use r_sys_dir instead of reimplement (-48LOC)

graph

• Add support for highlighted edges in graphviz
• Add ageh command to let users define which node links should be highlighted

hash

• Implement ssdeep fuzzy hashing algorithm
• Fix name collision for SHA functions

io

• Close #18257 / Remove RIODescData
• Enable io-plugins to set bin.baddr on launch
• Fix comment
• Implement custom bit size cyclic memory layout and wrap flags in
• Rename r_io_map_get_for_fd to r_io_map_get_by_fd
• Rename r_io_map_resolve to r_io_map_get
• Rename r_io_map_get to r_io_map_get_at
• Implement slurp:// uri handler plugin
• Implement omd command, as a simplified version of om
• Fix infinite loop in r_io_map_next_available
• Fix #17049 - oa whithout filename specify, add oa test
• Add help message for winkd://? and improve desc

json

• iVj must print valid json, not empty output (#18571)
• Add json version output to r2 -vj
• rasm2 -L now shows an array of objects
• Fix #18284 (json command returning empty string)

lang

• Add #!*? command to show rlang plugin examples
• Add support to the V programming language for scripting

print

• Implement pFX command exemplifying the use of r_sys_unxz()
• Android Binary XML support (#18545)
• Improved pdc, added pdco and pdcj, print orphan nodes
• Fix alignment issues in RTable with utf8 fields

reg

• Fix null printf issue in arpi command

search

• Import @siguza's arm64 xref finder
• Show results after pressing ^C in /ad
• Fix /ad of multiple consecutive instructions

shell

• Fix proper hash comments & quotes mix (#18551)
• Implement whoami and uid commands
• rasm2 -Lj works the same way as -jL
• Add variable autocompletion class in !!!
• Add scr.loopnl to add a newline on all the @@ loops

test

• Add R2R_SKIP_ASM env var handling in r2r

tools

• Fix #18391 - Show help in r2pm even before initializing the db

util

• Add r_file_find to recursive list files and subdirectories into a list
• Rename dep in rbtree.c to depth
• Rename d, d2, d3 in rbtree.c to direction ...
• Optimize r_rbtree_cont_{first/last} #18485
• Implement r_rbtree_cont_node_prev (siol eternal)
• Implement r_rbtree_cont_last
• Fix endless loop in r_rbtree_cont_node_next
• Add unit test for r_rbtree_cont_node_next
• Fix segfaults in rbtree.c (parent backlink)
• Add r_rb_cont_tree_node_next (SIOL Eternal)
• Add backlink to parent in RBNode (SIOL Eternal)
• Add r_rb_cont_tree_find_node (SIOL Eternal)

visual

• Add agfb for braile graphs
• Revert "Fix memleaks in agraph by keeping a separated list of dummy nodes
• Fix memleaks in agraph by keeping a separated list of dummy nodes
• Initial implementation of graph edge highlighting

visual"

• Revert "Fix memleaks in agraph by keeping a separated list of dummy nodes

Improved V850 Support

This release comes with several improvements for the V850 (in concret e2) cpu. The default disassembler is not really supporting many of the instructions of this architecture, but you can use r2ghidra as disassembler and analyzer which comes with a bunch of improvements for this architecture. Here's a list of the most relevant changes:

• Add support for cyclic memory layouts, this memory model is only supported in some rare architectures like s390, VAX, old ARMs and some V850. And this is not supported by any other static analysis tool (only by some closed source emulators from what @trufae could find).
• Implemented jump table analysis and pointer table size prediction, requires latest r2ghidra to work
• Add /cu command to find UDS dispatch tables and pointers for CAN BUS handling firmwares
• The new omd command makes creating memory layouts for embedded firmwares much easier, but at the end it's just a simplified version of om.
• Add slurp:// uri handler which does the same as oom to reload the given disk file into a malloc:// which is ideal for loading firmware dumps with ram contents for proper emulation.
• Fix PSW register bits definition for v850
• Added default calling convention for v850e2-gcc

ARM64/Apple support

• Android binary XML decoder available in the new pFa command (thanks @meme)
• Added support for the new CoreSymbolication file format (thanks @mrmacete )
• Support the latest dyldcaches from macOS/arm64 (thanks @meme)
• Add core plugin using @Siguza 's arm64xref search code which is 200x faster than /r with capstone
• Fixed large loading times and segfaults when loading some corrupted mach0 binaries
• Improved ARM32 LDR esil emulation which may fix some missing xrefs

Analysis

• New command: aaw, flag all words pointing to known flags
• Float/Double/LongDouble types supported in pf [fFG] and wv[fFG]
• Better handling errors when parsing invalid register profiles
• Add =RS directive to define the default register size.
• Assign pdc, pdd, pdg, pdz to their respective decompilers
• Honor all asm.cpu values for the powerpc GNU disassembler
• Added levenstein binary diffing path APIs
• Improve pdc pseudo-decompiler output (show orphaned bbs) + pdcj support
• Add support for new crypto keys on CPS2

Search

• Add brand new implementation of ssdeep (by @trufae) under the MIT license.
• Fix /ad command results are now correct and tested.
• New sixref command (see siguza's plugin in the arm64 section)

Shell

• Add lsr, whoami and uid commands
• Move the Vlang rlang plugin from -extras to core. it's now stable and ready to use.
• Add scr.loopnl to add a newline on all the @@ loops
• Improved dmi commands to load more symbols in debugger mode
• Fix #16254 - grep expression parse improvement ##cons
• Add freebsd-x86-32 support for sflib based shellcodes with ragg2

Binaries

• Added bin.cache as a high level value for io.cache
• Add support for loading symbols from .gnu_debugdata sections on ELF binaries
• Support latest dyldcache and coresymbolication files for macos-arm64 and ios
• Fixed segfaults and large loading times on 6502, PYC, DEX, MACHO, ELF, DWARF formats
• Dwarf information is now listed in the output of pdj and other CL listings

Visual

• Add support for highlighting edges in graphviz and ascii graphs
• Honor cfg.charset in w, ps, psz and psj (thanks @gogo2464 )
• Add minigraph support in visual (check graph.mini)
• Support multibyte input conversions in custom charset encodings
• Improved glob expression text filtering (thanks @as0ler )
• Implemented braile-art graph rendering (afbg)
• Show status register bits in visual debugger mode

Build

• Clarify license usage in target build for core modules and installed plugins (
• Fix static builds with meson
• Handle use_ssl, use_fork, use_dylib, nogrub, nogpl and custom plugin builds with meson
• Cleaned up slow tests and make CI run in GHA in 8min
• Import patches from Termux

This is the second release after the fork, we are still putting things in place and optimizing the development for what we had in mind. Probably many people expected a public statement about the events, but this post end up being used as a therapy and focused on spending the time for what it matters: have fun, move fast and code for what matters most for the users and contributors without losing time and nerves in personal conflicts or strict roadmaps, just fixing, improving and keep vibing the amazing community in r2land.

There are frequent back and forth pulls of changes from both projects (see sys/derizin.sh for more details), and future directions of both projects will probably differ enough to lower that pace. If you are curious about other side projects:

About r2ghidra, it was rebranded (previously named r2ghidra-dec), and has been updated with all the changes in rz-ghidra, but adds ACR build support (which works on FreeBSD), removes the need for bison and flex, See https://github.com/radareorg/r2ghidra for more details about the 5.1.0 release.

On r2cutter, the repository, project and icon has been renamed from Cutter to r2Cutter as well as updated the r2 dependency to the latest 5.1.0, but the CI hasnt been massaged yet to do the release builds, so no release of r2cutter is planned until this issue gets fixed.

r2dec is still available and working, just remember to update your package database with r2pm update.

Alexander von Gluck IV Alexis Ehret Allen McIntosh Anton Kochkov Aswin C Briand Djoko Carson McManus ChD1 Dennis Goodlett Eduard Eduard MURESAN Fangrui Song Florian Maerkl Francesco Tamagni Fredrik Fornwall Giovanni GustavoLCR Kamil Rytarowski Khairul Azhar Kasmiran Liumeo Murphy Paul I Qijia Liu RHL120 Riccardo Schirone Riccardo Schirone Sahil Siddiq Sylvain Pelissier aemmitt-ns aemmitt-ns condret eagleoflqj gogo gogo2464 ivan tkachenko laohuai liumeo mrglm pancake pancake pancake ratijas wargio yossizap yossizap

Highlights

This release comes with a large list of bug fixes, many of them you may probably not even noticed, but some of them are important for users and packagers, it has been tested on a large list of platforms, not just in the CI, but also in sparc, mips, powerpc and other funky hardware (Thanks @unixfreaxjp !). We are not forgetting the new Macs, and this release comes with few fixes for fat binaries, kernel caches and arm64 floating point emulation (kudos to @mrmacete and @aemmitt-ns for them!).

Projects: One of the most awaited feature is now finally available for testing, the git support has been enabled by default and some options and backward compatibility transitional code have been removed. Please test this out and let us know if you spot any issue! thanks @trufae for this!

The CI have been rewritten for simplicity and it's now building and publishing Android, iOS, macOS, Linux and Windows artifacts on every commit, ASAN, LGTM and COVERITY are still there, but all jobs run in github actions.

Lots of improvements in the support for JSON have been added by @liumeo also, several memory leaks have been cutted down, which are always welcome.

Support for streaming large files over mg, and added support in r2frida is now available thanks to @as0ler!

r2wars

The r2wars game runs on top of r2, but it needs some tweaks for the esil vm to work, this version optimizes this by checking configuration options outside hot loops.

• Cache cfg.r2wars value outside the eval loop

Those 'hacks' will be eventually removed when r2wars gets able to emulate syscalls, traps and low level stepping for context switching at esil-expression level.

• Support sbfm/ubfm in arm64
• Initial support for arm64 asm extendtype
• Add test and update arm.winedbg (#18117)

The arm64 assembler has been extended support more instructions and be more formal and correct.

• Implement i4004 assembler

It's always great to welcome a new supported architecture for assembling code (disassembler for i4004 was already available). Kudos to Liumeo for this nice addition!

bin

• COFF: handle empty sections (#447)

• Dont demangle with libs unless requested

• Add bin.cache evar to use io.cache when bins need to patch relocs

• Fix Mach-O rebase on fat slices

• Add additional ELF header fields to rz-bin output

• Fix PE Delay Imports for multiple delayed DLLs (rizin)

• Lowercase DEX method attributes and move r_num_bit_count()

• Initial implementation of the DEX annotation parser

The DEX annotation metadata is now parsed in the DEX plugin, this means, that parsing is actually a bit slower (it's parsing more information) but provides more context and information of the application classes and methods. Use bin.verbose=true to get that information.

This metadata must be imported into r2 somehow, but this interface hasnt been defined yet, so only plaintext representation is supported at load time. Probably finding a good tree representation for an Sdb instance could work.

radiff2

• Add more checks on the passed files and fail early.
• Honor graph.font in diffing graphs too
• Remove buggy Levenshtein diff algorithm and rename the original code

Some confusing usage and documentation have been updated and the default diffing algorithm is now faster. (Thanks MaskRay for spotting it and Liumeo for massaging it)

ci

The whole CI scripts have been rewritten to run everything in GithubActions, and adjust the test of PRs to 20min, ASAN is only running in master (takes 1h), and every commit is compiled for linux, macos, windows, ios and android. No breaking commits can be merged. And all artifacts are available to download for every single commit and architecture.

As long as the Sanitized build takes 1h to run the testsuite we decided to make it run only in the master branch, if any regression happens there it's easy to fix with the crash logs in GHA.

This is the setup of jobs in the current CI:

• Add android-arm64 target to build release artifacts
• Add TCC ci task which is able to build and run the testuite
• Added cydia builds for arm64
• Add job to test build and install with spaces in builddir and installdir
• Add job to test install, uninstall, symstall for proper purgation and avoid disasters
• Fix the badge in the README
• Add asan ci job to run all fuzzed bins with a sanitized build (takes 1h)
• linux-test builds with acr and takes about 20min to run all tests
• CoverityScan service find vulnerabilities with advanced source code analysis.
• LGTM service spots static source analysis good practices
• Initial attempt to switch to Capstone 5, needs more

RTable

• Dashes in RTable with X format
• Implement RTable:sql and add RTable.name

You may not know about RTable yet, but it's an api and command modifier that will be used more and more over time. In short, RTable provides an API to create tables with columns with types and rows with data and an api and query syntax to operate over those tables in the same way as you would do in an SQL database but using the cryptic syntax of commands we like in r2land.

This release introduces a new output for SQL. This means that any information stored in r2 can be exported in SQL statements and processed in your favourite SQL database. This is an example usage:

$ r2 -AA /bin/ls
> afl,:sql > functions.sql
> !sqlite3
sqlite> .read functions.sql
sqlite> .tables
fcns
sqlite> select count(name) from fcns;
128

RISCV

• Fix #18212 - Detect RISCV gdb servers
• Add riscv in RSysArch and make it an enum, not a bitmask
• Update RISC-V ESIL with sign extention operator (#18109)

Native support for Linux/RISC-V is now available as well as remote debugging via GDB, the ESIL emulation have been improved a little bit.

disasm

• Fix HUGE bottleneck in the WebAssembly pseudo disassembler and analyzer
• pd, is an alias for pdt (pdt will be removed soon)
• Honor meta size in asm.meta=false and add tests
• Fix #18202 - Large Cd truncates and crashes in pd
• Implement print disasm until optype

ESIL

• Fix x86_cs cmpbs esil
• fix x86-cs rep/repe/repne esil expressions

@condret find out (and fixed) a bug in the way rep instructions were constructed in ESIL in x86.

• Support arm32 esil stmib/ldmib
• Add sign extension assignment operator (#18092)
• Add floating point operations for emulation

Thanks to @aemmitt-ns (Austin Emmitt) for implementing support for floating point arithmetics in ESIL as well as adding support for most FPU instructions for ARM64. That's an important move forward in order to improve the language to handle more instructions and architectures.

A work in progress support for RIOBanks is not yet included in this release. But hopefully in the next release @condret and @trufae will be manage to finish the new API and commands and integrate them into the ESIL to support memory banks in GameBoy emulation for example (as well as add support later for other archs).

• Add support for RAnal.ESIL plugins

Those new types of plugins are right now just a place holder to call init/fini and do whatever you want from there. But in the next release ESIL plugins will provide the ability to expose some functionalities to the ESIL VM, syscall implementations in userland, libc emulation functions, custom esil operations, hardware devices, etc. Join the Discord, Telegram or IRC channels to raise the topic if you are interested on more details.

fs

• Add support to stream files using mg (#18253)

This feature has been added pair to pair with the r2frida implementation, this way enables r2 to download all the files and its contents without any file size limitation from the remote device to your host. All the RFS plugins API has been changed to if you are using custom RFS plugins you may take care of that.

Support for uploading is not yet implemented, but it is planned in the near future.

Thanks Murphy for that great contrib!

io

• Accept rwx argument in onn command
• Add onn command to fix custom map assignments

Those changes and new command are required for the projects to be able to save and restore the status of files, binfile and iomaps in proper order and reference.

• Fix and refactor the ar:// plugin

The refactoring of the io.ar plugin spotted a regression in open_many() which is not yet fixed, brave volunteers are welcome!

Projects

The most requested feature for r2 has been reworked to actually make it work and improved several use cases that weren't handled before:

• prj.git is now enabled by default if git is in path

this means that everytime you run Ps after saving the changes in will prompt you for a commit message. The ability to rollback to any previous state of the project by just calling git reset and Po becomes very handy when bad things happen or you just want to track your progress.

As long as projects are in plain text they are readable in git diff.

Improved support to ease the workflow to support multiple users sharing the same project via git will be implemented in future releases.

• Handle io.maps and bin.segments in o* to handle custom maps in projects
• Add map name information in o* output
• Honor mapaddr for malloc in o*
• Save the write cache in projects

As long as the user can create custom maps on specific files, the projects need to determine if there's any binobject associated with a specific file for processing a map. This puzzle is solved by the o* command which now prints the right commands to reconstruct the same IO environment starting from a clean session.

• Reworked P command with RProject and prj.name integration
• dir.projects becomes abspath when set
• Fix projects by removing code and honoring prj.name
• Save the write cache in projects

The P command is now much more stable and all the subcommands work as expected, some tests have been added and project renaming can be done via command or via evar prj.name. The magic behind this evar-project-action is done by using the RConfig.getter APIs that have been there for a while but barely used, the value is updated at get time from the project instance details. This way it's possible to rename a project like this:

> e prj.name
test
> e prj.name=case1

• Tell the user that debugging projects don't work

Projects are working, but they are far from perfect, one of these missing corners is the debugging support, the main reason for that is the lack of integration of aslr rebasing in projects, this will be eventually implemented, but for now it's better to avoid the user to mess the thing.

In any case, it's always recommended to have your own manually writen scripts to do setup some flags, memory patches or breakpoints, so you are more in control of what you run in a living process.

• Fix calling convention save/restore
• Print call convention once in afi
• Warn once about the missing anal.cc
• Use RConfigNode.getter callback in anal.cc to be in sync with k anal/cc/default.cc

Some improvements in the way calling conventions are handled inside r2 enabled the use of anal.cc like it's done in prj.name, with a 'live' evar. default calling convention is defined by the architecture but can be redefined by the rbin plugin or the analysis information. In addition the user can also specify a custom CC for each function, all those details are preserved with the anal.cc evar and the tc and afc commands.

• Remove transitional projects code
• Remove file.path and file.lastpath and add RProject
• Remove the prj.simple option
• dir.projects becomes abspath when set
• Use UID instead of PID to identify the user to avoid changing projects everytime

Refactor

• Refactor tcc and afcl commands, improve help and JSON
• 25 commits refactoring the code to use the formal PJ api to generate JSON

This includes honoring the settings defined by the user in the cfg.json evars, this nice feature was introduced by @hexploitable in the previous 5.0 release.

[0x00000000]> e cfg.json.num =?
none
string
hex

Rizin

• Added support for regex in test output and stderr
• Massage RRegex to fix codingstyle and a null deref.
• This resulted in a cleanup and refactoring of RRegex

One of the changes introduced in Rizin is the ability to use regexps to check the output of an r2r test, but after doing some cleanup in the regex code some issues were spotted in the logic, so it's not encouraged to write tests using regexps yet. Unit tests has been added, but it still requires to be fixed.

The bugs are logic bugs, not exploitable, but some match expressions won't work. But at least the feature is in sync.

Other commits taken from RZ grouped by author are:

Paul I

• COFF empty sections
• memleaks in ophandlers
• rtable X dashes

xvilka

• part of the improvements for indentation

wargio

• avr anal warning due unpopulated mnemonic and further refactoring
• fix ao rjmp issue

ret2libc

• Fix misusess of r2 commands inside r2
• Use r_core_flag_get_by_spaces() in getFunctionName()

kazarmi

• Fixed AVR anal plugin warning due unpopulated mnemonic
• Fixing clang flow warnings (#321)
• Fix #rizin302 - Fix function modification detection false
• Remove all dead assignment detect by clang sa (#310)

yossizap

• Fix trace crash
• Add regex support in r2r

Florian

• Fix null deref in rbtree
• Implement delay imports in PE parser

shell

• Implement rax2 -I to convert from/to LONG and IP Address

Sometimes a shellcode or a piece of program is doing some operations with IP addresses and it stores the IP address on a 32 bit register value. rax2 now provides a handy commandline option to ease this conversion. This feature was already available as a hint for the disassembly to convert instruction arguments to ip addresses.

$ rax2 -I 192.168.1.32
0x2001a8c0
$ rax2 -I 0x2001a8c0
192.168.1.32
$

• Implement $i and $I numvars

Those two variables have been added in order to ease writing some scripts that navigate thru the code moving forward and backward honoring the instruction boundaries of the current analysis information.

So $i is the address of the next instruction and $I of the previous. Things get more interesting when the braces join the game: Using $i{3} gives you the address of 3 instructions forward. and the same goes for $I{3} to go backward.

• Fix #18171 - Support RNum for syscall-name in asl command

The asl command has been modified to use RNum when parsing the argument, so its possible to

API

• Add RFile.new and RFile.move APIs
• RFSPlugin API has changed

Plugin delegates return int instead of RFSFile to avoid leaks and uafs, needed for streaming largs files over mg.

• New RAnal.ESIL plugins

Add esil.dummy in your plugins.cfg if the build fail with missing R_ESIL_PLUGINS error.

Visual

• Fix ecn (and VR) when no custom theme was set in .rc

In human words: rotating color themes is working again!

• Implement history filtering for dietline
• Initial implementation of r_cons_eprintf

This new API is wrapping eprintf() but its also able to buffer the results and flush them after r_cons_flush().

FUTURE: The need for this API is to improve the r2pipe API and handle a 3rd communication pipe to handle asyncronous error messages. This is a long term plan and should be backward compatible, so no r2pipe scripts may break.

• Fix help rendering: avoid printing trailing whitespaces (#18115)
• Improve str.wrap, add cons.line and fix cons.printat glitch
• Fix #17940 - Show ConfigNode options when selected in Ve
• Box borders in graph and panels are now in yellow
• Update www/t from radare2-webui
• Fix cascading solitaire issue in panels menus
• Fix the 'c' cursor behaviour in disasm

Those commits improve the experience in panels, fixing an anoying bug in the menus, improving the cursor mode. The default color theme for the frames makes it easier the eye.

The heavy webuis were removed in 5.0, but we are still shipping t/iled and p/anel ones, it's known that the webui repo needs some attention

bindings

The bindings have been also updated with some more valadoc documentation that can be read in here:

https://radare.org/vdoc

This documentation and API can be used for any bindings generated by valabind, this is: python, nodejs, ruby, go, v, ... the work to stabilize the apis in this module focused in RConfig, some fixes have been done in this module.

security

As usual, every release of r2 comes with a large list of security vulnerabilities, bugs and crash fixes. The list below sumarizes the most relevant ones:

• Fix #18274 - Fix crash in r2 *.wasm
• Fix crash in XNU kernel parsing (no cache)
• Fix code injection vuln in .ic* with ObjC classes
• Fix trace crash caused by a mismatch between the register profile and op anal
• AVR: Fixed profile, (null) instruction and anal
• Fix potential null-deref in r_rbtree_cont_foreach()
• Fix crash when wasm file contains symbols with large names
• Handle ^C and fix ASAN crash in aeA command

build

• Disable AVR plugin from all static builds because of the duplicated symbols issue introduced in recent refactoring.
• Add r2.1 when installing with symstall
• Fix debugger build problem in android-x86_64
• Remove --without-r2r configure option
• Create dist/ to hold all the distribution build files

Merged some patches coming from Termux to improve the debugger support on android-x86. The r2r testsuite executable is always built and should be available to all the user installations.

Also, some issues has been fixed in sys/install as well as new CI jobs to verify no regressions happen on install/uninstall/spacesinpaths, etc.

config

• Fix some returns to fix initialization issues in evars
• Remove unused cmd.xterm and use * instead of strcmp for ?
• Support evar filtering in eq and check for bool type in RConfig.toggle
• Expose RConfigNode.options APIs to avoid messing with internals
• Count lines is a prefix operator
• Add a progress bar for when scripts are running
• Honor R2_CFG_NEWSHELL=0 to disable it
• Seek command ignores the tmpseek
• Add missing vars from ?$? in ?$ and sort them alphabetically

Authors

• David CARLIER [email protected]
• Florian Märkl [email protected]
• Khairul Azhar Kasmiran [email protected]
• NIRMAL MANOJ C [email protected]
• pancake [email protected]
• phakeobj [email protected]
• Riccardo Schirone [email protected]
• yossizap [email protected]

This release could not be done without the help of several people, who contributed with many fixes and improvements. Above you can only find some short highlights of what was done in this release, but many more important changes have been committed and you can find them in our git log.

Authors

• Alexis Ehret [email protected]
• Anton Kochkov [email protected]
• Aswin C [email protected]
• atodekangae [email protected]
• Azox [email protected]
• condret [email protected]
• Cyrill Leutwiler [email protected]
• David CARLIER [email protected]
• Dennis Goodlett [email protected]
• DharmaCode [email protected]
• Disconnect3d [email protected]
• Eduardo Novella [email protected]
• Eli Schwartz [email protected]
• Fangrui Song [email protected]
• Florian Märkl [email protected]
• Francesco Tamagni [email protected]
• FXTi [email protected]
• Giovanni [email protected]
• gkpln3 [email protected]
• GustavoLCR [email protected]
• HoundThe [email protected]
• Ian Huang [email protected]
• Ishi Tatsuyuki [email protected]
• Jerome-PS [email protected]
• karliss [email protected]
• Khairul Kasmiran [email protected]
• Les De Ridder [email protected]
• Liumeo [email protected]
• Maxim Ivanov [email protected]
• mdolmen [email protected]
• meme [email protected]
• meowmeowxw [email protected]
• Michael Scherer [email protected]
• NIRMAL MANOJ C [email protected]
• Ole André Vadla Ravnås [email protected]
• Óscar Carrasco [email protected]
• pancake [email protected]
• Paul I [email protected]
• phakeobj [email protected]
• RHL120 [email protected]
• Riccardo Schirone [email protected]
• Sean Maher [email protected]
• Sergei Trofimovich [email protected]
• Soatok Dreamseeker [email protected]
• Sylvain Pelissier [email protected]
• terrynini [email protected]
• Vane11ope [email protected]
• Yusef Karim [email protected]
• zawwwu [email protected]
• Zi Fan [email protected]