Radare2 Files

## Authors [AGhebrea](mailto:140226968+AGhebrea@users.noreply.github.com) [Abhi](mailto:85984486+AbhiTheModder@users.noreply.github.com) [Anton Bolshakov](mailto:blshkv@users.noreply.github.com) [Claude](mailto:noreply@anthropic.com) [Evgeny Kolmakov](mailto:randomjack94dev@gmail.com) [Hissssst](mailto:37012324+hissssst@users.noreply.github.com) [MiKi](mailto:miki@mikelloc.com) [Mohammed Hassan](mailto:Mohammedhsn258@gmail.com) [Mohammed Hassan](mailto:hsnmohd65@gmail.com) [OrbisAI Security](mailto:mediratta01.pally@gmail.com) [ProMix](mailto:misha.zavertkin@mail.ru) [Ricardo J. Rodríguez](mailto:rjrodriguez@unizar.es) [ada-l0velace](mailto:9060550+ada-l0velace@users.noreply.github.com) [arhwx](mailto:arahwrm@gmail.com) [dependabot[bot]](mailto:49699333+dependabot[bot]@users.noreply.github.com) [gogolovefish](mailto:64474767+gogolovefish@users.noreply.github.com) [neil](mailto:github@neilpang.com) [nnguyen609](mailto:nnguyen609@gatech.edu) [pancake](mailto:pancake@nopcode.org) [pancake](mailto:pancake@nowsecure.com) [pancake](mailto:trufae@gmail.com) [phix33](mailto:122955334+phix33@user.noreply.github.com) [phix33](mailto:122955334+phix33@users.noreply.github.com) [potato](mailto:30723680+0verflowme@users.noreply.github.com) [ryawa](mailto:22625346+ryawa@users.noreply.github.com) ## Changes **abi** * Pahole more structs to drop gaps and reduce struct size * Make RCons authoritative for command help rendering * Unify the struct and union member model into RAnalTypeMember * Use BE bool flag (instead of int le) for utf16->utf8 **anal** * Don't treat register moves as argument uses in rarg extraction * Warn the user analyzing non-executable maps * Use the target word size for pointer types in the anal type api * Select the MIPS calling convention from the ELF o32/n32 abi * Keep the function frame size in second passes * Honor anal.vars.newstack in the esil analysis * Stop treating ARM stack restores as arguments * Resolve emu call arguments through the calling convention layer * Restore bb regstate for the type propagation * Test nested struct field typing from arm64 return value stores * Add the ppc64 ELFv2 calling convention and select it from the ELF ABI * Fix powerpc calling conventions * Make the afvs stack delta frame relative like afvb * Keep pointer dereference count in callee argument * Name the stack canary from a register write index instead of trace position * Fix cc stack arg slot offsets and bound the argslot scans * Fix the double return-address skip in the callargs stack walk * Add r_anal_cc_argslot and argval APIs resolving stack arg slots * Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double * Unify type ranking, memoize block reachability and make the parallel type meet order independent * Merge conflicting type facts from parallel paths with an explicit lattice * Keep fail-only fallthrough edges in the function graph * Fix arm64 =SN syscall register alias to follow asm.os * Use stateful decoding in the /r, aea and aespc linear sweeps * Follow deref chains when typing struct fields from return values * Fix UCALL bitmask misuse in aaft that skipped return-value stores * Unify struct and union field picking and simplify the const retype in aaft * Propagate callee types into struct and union fields during aaft behind types.fields * Add anal.gpseed to seed a PIC base register during ESIL analysis * Use r_anal_block_successor_addrs_foreach to build the function graph * Add asm.cmt.reguse comments * Expose dyncc register role APIs * Add reguse analysis hints * Synthesize struct types from pointer-argument access patterns (afts) * Better call clobbered register detection for arm64 * Honor calling convention clobbers in ESIL analysis * Add r_anal_cc_isclobber API * Emulate bbs in CFG order for the type matcher * Add callconv for all archs (updates clobber and preserve info) * Fix pdb/dwarf union parsing to fill the union member vec * Add clobber and preserve register for ppc and arm callconv * Dont pick ppc TOC pointers as function argument registers * Mark variadic libc functions properly and fix caller arg over-recovery * Restore arm32 AAPCS register args r0-r3 in calling convention **analysis** * Don't treat register moves as argument uses in rarg extraction * Warn the user analyzing non-executable maps * Use the target word size for pointer types in the anal type api * Select the MIPS calling convention from the ELF o32/n32 abi * Keep the function frame size in second passes * Honor anal.vars.newstack in the esil analysis * Stop treating ARM stack restores as arguments * Resolve emu call arguments through the calling convention layer * Restore bb regstate for the type propagation * Test nested struct field typing from arm64 return value stores * Add the ppc64 ELFv2 calling convention and select it from the ELF ABI * Fix powerpc calling conventions * Make the afvs stack delta frame relative like afvb * Keep pointer dereference count in callee argument * Add r_anal_cc_argslot and argval APIs resolving stack arg slots * Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double * Unify type ranking, memoize block reachability and make the parallel type meet order independent * Merge conflicting type facts from parallel paths with an explicit lattice * Follow deref chains when typing struct fields from return values * Fix UCALL bitmask misuse in aaft that skipped return-value stores * Add asm.cmt.reguse comments * Expose dyncc register role APIs * Add reguse analysis hints * Synthesize struct types from pointer-argument access patterns (afts) * Better call clobbered register detection for arm64 * Honor calling convention clobbers in ESIL analysis * Add r_anal_cc_isclobber API * Emulate bbs in CFG order for the type matcher * Add callconv for all archs (updates clobber and preserve info) * Add clobber and preserve register for ppc and arm callconv * Dont pick ppc TOC pointers as function argument registers * Mark variadic libc functions properly and fix caller arg over-recovery * Restore arm32 AAPCS register args r0-r3 in calling convention **api** * Use the formatted sdb setters * Use the new formatted SDB getters -200LOC **arch** * Fix opcode decoding and endian selection in the ppc.gnu plugin * Pseudo for ppc ctr branch * Add the missing operand count to the PowerPC lfiwax pseudo rule * Keep every operand in the mips and sparc pseudo fallbacks * Widen the PowerPC word rotate masks to the full ISA MASK * Simplify the cr0 and trap helpers in the PowerPC pseudo filter * Decode hex trap conditions and the folded unconditional trap forms * Fix the rldicr rotate mask being taken from the rldic rule * Dispatch the PowerPC pseudo fixups by mnemonic instead of table position * Keep every operand when no PowerPC pseudo rule matches * Add the missing isel rule to the PowerPC pseudo table * Fix PowerPC bclrl link register handling * Support the capstone v6 PowerPC operand and branch predicate model * Write LR on the linking conditional branch-to-ctr forms even when not taken * Workaround ppc.cs UB bug causing random esil test fail (capstone followup) * Fix x86 rip-relative ptr for zero-displacement destination operands * Fix PPC mfspr/mtspr decoding, stwu/stdu stack detection and vle archinfo * Type arm64 flag-setting adds/adcs/subs/ands/bics in ESIL analysis * Remove capstone v3 support, capstone 4 is the minimum * Fix the v35 plugin build and stop typing valid arm64 instructions as ILL * Fix MIPS conditional branch-and-link (bgezal/bltzal) jump target * Fix arm.gnu Thumb branch and svc/udf imms * Gate PPC toc_map TOC with RArchOpMask.STATEFUL and wire it into aar * Early error handling when arch is not initialized * Fix PPC conditional lr/ctr branch aliases incorrectly decoded as jmp2zero * Add RArchOpMask.STATEFUL and RArchSession.reset * Invalidate the toc_map base register on PPC update-form loads and stores * Invalidate the cached t9 call target on untracked writes and drop the mips.gnu decoder state * Accept MIPS ISA CPU names **bin** * Fix signed underflow case for ppc elf imports * Preserve PE section names when COFF strings are unavailable * Strictier coff magic check * Gate the ppc64 opd and glink logic by ELF ABI and fix the ELFv2 stub stride * Fix out-of-bounds read on the SOM dynamic loader string table * Fix uninitialized .NET stream sizes * Pack bin vector element structs * Better DEX header and string validation with less code * Reject malformed DEX headers before string parsing * Add v128, ref and reftype support for wasm * Initial implementation of the rust v0 demangler * Implement iuo command to open resoUrces inline * The old iU is now under iu, same goes for rabin2 -u * Move the rabin2 -u feature into an env var * Some binfiles require custom resource retrievals * Add raw resource extraction controls * Add iU, table output and handle invalid subcommands * Add support for encoded resources and extraction * List demangler plugins as part of rbin * Make RBin demanglers pluggable and selectable * Handle macho resources on 64bit fat slices too * Add support for GLib Resources inside ELF files * Expose macho code signature and certificate as resources * Add dir.binsdb (from binpath/dirprefix) for PE/MDMP ordinal lookups * Parse and expose PE/CLR Resources * Add OS/2 LE/LX resource support * Add ix command for extract sections, segments and resources * Rename iR to iU and add iUx extraction * Implement resource extraction api wired to rabin2 * Fix leak and harden the Java parser to not parse too much garbage * Better QNX header check * List and extract QNX LMF resources * Add resources support for the Pebble * Expose PE resources from mdmp * Extract resources with rabin2 -xU * List resource metadata and paddr * Deprecate the old sdb metadata for resources * Preserve generated NE entry symbols (bin.unnamed=false) * Honor 32bit NE absolute addressing for > 64k tables * Reject invalid NE resource shifts * Expose and harden NE binary resources * Use the generic resource API for iR commands * Expose PE resources through the generic API * Add generic binary resource API * Fix [#23827] - oba not loading bin info from fat macho headers * Add error if pdb7 root size negative or zero * Fix PE version string parsing on big-endian hosts * Utf16 strings in minidumps are always little endian * Fix infinite loop in the NE fixup parser * RBinPluginAny is now "null" for consistency and no longer uses LibMagic * Decode PEF relocs lazily, add more bounds and overflow checks * Fix AArch64 ELF relocation patching * Stop parsing invalid PE import libraries * Fix PE library import deduplication slowdown * Fix warnings parsing zero-sized PE import directories * Only do the right PE msvcseh checks for given arch/bits * Fix bits in arm64 PE * Name defined dynsym GOT slots in section-less ELFs * Name global GOT slots to resolve relative GOT loads in mips.gp **build** * Add MiKNix platform support * Fix [#26312] - Compile against zydis 4.1 ... 5dev * Improve jslinux build times, linking only the r2blob * Add docker for dist/jslinux to compile on macOS * Add dist/jslinux using temu/rv64 * Dont force x86.pseudo on single-arch-non-intel * Build fixes for empty muta, egg, fs plugin lists * Fixes for Windows XP * Add libandroid-spawn to Termux package installation * Select CS_ROOT after including config-user.mk so configure --with-capstone-next takes effect * * Add android-sdk script for multiabi toolchain * Fix [#24090] - Android ARM64 static compilation * Autodetect NDK from Android Studio in sys/android-*.sh * Use an alternative windows ci action with newer deps * Ignore the test_anal_types unit test binary * Silence nullability extension warnings with GCC * **ci** * Publish Android SDK in releases * Specify ref to checkout testbins * Dont build for filc in PRs **cons** * Use sorted RVec to store themes * Update statically compiled color themes * Detect terminal capabilities with COLORTERM * Isolate new task command handlers with child consoles * Isolate consoles and share console state in ctx cloning * Fix edge cases of the sort comparator * Make case-insensitive grep modifiers stage-local * Fix chained grep range and column stage ordering * Fixed multi-digit $:NN parsing * Fix sort and uniq grep counts * Fix ?. after filtered output * XML formatting leaves a stale buffer capacity * Expose cancel and failure states for RConsEditor * Fix editor line-list ownership * Remove global RConsEditor state * Fix TAB help prompt redraw **core** * Route task output through parsed command contexts * Keep task identity local to command execution * Fix windows build (strset is declared in mingw and msvc string.h) * Structure only natural loops in the pdc region AST * Select core.pseudo in all plugin profiles that keep pdc * Build a region AST for pdc with a pdct debug dump * Move the pdc pseudo decompiler into a core plugin * Fix [#26245] - Handle waitpid failures in r_sys_cmd_str_full() * Report invalid analysis subcommands **crash** * Memory exhaustion bug parsing malformed kernelcaches * Fix [#26390] - Bound HFS+ btree records and catalog names * Fix [#26390] - ASAN OOBR when namelen > 30 in hsfplus * Fix [#26374] - Stack oobread in print_insn_tic6x * Fix oobread in ELF’s PN_XNUM * Fix UAF in `oc -;oc -` * Use dynamic base64 encoding in command callers * Reject empty r2agent HTTP auth tokens * Fix OOB reads in ropchain/pxb/ptb/px3 print commands * Fix OOB reads in print commands and Apple cache parsers * Fix OOB reads in dyldcache dep carving * Fix [#26343] - heap OF using _dyn variants in ?b64[-] * Fix stack overflow, offbyone, UB and leaks in the visual mountpoint code * Fix [#26342] - stack overflow in tinycc include * Fix pxd8 and pxu8 short-buffer reads * Fix off-by-one in the http socket api * Fix [#26325] - NULL realname dereference in disasm flag comments * Prevent pipe and redirect injection after escaped quotes * Fix r2agent authentication fallthrough * Fix 1 byte oobwrite bug in the gdbclient * Fix heap over-read at buffer end when parsing gdb regs * Fix oobwrite in gdb register bounds * Fix OOM crash in the gdbserver xml register * Fix stack exhaustion gdbserver in xi:include href=self.xml * Fix oobread in vFile pread gdbserver responses * Same oobread for the P register packet parsing * Fix oobread in gdbserver p/P register handlers * Fix oobread in gdbserver p/P register handlers * Fix [#26255] - heap overflow write in our gdb server * Fix [#26258] - punycode encoder oobread * Refactor and harden LE/LX page decoding * Harden LE/LX section and relocation parsing * Validate uleb128 parsing in the DEX debug-local operands * Fix [#26240] - egg include parser buffer underflow * Fix [#26241] - null deref on dex memory exhaustion * Fix [#26243] - Handle REgg initialization failure * Fix [#26246] - fdleak when pipe(2) fails in lang_pipe_run * Detect NE relocation chains infinite loops * Bound NE counted string parsing * Harden lua parser fixing many oobreads * Fix Lua function parser OOB reads * Fix oobread in Mach-O protocol list pointer parsing * Fix Swift Mach-O invalid type metadata parsing * Fix Swift Mach-O member metadata bounds check * Fix Swift Mach-O field metadata bounds check * Fix null+1 bug in afvt parsing * Fix bplist Unicode string conversion * Fix oobwrite by one (final null byte) in RStrStore * Always null terminate utf16->utf8 strings * Validate Mach-O LC_DATA_IN_CODE ranges * Fix oobread when skipping subtests in softmagic match * Fix segfault in malformed dwarf * Fix malformed pyc refs crash and discarded ELF reloc leak * Fix oobread in ELF PN_XNUM phdr count handling * Validate dmp64 page counts against dump size * Fix pyc marshal interned ASCII handling and validate code object section sizes * Fix heap write overflow in Python loader * Reject truncated PEF relocation tables **debug** * Fix windows build and debugstop on unix * Implement dcut command to continue until time * Fix getreg/setreg on wxp * Fix ptrace requests on NetBSD * Fix the FreeBSD build of the syscall trace mask * Fix typo in desil exprmatchreg == handling * Fix wrong size used in realloc * Handle arv as a mirror of drv, to handle vector registers * dc calls aec when cfg.debug is false * Initialize subprocess env when not available for nix-ld **disasm** * Derive emu comment stack args from the calling convention layout * Resolve stack-located format strings and scalar call args in emu comments * Unify pd/pi/pdj backward walk and align the map-start window * Harden backward disasm corner cases near file start and blocksize * Fix [#26262] - backward pdi/pdj drift when the window contains invalid instructions * Add asm.cmt.invalid to comment invalid instructions * Fix [#26262] - pdj and pdi with negative count on aligned archs * Expand printf-family varargs from the format string in emu call comments **esil** * Fix mips.gnu REGIMM branch targets and unconditional link * Fix MIPS bgezal/bltzal to always write the link register * Fix mips.gnu jal ESIL empty jump target * Set cr0 on PPC record-form instructions and fix sraw/srawi word sign extension in ESIL * Fix mips.gnu add/mult decode fallthrough and add missing hi/lo registers * Fix mips signed mult high word and add srav ESIL * Add arm64 BICS ESIL and type BIC as AND * Fix mips.gnu slt-family ESIL dstreg and signed comparison * Fix x86 SHL/SAL and NEG condition flags in ESIL (incl. memory destinations) * Fix arm32 CMN flags and MOVT top-halfword replacement in ESIL * Fix arm64 sbc ESIL carry sense and add sbcs/ngc/ngcs with NZCV flags * Fix NZCV flags for arm64 flag-setting ops and carry-in for adc/adcs in ESIL * Fix PPC extsb/extsh/extsw ESIL to always sign-extend into the destination * Encode full-width compare results in the PPC cr ESIL model * Apply the delayed branch when the delay slot op emits no ESIL * Fix arm halfword and byte load widths in ESIL * Fix ppc64 ld ESIL to not update the base register * Propagate stop reason for esil debugging * Stop ESIL continue at unmapped PC **graph** * Point switch case graph edges at the case jump target **http** * Improve the launcher webui style * Prevent stale WebUI assets * Fix HTTP browser launcher selection * Update the Material WebUI from latest radare2-webui * Empty lines in http auth file let pass any password * Protect with auth the r2agent web sessions spawns **io** * Initial io.ebpf for Linux-x64,arm64,rv64 * Fix [#26411] - oobwrite in io.gprobe * Preserve permissions in io.xattr **lang** * Avoid null language plugin lookups **magic** * Run text magic rules after binary misses * Fix [#26164] - libfile 5.47 deprecated regex/c **port** * Add dist/netbsd to boot r2 in the browser **project** * Fix new project script for meta, hint and var * Add 'prj list' subcommand * Complete Ct commands and project persistence * Lossless Ct base64/json serialization **projects** * Fix new project script for meta, hint and var * Add 'prj list' subcommand * Lossless Ct base64/json serialization **pseudo** * Convert only whitespace-preceded semicolons to comments in pdc * Bring back the orphan block in pdc * Fix zero-width pdcj annotation ranges in the pseudo decompiler * Use strbuf padding for pdc indentation instead of a fixed buffer * Return NULL instead of false in the dalvik pseudo parser * Fix [#26392] - oobread in asm_filter * Initial h8300 pseudo decompilation * Emit structured if/else in pdc * Implement pdc* comment output **r2pm** * Add R2_LIBS with the library flags from R2_LDFLAGS **search** * Fix [#26294] - Search stops on 0xffffffff data when io.cache is enabled * Fix disassembly regex parsing and validation * Preserve instruction boundaries across disassembly search blocks * Apply search alignment to disassembly hit starts * Global search.maxhits in disassembly search (not reset after each map) * Fix multi-regex disassembly sequence search * Make text magic scan optional with /mt **shell** * Check r2p in basename for r2pipe calls * Cleanup dollar files apis * Iterate command aliases directly in the hashtable * Port echo to task-owned command contexts * Fix [#26377] - rm command silently ignoring -r and -rf flags * Change b64: command behaviour and add b64:' * Fix -j? and wire subcommands to js * Accept parenthesis in temporal heading seek expressions * Implement the heading `@` syntax support * Bring back the command substitution execution * Improve cmd syntax test coverage and fix separator bugs * Keep command substitution output opaque * Support raw calls inside command substitutions * Support literal commands after && and || * Normalize raw calls at command boundaries * New CtxOnly RCmd API callbacks and add generic subcommands helpers * Use the new cmdapi in the agD plugin * Validate raw call addresses and faster quote strip * Remove the deprecated double-quote raw call * Preserve shell preprocessing and internal pipe chains * Unify r2 and system shell command boundaries * Support && and || command short-circuiting * Add lazy argument slices to command contexts * Add contexts for the new command handlers * Keep command dispatch results structured internally * Implement the new cmd api for trie based commands * Make inline double quotes transparent before dispatch * Preserve literal escapes in echo pipelines * Fix the use of ', " and \ with lots of tests * Prevent command injection in quoted spans * Fix grouped grep after json format * Fix subcommand parsing + help for z- * Fix parsing /ad search subcommands modifiers * Handle ed/-E errors and both behave equally * Sync buffer length to avoid unnecessary strlens * Respect cursor position in Tab, and autocomplete afvn varnames * Fix exact autocomplete lookup for command arguments **sync** * Support thread conds on Windows 95/XP * Add timeout support for r_th_cond_wait **test** * Avoid shared .tmp directory races between parallel tests * Escape colon in count greps now that ~? honors line ranges * Split the struct synthesis tests out of the overgrown types test file * Add r2r test proving pdb unions survive the anal base-type path **tests** * Avoid shared .tmp directory races between parallel tests **tools** * Show -Os in 'r2 -v' for size optimized builds * Add more vars for r2 -H * Slurp raw stdin before converting it with rax2 -S * Fix [#24090] - Android toolchain reuse across architectures * Centralize rcfile path construction and update -E/ed doc * Document r2 -E flag * Make rasm2 -L exit 0 like r2 -L and rafind2 -L **types** * Regenerate c2 golden files and test in CI * Accept multiline function signature definitions * Parse function pointers within function parameters * Store variadic args as both forms * Fix ctypes argument store for fnptr members and (void) prototypes * Remove redundant null checks before free in the C types parser * Expose type signedness and variadic checks in the r_type api * Type the variable receiving the malloc'd pointer in afts * Resolve the type matcher arg location and slot offset from one lookup * Resolve stack arg slots via the cc argslot API in the type matcher * Synthesize allocator return objects in afts * Report size-function provenance in aftsj sizehints * Cleanup the size-fn harvesting code in anal_tp * Harvest object sizes from memset-style call sites * Support long return types with > 64chars * More comma based types support for structs, surviving sizeof, pf and tsc * Support member fields with types containing commas * Parse hex array dimensions in struct and union members * Unify struct/union sdb serialization between the C parser and base types * Expose and use real type size and field alignment details * Strip wrapping quotes from the afvt type argument * Struct redefinitions replace the saved members * Preserve struct member array counts through the base-type sdb roundtrip **util** * Add non-recursive thread lock support for Windows * Preserve partial stdin reads and remove dead newline code * r_stdin_readline: correct EOF handling * Add RSys.open(), a reusable system opener API * Fix duplicate separators in r_file_root paths * Fix r_num_units integer check for 80bit long doubles * Disable log colors on legacy Windows consoles * Implement strict vs tolerant base64 parsing modes * Fix [#26359] - out-of-range shifts and rotates in RNumMath * Fix hex string escape decoding * Document tolerant base64 decoding * Initial import of the Trie data structure * New r_sys_exepath and more portable pidpath api * Add r_str_filter_file API for project names * Fix [#26244] - Prevent r_sys_cmd_str_full pipe hangs * Fix dominator tree construction and add unit tests * Add r_str_printfmt and the pfp command to map printf formats to vararg types * Preserve callback RNum errors in math parser * Fix math tokenizer race condition in RNum * Add the new RStrPnlen for printable length strings * Match unstripped function names in type guesser so afs protos resolve * Optimize strbuf with less strlen and better weakref uses * Format large strbuf appends in place **visual** * Implement scr.drag to click+drag to scroll in disasm/hex/graph * Fix null dereference on prompt exit in visual find * Fix visual disassembly scrolling across middle boundaries * Fix disasm scroll bug over metadata * Lock horizontal scroll in hexdump/disasm with scr.wheel.hscroll * Fix visual disasm reverse scroll over metadata rows * Fix visual disasm scroll stuck inside metadata **windows** * Add dist/reactos to create live web images for r2 * Fix debugger bugs for w32 (io read, attach and maps listing) * Parse more ansi escape codes for non-vt terminals * Disable more ansi codes on non-vt terminals * Fix RCons.clearLine performance on legacy w32 **zignatures** * anal: fix zignature drop for functions with empty-typed vars or varargs