Release Notes
Codename: "Exploit Twist" Version: 6.1.8 Previous: 6.1.6 AbiDiff: 107-110 (3) Commits: 236 Contributors: 18
:::sh
curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.8/radare2-6.1.8.tar.xz | tar xJv
radare2-6.1.8/sys/install.sh
Highlights
More details
## Authors [Abhi](mailto:85984486+AbhiTheModder@users.noreply.github.com) [Evgeny Kolmakov](mailto:randomjack94dev@gmail.com) [Jon Palmisciano](mailto:jp@jonpalmisc.com) [Kevin Stubbings](mailto:kwstubbs@github.com) [Lazar Aleksic](mailto:kripticni@proton.me) [Luisss003](mailto:145069480+Luisss003@users.noreply.github.com) [Nitan Alexandru Marcel](mailto:nitan.marcel@protonmail.com) [Ole André Vadla Ravnås](mailto:oleavr@gmail.com) [ada-l0velace](mailto:9060550+ada-l0velace@users.noreply.github.com) [bdunahu](mailto:bdunahu@operationnull.com) [dependabot[bot]](mailto:49699333+dependabot[bot]@users.noreply.github.com) [pancake](mailto:pancake@nopcode.org) [pancake](mailto:pancake@nowsecure.com) [pancake](mailto:trufae@gmail.com) [phix33](mailto:122955334+phix33@user.noreply.github.com) [phix33](mailto:122955334+phix33@users.noreply.github.com) [potato](mailto:30723680+0verflowme@users.noreply.github.com) [randomjack94dev](mailto:randomjack94dev@gmail.com) ## Changes **abi** * The sdb_remove has been deprecated as dupe for sdb_unset **analysis** * Keep duplicate single-instruction import trampolines distinct on name collision * Autoname import call stubs after the imported function * Don't create string metadata at addresses inside analysed functions * Add pebble script for stub scans * Optimize SDB key renames in analysis metadata * Ship the syscall tables for PebbleOS * Render array stack var element accesses as name[i] in disasm * Shadow phantom stack vars overlaid by an array-typed variable's extent * Optimize a:six and add more tests for it * Fix afv mislabeling DWARF register locals as args by honoring isarg * Fix PPC bctrl losing CALL type under capstone6 via BCCTR/BCCTRL alias ids **arch** * Harden PPC64 TOC tracking by invalidating toc_map on register clobber, call and return * Invalidate the PPC TOC register cache on function return * Validate asm.cpu against plugin CPU list * Default cpu for avr is now ATxmega128a4u * Fix PIC disassembler on big endian hosts * More ARM big endian fixes * Update capstone v5/next, bigendian, m68k and x64 fixes **asm** * Apply the pseudo filter only once in rasm2 and pad **bin** * Fix obf reload stacking duplicate bin objects and io maps * Autoresolve anal.gp for ppc32 via small-data * Handle as cyclic memory the raw string map address wraparounds * Honor paddr in raw strings * Fix raw string rebasing for non-VA sections * Fix [#10722] - Respect mapaddr on raw strings * Optimize dyldcache local symbol matching * Fix [#26079] - Local symbols missing in dyldcache * In ftab/gns1 use segment tags for proper archinfo * Harden GNS1 loader * Add FTAB extractor plugin * Improve GNS1 detection to solve dyldcache false positives * Require spaced arguments for iz+ * Fix dyldcache local symbol offset matching * Add `R_DYLDCACHE_NO_DEPS` option for shallow filtering * Auto-resolve PPC64 TOC base (anal.gp) for ET_REL and ELFv2 * Fix fuzzed PE timeout bug, clamping vsize * Reduce false positives in the PL PEs id * Add Rust and D demanglers * Add new C++ demangler * Add IBM XL demangler * Add ARM ABI demangler * Add ldmap.r2.js script to load sourceline from ldscript map files * Fix more bigendian parsing bugs for PE * Fix kernelcache parsing on bigendian * Fix SFC parsing on big endian * Fix big endian parsing bug for MDT * Implement idd command * Apply PPC64 TOC16 relocations to addis/ld immediates on ET_REL * Clean LE endian-safe parser * Detect ppc32 e500/e500mc cpu from .PPC.EMB.apuinfo note * Fix memory leaks in the mdmp parser * Fix misaligned PPC ET_REL REL24/REL14 relocation targets **build** * Fix riscv_cs capstone mode detection for all capstone versions * Move Nix stuff into dist/nix * switch to rev for sdb * Bump softprops/action-gh-release from 3.0.0 to 3.0.1 * update zydis subproject url for nix * Add Nix flake and dev shell support * Use #ifdef CS_VERSION_PRE_RELEASE instead of CS_NEXT_VERSION version guard for riscv_cs capstone mode * Fix subproject updates * Meson use_sys_zydis: find library as capital "Zydis" * Detect system zydis without pkgconfig + ppc fixes **cons** * Use RStrConstPool for RConsMark names * Fix console context races and UAF when running background tasks * Fix bluy theme color for swi/new instructions * Fix [#25984] - Support negative internal grep columns * Reset terminal with RCons in a portable way **core** * Fix numvar reference math state handling **crash** * Fix HFS+ filename UTF-8 buffer sizing * Fix null deref when RBinInfo callback is null * Fix p= sparse map allocation crash * Fix len multiply overflow in r_str_utf16_encode * Fix len multiply overflow in r_str_escape_utf * Fix len multiply overflow in escape_utf8 * Fix sz multiply overflow in r_str_escape_raw * Fix [#26047] - allocation size overflow in r_str_word_get0set * Fix count overflow in x examine command * Fix blocksize multiply overflow in pfb command * Fix integer overflow in pxAv print command * Fix signed overflow and null deref in pv print command * Fix [#26048] - integer overflow in pb * Fix [#26051] - oobread on truncated mdmp files * Fix [#26049] - cmd.load descriptor UAF in bin load * Fix [#26045] - r_str_append signed length overflow * Fix [#26044] - UAF in pde, regprofile changing inside the loop * Fix more OOB read bugs in the java parser * Fix [#26043] - 2 byte oobread bug in RBinJava line number table parser * Fix [#26042] - Fix aos opcode count overflow * Fix [#26046] - Harden and optimie RStr.replace for irreal 2 milion length strings cases * Fix [#26035] - Oobsfaults in omba, ombd and ombg commands * Fix more empty buffer issues in bin2strdup callers * Fix assert with 0 length quoted strings in w **debug** * Fix cons push leak in RDebugIo reg profile * Open self with api instead of commands in r2preload * Fix GDB register cache bounds and ownership checks **diff** * Use RCons.printf in core/gdiff **disasm** * Support hexdump/disasm addresses in octal base * Unify asm.addr.base10/36 into asm.addr.base * Fix overlapped strings length using RAnalOp.ptrSize * Apply the pseudo filter only once in the disasm pipeline * Preserve spaces in constructed string comments **esil** * Model PPC XER.CA ESIL for add/subtract-with-carry and algebraic shift-right * Isolate ESIL registers for type link propagation * Use local ESIL for type link propagation * Unify ESIL constructors behind an REsilOptions struct * Use core ESIL step-back for dsb * Consolidate ESIL step-back history and tests * Report ESIL step-over stop status * Improve stepover and more aeso tests * Print ESIL cmd handler values in hexadecimal * Honor esil.iotrap in core ESIL stepping * Rewrite ESIL stepping around core single step * Get rid of esil.verbose * Use ESIL voyeurs to track refs * Reload core ESIL callbacks on arch changes * Fix PPC indexed load/store, shift/rotate/divide and sign-extend ESIL * Add ESIL for PPC scalar floating-point load/store/arith/convert ops * Fix floating point emulation bug on 32bit * Fix error handling in esil poke * Fix esil poke on big endian hosts * Add ESIL for PPC integer/logical/rotate/mod ops and fix subfze/nor/nand * Add ESIL for the PPC isel conditional-select instruction * Pass ESIL instances to arch callbacks * Use local ESIL stats for ROP classification * Tighten core ESIL step and trap handling * Clean up core ESIL config and interface plumbing * Treat unreadable pin PCs as handled in core ESIL * Fix ESIL alias voyeurs seeing updated registers * Add core ESIL lifecycle and stepback support **fs** * Fix HFS+ catalog filename conversion * Avoid heap allocation in HFS+ catalog key compare * Expose addrline dwarf info in the r2 virtual filesystem * Fix ntfs utf16 filenames on bigendian **http** * Fix prefix and www root fallbacks **io** * The dsc io plugin is not a block device * Fix memory leak in io.self on close * Fix windows block device identify **muta** * Fix endian bugs in the serpent **print** * Implement pFJ for JWT token decoding * Add the CLd for source baked decompiler command * Add RTableOptions.wrap and more markdown improvements * Extend all p-/p= with json and better bounds * Fix [#26034] - pf beyond blocksize prints zeros **pseudo** * Simplify pdc helpers and remove redundant null checks * Refactor pdc line emission and loop goto filtering * Resolve pdc global folds from analysis metadata * Recover varnames with gp relative globals for pdc signatures * Hold asm.addr.base for pdc too * Reset asm.addr.relto in pdc to not break pseudo disasm * Fold resolved TOC global loads into flag names in pdc **r2r** * Fix token test terminal reset expectation **refactor** * Use r_read_ble32 in rtti_msvc **reg** * Document lowercase register roles for dyncc **search** * Use isolated ESIL VM for gadget search * Use local ESIL in search commands * Preserve gadget class details * Unify gadget class storage * Fix legacy ROP classification correctness **shell** * Add r2vsql in the fallback command handler * Shorten alias help messages * Fix 'join' command argument parsing **socket** * Fix PTY dynapi initialization in socket redirection **tests** * Improve and document REQUIRE in r2r * Some tests require zydis **tools** * Fix binary number parsing in rasm2 * Rafs2 wasnt included in binr/blob **types** * Fix type lookups for long function names * Add 'tsn' to lookup struct names by size * Add `ten` command for enum lookup by numeric value * Support union offsets in type member lookup **util** * Optimize RStrBuf.slice - 30% faster * Render inline markdown codeblocks/spans * Render markdown attributes in table cells * Add table trim option with ellipsis * Fix markdown table emoji widths * Fix custom float roundings and endian issues **windows** * Port the r2preload thing to Windows