Radare2 Files

## Authors [0xf00sec](mailto:159052166+0xf00sec@users.noreply.github.com) [AGhebrea](mailto:140226968+AGhebrea@users.noreply.github.com) [Aayush Khanna](mailto:96649223+aayush0325@users.noreply.github.com) [Angelo Ayton](mailto:angeloayton@gmail.com) [Bernhard M. Wiedemann](mailto:637990+bmwiedemann@users.noreply.github.com) [Claude](mailto:noreply@anthropic.com) [Jinbao Chen](mailto:46992360+wildoranges@users.noreply.github.com) [Kirby Kuehl](mailto:kkuehl@gmail.com) [Kleopatra Poritsi](mailto:kleopatrapor@gmail.com) [Mohammed Hassan](mailto:Mohammedhsn258@gmail.com) [Priyanshu Kumar](mailto:priyanshukumarpu@gmail.com) [Ruffalo Lavoisier](mailto:RuffaloLavoisier@gmail.com) [Vaibhav Srivastava](mailto:vaibhavsri1712@gmail.com) [Vectrain51](mailto:wzc5147@gmail.com) [mmustafasenoglu](mailto:mmustafasenoglu0@gmail.com) [pancake](mailto:pancake@nopcode.org) [pancake](mailto:pancake@nowsecure.com) [pancake](mailto:trufae@gmail.com) [phix33](mailto:122955334+phix33@user.noreply.github.com) [phix33](mailto:122955334+phix33@users.noreply.github.com) [potato](mailto:30723680+0verflowme@users.noreply.github.com) [root](mailto:root@localhost.localdomain) ## Changes **abi** * Make RIOBind reads return byte counts * Deprecate r_bin_is_static as requested by R2_590 **anal** * Dont recover fp vars in frame-less functions * Fix switch ownership when analyzing overlapping blocks * Add arm64 swift convention for fpu args * Rename default register arguments once when recovery ends * Handle subregister arguments on x64 * Fix wrong variadic detection when eax is written before testing al * Fix calling convention for arm64/swift fpargs * Refresh VARTYPE metadata after variable renames * Dont reuse fp args after calls * Simplify floating-point argument recovery * Add dyncc floating-point argument registers * Memoize cc arg counts and skip fp walk on integer ops * Recover float args from a separate fparg register sequence * Fix readAhead UB in the function analysis loop * Remove duplicate counted read bookkeeping * Fix partial reads in analysis consumers * Fix jump tables truncated by short reads * Stop walking pc-relative indirect jumps as jump tables * Analyze disconnected exception handler blocks * Fix RAnalOp leaks in the disasm, diff and debugger decode loops * Fix aeg folding ops without a dfg handler into constants * Fix the memory leak and quadratic cost of aoj with many opcodes * Fix dfg esil for goto and cmps * Fix JSON disassembly architecture hints * Use function call conventions for afsj arguments * Fix fp local variable and arm32 reg tracking * Resolve typed JNI table calls in analysis * Typed JNI interface tables and indirection * Materialize typed JNI native methods during analysis * Add the new jni analysis plugin * Stop afb and afbi from deleting switch cases that share a target * Drop a stale arg from the float-formal expectation * Separate a formal's ABI position from its sdb index * Place formal parameters that DWARF leaves without a location * Quiet aavrq to reduce noise in `aaa` * Expose more switch details in the json output * Forward register args through direct tail jumps like calls * Match forwarded callee args by register instead of argnum * Include the switch default target in block successor iteration * Dont treat the returned int as a variadic marker * Preserve registered types when linking DWARF prototypes * Link DWARF types only when prototypes match * Name local plt stubs in x86 retpoline layouts * Free all flag metadata strings * Name local plt stubs from their got relocs in aa * Split the type propagation plugin into libr/anal/p/tp * Warn for unresolved DWARF function return types * Test bbstate restore doesnt rewind esil memory * Bind exact DWARF function prototypes to their address * Keep loop body register changes after the loop in aaft * Honor address-linked function signatures * Drop stale func arg keys when reanalysis recovers fewer arguments * Fix local/global address detection for opmask in signatures **analysi** * Dont recover fp vars in frame-less functions * Add arm64 swift convention for fpu args * Rename default register arguments once when recovery ends * Handle subregister arguments on x64 * Fix wrong variadic detection when eax is written before testing al * Fix calling convention for arm64/swift fpargs * Refresh VARTYPE metadata after variable renames * Dont reuse fp args after calls * Simplify floating-point argument recovery * Add dyncc floating-point argument registers * Memoize cc arg counts and skip fp walk on integer ops * Recover float args from a separate fparg register sequence * Fix readAhead UB in the function analysis loop * Remove duplicate counted read bookkeeping * Fix partial reads in analysis consumers * Fix jump tables truncated by short reads * Stop walking pc-relative indirect jumps as jump tables * Analyze disconnected exception handler blocks * Fix RAnalOp leaks in the disasm, diff and debugger decode loops * Fix aeg folding ops without a dfg handler into constants * Fix the memory leak and quadratic cost of aoj with many opcodes * Fix dfg esil for goto and cmps * Fix JSON disassembly architecture hints * Use function call conventions for afsj arguments * Fix fp local variable and arm32 reg tracking * Resolve typed JNI table calls in analysis * Typed JNI interface tables and indirection * Materialize typed JNI native methods during analysis * Add the new jni analysis plugin * Stop afb and afbi from deleting switch cases that share a target * Drop a stale arg from the float-formal expectation * Separate a formal's ABI position from its sdb index * Place formal parameters that DWARF leaves without a location * Quiet aavrq to reduce noise in `aaa` * Expose more switch details in the json output * Forward register args through direct tail jumps like calls * Match forwarded callee args by register instead of argnum * Include the switch default target in block successor iteration * Dont treat the returned int as a variadic marker * Preserve registered types when linking DWARF prototypes * Link DWARF types only when prototypes match * Name local plt stubs in x86 retpoline layouts * Free all flag metadata strings * Name local plt stubs from their got relocs in aa * Split the type propagation plugin into libr/anal/p/tp * Warn for unresolved DWARF function return types * Test bbstate restore doesnt rewind esil memory * Bind exact DWARF function prototypes to their address * Keep loop body register changes after the loop in aaft * Honor address-linked function signatures * Drop stale func arg keys when reanalysis recovers fewer arguments * Fix local/global address detection for opmask in signatures **analysis** * Dont recover fp vars in frame-less functions * Add arm64 swift convention for fpu args * Rename default register arguments once when recovery ends * Handle subregister arguments on x64 * Fix wrong variadic detection when eax is written before testing al * Fix calling convention for arm64/swift fpargs * Refresh VARTYPE metadata after variable renames * Dont reuse fp args after calls * Simplify floating-point argument recovery * Add dyncc floating-point argument registers * Memoize cc arg counts and skip fp walk on integer ops * Recover float args from a separate fparg register sequence * Fix readAhead UB in the function analysis loop * Remove duplicate counted read bookkeeping * Fix partial reads in analysis consumers * Fix jump tables truncated by short reads * Stop walking pc-relative indirect jumps as jump tables * Analyze disconnected exception handler blocks * Fix RAnalOp leaks in the disasm, diff and debugger decode loops * Fix aeg folding ops without a dfg handler into constants * Fix the memory leak and quadratic cost of aoj with many opcodes * Fix dfg esil for goto and cmps * Fix JSON disassembly architecture hints * Use function call conventions for afsj arguments * Resolve typed JNI table calls in analysis * Typed JNI interface tables and indirection * Materialize typed JNI native methods during analysis * Add the new jni analysis plugin * Stop afb and afbi from deleting switch cases that share a target * Drop a stale arg from the float-formal expectation * Separate a formal's ABI position from its sdb index * Place formal parameters that DWARF leaves without a location * Quiet aavrq to reduce noise in `aaa` * Expose more switch details in the json output * Forward register args through direct tail jumps like calls * Match forwarded callee args by register instead of argnum * Include the switch default target in block successor iteration * Dont treat the returned int as a variadic marker * Preserve registered types when linking DWARF prototypes * Link DWARF types only when prototypes match * Name local plt stubs in x86 retpoline layouts * Free all flag metadata strings * Name local plt stubs from their got relocs in aa * Split the type propagation plugin into libr/anal/p/tp * Warn for unresolved DWARF function return types * Test bbstate restore doesnt rewind esil memory * Bind exact DWARF function prototypes to their address * Keep loop body register changes after the loop in aaft * Honor address-linked function signatures * Drop stale func arg keys when reanalysis recovers fewer arguments * Fix local/global address detection for opmask in signatures **api** * Add R_LOG_HINT which is unset for automatic steps * Replace system bits packing with generic value packs **arch** * Take the arm32 immediate shift carry from the source register * Mask the arm32 shifted-operand count to its low byte * Fix m680x jsr/jmp/bsr and branch targets so calls get xrefs * Add CIL token resolution and stack ESIL * Fixes for the Dalvik array, object and memory esil * Fix Dalvik calls and result register handling * Fix signed Dalvik operands and branch targets * Fix sign data bug in dex decoder * Reroute the capstone v6 ppc overflow-form ids onto their base cases * Decode the mips.gnu unaligned word loads and stores * Fix the mips.gnu instruction ids and let it decode at 64 bits * Initial support for nvidia ptx sass encode/decode/pseudo * Type ppc bcl 20,31 branch-always forms as jumps that set lr * Remove the dead colon replacement from the ppc, mips and sparc pseudo parsers **bin** * Support msvc demangling single letter names * Fix missing null byte when the msvc demangler emits std::nullptr_t * Add string type suffixes to filter iz and izz output * Patch aarch64 ET_REL GOT relocs against the import slot * Place ET_REL NOBITS sections and its import slots * Compute baddr for elf relocs outside the hot loop * Patch relocs at their mapped address under a custom baddr * Fix slow load of mach0 with repeated classes and huge objc lists * Read the in-place addend for implicit-addend crel relocations * Patch i386 GLOB_DAT, JMP_SLOT and RELATIVE dynamic relocs * Stop reading REL targets while listing relocations * Fix off-by-one array extents when DWARF uses DW_AT_count * Add RBinSymbol.hsize for header metadata paddings * Migrate RBin trycatch storage to RVec * Parse the CLR exception clauses of the dotnet method bodies * Fix the PE64 SEH scope tables and parse the MSVC C++ exception regions * Harden the eh_frame trycatch parser and fix the flag fallout * Parse the Itanium exception regions from the ELF eh_frame * Generalize the LSDA parser and fix the typed trycatch details * Keep import GOT relocs at their site when bin.relocs.apply is on * Expose C++ vtable ownership in class metadata * Improve C++ class metadata recovery * Fix Itanium (c++) multiple-inheritance base offsets * Fix bin base address handling with -m and in threaded loading * Parse encoded DEX exception handlers * Fix [#26552] - type relr relocs for the target machine * Add async and generator flags to symbol JSON * Add JSON output for try/catch metadata * Add bytecode argument and return metadata to isj * Fix [#26546] - stop zeroing relr relocs under bin.relocs.apply * Fix [#26547] - encode thumb branch relocs instead of a raw word * Keep non-import ELF relocs at their site when bin.relocs.apply is on * Parse CLR types, signatures and user strings * Move the java member descriptor api out of r_bin into shlr/java * Sideload macho dsym matching arch slice and uuid * Fix [#25480] - pcap stream selection support * Fully expand ELF RELR bitmap relocations * Add support for the android-specific ELF relocations * Fix JNI symbol detection for ELF only * Add structured Java and JNI descriptor parsing * Fix dwo_id truncation in the DWARF5 unit header * Scan the last 20 bytes of a range for ppc64 ELFv1 eager call stubs * Recover Swift struct field offsets from type metadata * Add AArch64 ET_REL relocation patching tests * Encode AArch64 branch and data relocations instead of an 8 byte write * Replace RList/RRBTree store of RBinRelocs into RVec * Unify bounded ELF string table lookups with strtab_str() * Cap the section-less ELF symtab scan with the stated symbol count * Only import undefined symbols in the section-less ELF scan * Bound the section-less ELF dynsym scan at the next dynamic table * Fix heap out of bounds read in the ppc64 plt stub segment scan * Scan every code range for ppc64 plt call stubs and accept static-chain loads * Name ppc64 ELFv1 text call stubs after their plt slot * Move ELF PLT import resolution into plt.c * Fix ELF-ppc32 import addresses for fPIC secure-plt call thunks * Fix ELF-arm64 plt entry stride for pac-plt and bti-plt layouts * Use bin.lang as default for ic+ metadata * Detect symbol languages independently of binary format * Fix field sizes and IBM XL language detection * Extend ic+ attribute parsing * Expose class attributes in JSON * Unify binary metadata in RBinAttr * Register binary languages during symbol parsing * Clarify scalar and packed binary language types * Use value packs for binary languages * Add mixin/late attributes needed for Dart classinfo * Load Swift metadata classes from ELF binaries * Refactor Mach-O Swift class extraction to use shared loader * Add generic Swift metadata class loader * Extend Swift demangler for symbolic references and members * Fix null names and wrong addresses from DWARF5 indexed forms * Add iccl command to list the langs * Add CIL classdump output for icc * Add Dart classdump output for icc **build** * Rebuild shlr objects when the headers they include change * Reproducible egg xor key via SOURCE_DATE_EPOCH * Fix wasi tool linkage against libr_java * Fix JSLinux runtime patching and distribution packaging **ci** * Rewrite lint.sh in python to scan each file only once * Removes 5-6 jobs + macOS x86_64 leg from PR triggers, restricting them to push-to-master only **cons** * Use RStrBuf instead of global CbPrintf in Stiv * Faster graphs: 6x (color+utf8) 20x (nocolor+ascii) * Fix console visual rendering bounds * Prevent internal pager from scrolling its first page * Clearline in ^R while typing to avoid glitching the terminal * Forward mouse-wheel events in JSLinux terminal * Fix wrong line count in command output **core** * New core plugin command context interface api * Refactor r_num_math error handling in cmd_seek (Step 2) * Add support for embedding .r2.js scripts via r2plugin/xps **crasg** * Fix stack overflow in the visual assembler **crash** * Fix msvc demangler string copy null deref * Fix UAF on bochs.detach with the register cache * Fix oobread parsing debug.bochs breakpoint list * Fix stack buffer overflow parsing the bochs stop address * Fix out of bounds write parsing bochs register replies * Fix copy_string reporting success after freeing its buffer * Fix heap buffer overflow in the base91 muta plugin * Fix integer overflow in the swift demangler bounds check * Fix gron filter null deref * Fix [#26600] - Define capability-based bin IO redirects * Fix null derefs in pdb/tpi parser * Fix infinite loop parsing fuzzer pe64 exception directory * Otezip source doublefree in fszipdir * Fix null assert for unbinded symbols in isj * Fix xref cleanup ordering * Fix UAF in fcn callconv * Fix [#26458] - oobwrite in RBin.NSO and LZ4.decompressBlock * Fix bound bugs in WinKD io code * Fix null deref in RBin.attrFromString * Validate UBIFS node lengths before struct reads * Share Mach-O bind repeat validation * Validate threaded Mach-O bind repeats * Limit malformed Mach-O bind relocation loops **debug** * Fix bochs register profile alignment when segments missing * Add support for data watchpoints for Haiku * Handle asynchronous Haiku thread exits * Fix Haiku debugger exceptions handling * Add native debugger support for Haiku (x86-32/6) * More work on the single step for xnu * Fix single stepping again on macos-arm-64 * Fix Linux RV64 native debugger register profile **disasm** * Don't print a string comment for a relocated pointer slot * Fix riscv unsigned branch pseudo, add missing branch rows * Fix heap buffer overflow when truncating the bytes column * Fix fp based / x29 stack var disasm for arm64 * Show the instruction under a typelink that has no format * Render arm conditional branches as v conditions in the pseudo output **esil** * Fix shift overflow and ASR sign extension * Reorganize ESIL op registration and reuse gb nops * Simplify ESIL string history ring * Turn the esil stack arena into a ring buffer * Fix esil F== and F!= to compare exactly and follow IEEE on NaN * Correct the arm64 float compare flags and immediate width * Fix nested esil conditionals running the wrong else arm * Emit balanced esil for the arm64 conditional compares * Count only jumps and definition nesting toward esil.gotolimit * Warn on oversized CLZ width and keep plain esil fallbacks * Document the CLZ and POPCNT esil operations * Use the CLZ esil operation for the arm count leading zeros * Model the ppc count leading zeros and popcount forms * Add the CLZ and POPCNT esil operations * Rewrite the compound esil ops with REsilDefine instead of C handlers * Add r_esil_define to implement esil ops as word definitions * Add the ROT esil op to rotate the third stack element to the top * Declare the ++ esil op to push one value like -- * Fix esil_peek_some regsize handling and esil_poke_some return value * Fix CIL equality stack comparisons * Fix the arm64 bfxil, extr and smulh esil and model the msubl forms * Extend the arm64 register operands before shifting and mask the uxt forms * Wrap the esil signed division of INT_MIN by -1 like the hardware * Model the mips divide, wide multiply and multiply-accumulate forms * Model the mips sign-extend and byte-swap forms * Model the mips bitfield extract and insert forms * Model the mips64 shift and rotate forms and fix the dsra sign fill * Fill the mips.gnu dsra result from bit 63 * Narrow the mips.gnu sll result to 32 bits * Emulate the mips.gnu rotr and rotrv as rotates * Fix the x86 att operand details in capstone, not in r2 * Model PPC XER.OV/SO for the overflow-enabled forms and mfxer/mtxer * Fix the arm32 shift counts, sign extension and uadd8 esil * Write back the post-index offset of the arm unprivileged loads * Assign the arm adc, sbc and rsc result instead of accumulating it * Model the ppc high multiplies and the rotate-insert forms * Sign-extend the ppc word multiply and mask the shift counts * Fix esil that writes a destination aliasing its own source * Fix the x86 mul, div and movbe esil and model the bit counters * Merge the addressed bytes in the mips unaligned loads and stores * Deduplicate the x86 shift emitters and fix their flag ordering * Take the x86 shift counts from the right operand * Model the x86 rotates through the carry flag * Reuse one load macro and one compare block in the mips esil * Compare and multiply the whole mips64 registers in sltu and multu * Sign-extend the mips 32-bit results and mask the shift counts * Skip the x86 shift body when the count masks to zero * Zero-extend the 32-bit registers the x86 esil writes by hand * Jump to the right token when the bsf or bsr source is in memory * Fix bic expression for arm64 * Fix the x86 adjust flag bit position and adc carry propagation * Compute the sbb overflow correction before the destination write * Fix the sbb carry, adjust and overflow flags in the x86 esil * Store to the sbb destination and zero-extend its 32-bit register writes * Zero-extend every W register the arm64 ESIL writes * Zero-extend 32-bit register writes on arm64 * Zero-extend 32-bit register writes on x86-64 * Mask the x86 shift count to the operand width **flags** * Make r_flag_get_by_spaces only return flags from the requested spaces **globals** * Stop using RCons.Gprintf from heap api * Stop using the global RCons.Gprintf in the pdb parser **http** * Fix Windows socket bugs breaking HTTP server mode * Fix iOS JSLinux offline caching and startup * Add iOS icon and complete offline JSLinux cache **io** * Fix counted reads backed by the IO cache * Correct counted reads across IO maps **jslinux** * Font pinch recalculates terminal size * Ship an optional size-optimized TinyCC * Add terminal pinch font scaling to **muta** * Use r_base64_decode_dyn in the base64 muta plugin **panel** * Panel model initialized once and alphabetically sorted * Tabs now appear in the 2nd line **panels** * Panel model initialized once and alphabetically sorted **perf** * Cache IOMap and skip overlapping data metas when flagging relocs * Half the reloc string allocations, reduces 25% memory **port** * Finish the uefi port and publish artifacts in release **print** * Refuse base91 inputs that don't fit into an int * Don't size the print block from a pf/pm/pa argument * Fix psj misclassifying ascii strings with zero padding as wide * Add entropy edges printing mode **project** * Don't save/load scr.theme in scripts * Fix project saving error when no changes or prj.new fails * Reject project notes paths escaping through symlinked directories **projects** * Don't save/load scr.theme in scripts **pseudo** * Resolve pdc goto names on demand instead of collecting labelable addresses * Print pdc gotos to another function by its name * Keep each pdc branch's emulated stores from its siblings * Emulate every pdc block once in CFG order * Render pdc blocks via r_core_print_disasm not pD * Keep pdc emulation inside its own io cache layer * Add pdc.trycatch and make it structured in the ast * Initial support for trycatch statements in pdc (as comments) * Render pdcj, pdca and pdc* through the structured pdc too * Render sparc cmp and conditional branches * Don't inline function jmps in pdc * Improve pdc output on dex functions * Add s390 pseudo parser * Fix blockers that restricted pdc.structured * Reduce duplication in the structured pdc renderer * Resolve flag-named own edges and skip unset case targets in structured pdc * Render loops and switches in the structured pdc output * Ignore unset switch default and table addresses in pdc * Register pdc.structured from the pseudo plugin * Indent orphan blocks in pdc at the walk depth * Dont truncate pdc orphan case tags **r2js** * Fix [#26581] - Update to the r2papi 0.5.0 **r2pm** * Add portable r2 package platform support * Gate packages by platform **r2r** * Give valgrind-wrapped leak tests a minimum timeout **search** * Fix regex searches after short reads **shell** * Fix [#23362] - Handle math errors in cmd_seek * Port b to task-owned command contexts * Fix 'No session started' on 'd?*' **test** * Add r2r tests for the ppc32 _SDA_BASE_ agree/disagree gp seed * Add r2r tests for esil F< F<= ordering and compare underflow * Skip variable analysis in the glibc plt-local tests * Update the dex symbol golden for the flags field in is.j * Fix dex and cil test regressions, honor dyncc argcount in call comments **tools** * Fix [#26636] - Dont load global scripts with -N * Fix [#26431] - Support endian-swapped hex streams in rax2 **types** * Fix [#26675] - lstat returns int * Correctly handle void typedefs when omited * Add missing POSIX and glibc prototypes to the type database * Record DWARF DW_AT_byte_size for composite * Fail closed when a struct names itself in r_type_get_bitsize * Render void qualifiers (restrict, volatile..) from dwarf * Save a base type under the spelling that refers to it * Respect enum size if specified (defaults to 32bit like in C) * Keep improved type propagation in the goldens * Follow the declaration name into the jni and dwarf goldens * Follow the printed declaration name in the signature unit tests * Hand out the db key a function-name match went through * Add long type variants for windows base * Resolve typedefs before measuring pointer width * Measure typedefs in r_type_get_bitsize * Size pointer members with the target word width in the type api * Fix struct/enum roundtrip names * Fix type db lookups for __-prefixed names and comma-typed args **util** * Make the base91 char lookup static and use memchr * Handle .r2so as a portable lib extension * Use RStrBuf instead of memcat to render hexpairs * Guard empty reloc names, keep bin.prefix on demangled reloc flags and dedup r_str_newf/newvf * Speed up ASCII display-width calculations * Grow strbuf pads with the append slack instead of an exact fit **visual** * Bound panel scroll to its contents * Resize panels with the mouse drag event * Fix mouse wheel events in panel menus * Improve JSLinux touch navigation and guest defaults