Radare2

Release Notes

Codename: "Exploit Twist"
Version: 6.1.8
Previous: 6.1.6
AbiDiff: 107-110 (3)
Commits: 236
Contributors: 18

curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.8/radare2-6.1.8.tar.xz | tar xJv
radare2-6.1.8/sys/install.sh

Highlights

Authors

Abhi Evgeny Kolmakov Jon Palmisciano Kevin Stubbings Lazar Aleksic Luisss003 Nitan Alexandru Marcel Ole André Vadla Ravnås ada-l0velace bdunahu dependabot[bot] pancake pancake pancake phix33 phix33 potato randomjack94dev

Changes

abi

• The sdb_remove has been deprecated as dupe for sdb_unset

analysis

• Keep duplicate single-instruction import trampolines distinct on name collision
• Autoname import call stubs after the imported function
• Don't create string metadata at addresses inside analysed functions
• Add pebble script for stub scans
• Optimize SDB key renames in analysis metadata
• Ship the syscall tables for PebbleOS
• Render array stack var element accesses as name[i] in disasm
• Shadow phantom stack vars overlaid by an array-typed variable's extent
• Optimize a:six and add more tests for it
• Fix afv mislabeling DWARF register locals as args by honoring isarg
• Fix PPC bctrl losing CALL type under capstone6 via BCCTR/BCCTRL alias ids

arch

• Harden PPC64 TOC tracking by invalidating toc_map on register clobber, call and return
• Invalidate the PPC TOC register cache on function return
• Validate asm.cpu against plugin CPU list
• Default cpu for avr is now ATxmega128a4u
• Fix PIC disassembler on big endian hosts
• More ARM big endian fixes
• Update capstone v5/next, bigendian, m68k and x64 fixes

asm

• Apply the pseudo filter only once in rasm2 and pad

bin

• Fix obf reload stacking duplicate bin objects and io maps
• Autoresolve anal.gp for ppc32 via small-data
• Handle as cyclic memory the raw string map address wraparounds
• Honor paddr in raw strings
• Fix raw string rebasing for non-VA sections
• Fix #10722 - Respect mapaddr on raw strings
• Optimize dyldcache local symbol matching
• Fix #26079 - Local symbols missing in dyldcache
• In ftab/gns1 use segment tags for proper archinfo
• Harden GNS1 loader
• Add FTAB extractor plugin
• Improve GNS1 detection to solve dyldcache false positives
• Require spaced arguments for iz+
• Fix dyldcache local symbol offset matching
• Add R_DYLDCACHE_NO_DEPS option for shallow filtering
• Auto-resolve PPC64 TOC base (anal.gp) for ET_REL and ELFv2
• Fix fuzzed PE timeout bug, clamping vsize
• Reduce false positives in the PL PEs id
• Add Rust and D demanglers
• Add new C++ demangler
• Add IBM XL demangler
• Add ARM ABI demangler
• Add ldmap.r2.js script to load sourceline from ldscript map files
• Fix more bigendian parsing bugs for PE
• Fix kernelcache parsing on bigendian
• Fix SFC parsing on big endian
• Fix big endian parsing bug for MDT
• Implement idd command
• Apply PPC64 TOC16 relocations to addis/ld immediates on ET_REL
• Clean LE endian-safe parser
• Detect ppc32 e500/e500mc cpu from .PPC.EMB.apuinfo note
• Fix memory leaks in the mdmp parser
• Fix misaligned PPC ET_REL REL24/REL14 relocation targets

build

• Fix riscv_cs capstone mode detection for all capstone versions
• Move Nix stuff into dist/nix
• switch to rev for sdb
• Bump softprops/action-gh-release from 3.0.0 to 3.0.1
• update zydis subproject url for nix
• Add Nix flake and dev shell support
• Use #ifdef CS_VERSION_PRE_RELEASE instead of CS_NEXT_VERSION version guard for riscv_cs capstone mode
• Fix subproject updates
• Meson use_sys_zydis: find library as capital "Zydis"
• Detect system zydis without pkgconfig + ppc fixes

cons

• Use RStrConstPool for RConsMark names
• Fix console context races and UAF when running background tasks
• Fix bluy theme color for swi/new instructions
• Fix #25984 - Support negative internal grep columns
• Reset terminal with RCons in a portable way

core

• Fix numvar reference math state handling

crash

• Fix HFS+ filename UTF-8 buffer sizing
• Fix null deref when RBinInfo callback is null
• Fix p= sparse map allocation crash
• Fix len multiply overflow in r_str_utf16_encode
• Fix len multiply overflow in r_str_escape_utf
• Fix len multiply overflow in escape_utf8
• Fix sz multiply overflow in r_str_escape_raw
• Fix #26047 - allocation size overflow in r_str_word_get0set
• Fix count overflow in x examine command
• Fix blocksize multiply overflow in pfb command
• Fix integer overflow in pxAv print command
• Fix signed overflow and null deref in pv print command
• Fix #26048 - integer overflow in pb
• Fix #26051 - oobread on truncated mdmp files
• Fix #26049 - cmd.load descriptor UAF in bin load
• Fix #26045 - r_str_append signed length overflow
• Fix #26044 - UAF in pde, regprofile changing inside the loop
• Fix more OOB read bugs in the java parser
• Fix #26043 - 2 byte oobread bug in RBinJava line number table parser
• Fix #26042 - Fix aos opcode count overflow
• Fix #26046 - Harden and optimie RStr.replace for irreal 2 milion length strings cases
• Fix #26035 - Oobsfaults in omba, ombd and ombg commands
• Fix more empty buffer issues in bin2strdup callers
• Fix assert with 0 length quoted strings in w

debug

• Fix cons push leak in RDebugIo reg profile
• Open self with api instead of commands in r2preload
• Fix GDB register cache bounds and ownership checks

diff

• Use RCons.printf in core/gdiff

disasm

• Support hexdump/disasm addresses in octal base
• Unify asm.addr.base10/36 into asm.addr.base
• Fix overlapped strings length using RAnalOp.ptrSize
• Apply the pseudo filter only once in the disasm pipeline
• Preserve spaces in constructed string comments

esil

• Model PPC XER.CA ESIL for add/subtract-with-carry and algebraic shift-right
• Isolate ESIL registers for type link propagation
• Use local ESIL for type link propagation
• Unify ESIL constructors behind an REsilOptions struct
• Use core ESIL step-back for dsb
• Consolidate ESIL step-back history and tests
• Report ESIL step-over stop status
• Improve stepover and more aeso tests
• Print ESIL cmd handler values in hexadecimal
• Honor esil.iotrap in core ESIL stepping
• Rewrite ESIL stepping around core single step
• Get rid of esil.verbose
• Use ESIL voyeurs to track refs
• Reload core ESIL callbacks on arch changes
• Fix PPC indexed load/store, shift/rotate/divide and sign-extend ESIL
• Add ESIL for PPC scalar floating-point load/store/arith/convert ops
• Fix floating point emulation bug on 32bit
• Fix error handling in esil poke
• Fix esil poke on big endian hosts
• Add ESIL for PPC integer/logical/rotate/mod ops and fix subfze/nor/nand
• Add ESIL for the PPC isel conditional-select instruction
• Pass ESIL instances to arch callbacks
• Use local ESIL stats for ROP classification
• Tighten core ESIL step and trap handling
• Clean up core ESIL config and interface plumbing
• Treat unreadable pin PCs as handled in core ESIL
• Fix ESIL alias voyeurs seeing updated registers
• Add core ESIL lifecycle and stepback support

fs

• Fix HFS+ catalog filename conversion
• Avoid heap allocation in HFS+ catalog key compare
• Expose addrline dwarf info in the r2 virtual filesystem
• Fix ntfs utf16 filenames on bigendian

http

• Fix prefix and www root fallbacks

io

• The dsc io plugin is not a block device
• Fix memory leak in io.self on close
• Fix windows block device identify

muta

• Fix endian bugs in the serpent

print

• Implement pFJ for JWT token decoding
• Add the CLd for source baked decompiler command
• Add RTableOptions.wrap and more markdown improvements
• Extend all p-/p= with json and better bounds
• Fix #26034 - pf beyond blocksize prints zeros

pseudo

• Simplify pdc helpers and remove redundant null checks
• Refactor pdc line emission and loop goto filtering
• Resolve pdc global folds from analysis metadata
• Recover varnames with gp relative globals for pdc signatures
• Hold asm.addr.base for pdc too
• Reset asm.addr.relto in pdc to not break pseudo disasm
• Fold resolved TOC global loads into flag names in pdc

r2r

• Fix token test terminal reset expectation

refactor

• Use r_read_ble32 in rtti_msvc

reg

• Document lowercase register roles for dyncc

search

• Use isolated ESIL VM for gadget search
• Use local ESIL in search commands
• Preserve gadget class details
• Unify gadget class storage
• Fix legacy ROP classification correctness

shell

• Add r2vsql in the fallback command handler
• Shorten alias help messages
• Fix 'join' command argument parsing

socket

• Fix PTY dynapi initialization in socket redirection

tests

• Improve and document REQUIRE in r2r
• Some tests require zydis

tools

• Fix binary number parsing in rasm2
• Rafs2 wasnt included in binr/blob

types

• Fix type lookups for long function names
• Add 'tsn' to lookup struct names by size
• Add ten command for enum lookup by numeric value
• Support union offsets in type member lookup

util

• Optimize RStrBuf.slice - 30% faster
• Render inline markdown codeblocks/spans
• Render markdown attributes in table cells
• Add table trim option with ellipsis
• Fix markdown table emoji widths
• Fix custom float roundings and endian issues

windows

• Port the r2preload thing to Windows