jayhemnani
say hi →

/oss · 26 merged

radareorg/radare2

A toolkit for taking programs apart to study how they work, used by security researchers.

the project on GitHub (opens in a new tab)

  1. 20 Oct 2026

    The x86 assembler now builds 64-bit conditional moves correctly

    What was broken
    The assembler left out two bytes that mark a 64-bit or extended register. A 64-bit conditional move turned into a 32-bit one and the high registers became the wrong ones.
    What I changed
    It now writes those bytes for 16-bit, 64-bit and extended registers, checked against the GNU assembler.
    Why it matters
    Assembled code does what the source says.

    see the code, #27083 (opens in a new tab)

  2. 20 Oct 2026

    The x86 assembler now keeps the high registers in basic math

    What was broken
    For add, sub, xor, cmp and similar instructions on the extra 64-bit registers in their smaller sizes, the assembler dropped a prefix byte. The instruction quietly used a different, older register instead.
    What I changed
    It now writes that byte whenever one of those registers is used, checked against the GNU assembler on 80 cases.
    Why it matters
    Patching code with these instructions now writes what was typed.

    see the code, #27082 (opens in a new tab)

  3. 20 Oct 2026

    Java byte arrays from the print command now compile

    What was broken
    Java bytes run from -128 to 127, but the command printed every byte as 0 to 255. Any byte above 127 gave Java code that would not compile.
    What I changed
    Bytes are now printed as signed numbers, such as -112 in place of 144.
    Why it matters
    The printed Java compiles, and each value still maps back to the same byte.

    see the code, #27081 (opens in a new tab)

  4. 20 Oct 2026

    A one byte block no longer crashes a base64 print command

    What was broken
    The command that prints a block as base64 reserved too little memory. For a one byte block it wrote two bytes past the end.
    What I changed
    The command now uses a helper that reserves the right amount of memory.
    Why it matters
    A memory error that could crash the tool or be abused is gone.

    see the code, #27080 (opens in a new tab)

  5. 20 Oct 2026

    Old Mac file dates now print the right year

    What was broken
    Old Mac disk formats count time from 1904. The tool added the gap to 1970 instead of taking it away, so every date printed 132 years too late.
    What I changed
    The gap is now subtracted, so dates print correctly. The same mistake in a second date printer is fixed as well.
    Why it matters
    Dates from these disks read correctly.

    see the code, #27079 (opens in a new tab)

  6. 19 Oct 2026

    Struct views now color addresses by what they point to

    What was broken
    The toolkit can lay out memory as a struct, field by field. Fields holding addresses were printed as plain numbers, so you could not tell code from data at a glance, unlike its other memory views.
    What I changed
    With colors on, those fields are now colored by the kind of memory they point to: code, writable data or read-only data. Plain and machine-readable output stay the same.
    Why it matters
    Pointers to code or writable memory stand out while reading a struct.

    see the code, #27072 (opens in a new tab)

  7. 19 Oct 2026

    Changing folders inside the toolkit follows the shell's search list

    What was broken
    In a normal terminal, a list of favourite folders lets you jump to a folder by its short name from anywhere. The toolkit's own change-folder command ignored that list, a request open since 2024.
    What I changed
    The command now looks the name up in that list the way common shells do, and prints the folder it moved to when the list was used.
    Why it matters
    People can move around the same way they do in their terminal, including on Windows.

    see the code, #27066 (opens in a new tab)

  8. 19 Oct 2026

    The number tool reads signed values at the right size

    What was broken
    The toolkit's number tool can show a value as a signed number. It guessed the size from the wrong bit, so values like 256 came out as 0 and large numbers came out as -1.
    What I changed
    I made it read each value as signed in the smallest of 8, 16, 32 or 64 bits that holds it.
    Why it matters
    Users converting numbers get the value they typed, not a wrong one.

    see the code, #27065 (opens in a new tab)

  9. 19 Oct 2026

    The number tool shows small decimal numbers instead of zero

    What was broken
    Converting raw bytes to a decimal number printed only six decimal places, so very small values such as 0.0000001 came out as zero and others lost digits.
    What I changed
    The number is now printed with enough digits to get the exact same value back, the way the tool already did for another number format.
    Why it matters
    People reading values out of a program see what is really stored, not a rounded zero.

    see the code, #27064 (opens in a new tab)

  10. 19 Oct 2026

    Block hashes stay inside the range and report read errors

    What was broken
    In block mode, the last block could run past the requested end, and a failed read went unnoticed, so the tool hashed stale data.
    What I changed
    I made each block stop at the end of the range and made a failed read stop with an error.
    Why it matters
    Per-block hashes cover exactly the bytes asked for, and a read problem is reported instead of hidden.

    see the code, #27057 (opens in a new tab)

  11. 19 Oct 2026

    A unit test builds again without network support

    What was broken
    When radare2 was built with networking turned off, one of its tests would not compile on newer compilers.
    What I changed
    I added the one missing include the test needed.
    Why it matters
    People building radare2 without networking can run its full test suite.

    see the code, #27055 (opens in a new tab)

  12. 19 Oct 2026

    Hashing stops at the end of the file

    What was broken
    Asking the hashing tool for a range past the end of a file hashed the last chunk over and over, so the result matched no other tool.
    What I changed
    I made the range stop at the file's real size.
    Why it matters
    A hash of a whole file now matches what standard tools like md5sum print.

    see the code, #27054 (opens in a new tab)

  13. 18 Oct 2026

    rahash2 no longer crashes on empty input

    What was broken
    Piping nothing into rahash2 crashed the released version, because it tried to close a file it never opened.
    What I changed
    I made it close the file only when one was opened.
    Why it matters
    Scripts that sometimes pass empty input get a hash instead of a crash.

    see the code, #27040 (opens in a new tab)

  14. 18 Oct 2026

    rahash2 hashes the same range of every file

    What was broken
    When hashing several files with a byte range, rahash2 used that range only for the first file and hashed the rest to the end, so their hashes were wrong.
    What I changed
    I made each file get the range that was asked for, while files without a range still use their full size.
    Why it matters
    Hashing part of many files at once gives the right answer for all of them.

    see the code, #27039 (opens in a new tab)

  15. 18 Oct 2026

    rahash2 can hash empty files

    What was broken
    rahash2 refused any empty file with "Invalid file size", for every hash type, while other tools give the standard hash of empty input.
    What I changed
    I made empty files get the same hash as empty input for every algorithm; only a byte range that cannot fit still errors.
    Why it matters
    Hashing a folder of files no longer fails on the empty ones.

    see the code, #27034 (opens in a new tab)

  16. 18 Oct 2026

    rafind2 reports every match, even back-to-back ones

    What was broken
    When a pattern appeared twice in a row, like a run of repeated bytes, rafind2 only reported the first match and dropped the next one with a warning. The r2 search command found them all.
    What I changed
    I made rafind2 accept matches that start right where the previous one ended, the same as r2's own search.
    Why it matters
    A search through a binary no longer hides real hits in repeated data.

    see the code, #27033 (opens in a new tab)

  17. 17 Oct 2026

    The assembler's word view shows bytes in the right order

    What was broken
    radare2's assembler can print machine code as 4-byte words. For big-endian targets the bytes came out reversed, long output never wrapped, and a short result read past the end of its memory.
    What I changed
    I made it read words in the target's byte order, pad the last partial word, and start a new line every eight words.
    Why it matters
    The word view now matches the real bytes for any target, and short inputs no longer read stray memory.

    see the code, #27016 (opens in a new tab)

  18. 15 Oct 2026

    The file comparison tool shows every change

    What was broken
    radare2's tool for comparing two files skipped changes of a single byte, could print random memory for some inputs, and in one mode stopped after the first change.
    What I changed
    I fixed how it copies the changed bytes, made it stop reading at the right place, and let it carry on past the first change.
    Why it matters
    A comparison now lists every difference between the two files, and only what is really there.

    see the code, #26990 (opens in a new tab)

  19. 15 Oct 2026

    Inserting bytes into a file no longer cuts off its end

    What was broken
    radare2 lets you insert bytes into a file and push the rest along. With the default settings, the last few bytes fell off the end and were replaced by zeros.
    What I changed
    I made the insert move the rest of the file directly, so nothing is lost at the end.
    Why it matters
    Editing a file this way no longer silently damages it.

    see the code, #26989 (opens in a new tab)

  20. 15 Oct 2026

    The number converter now reads every line it is given

    What was broken
    Piping several numbers into the number converter, one per line, converted only the first. The line break at the end also confused it, so '1f' came out as 1.
    What I changed
    Each line is now cleaned up and converted on its own, as if it were typed separately.
    Why it matters
    Scripts can feed a whole list of numbers through the converter in one go.

    see the code, #26977 (opens in a new tab)

  21. 14 Oct 2026

    File fingerprints now match the standard ssdeep tool

    What was broken
    The toolkit can make a fuzzy fingerprint of a file, used to spot near-copies of malware. Its fingerprints differed from the standard ssdeep tool for many files, and small files got none at all.
    What I changed
    The fingerprint is now worked out the same way the standard tool does it, with a fresh start on each pass and the same minimum size.
    Why it matters
    Researchers can compare the toolkit's fingerprints with ones made anywhere else.

    see the code, #26968 (opens in a new tab)

  22. 13 Oct 2026

    The search tool no longer crashes on a badly written pattern

    What was broken
    The toolkit's search tool takes patterns written between slashes. Without the slashes, the release version crashed and newer builds silently skipped that search.
    What I changed
    The tool now says the pattern is invalid and how to write it, and still runs the other searches.
    Why it matters
    Users get a clear message instead of a crash or quietly missing results.

    see the code, #26969 (opens in a new tab)

  23. 13 Oct 2026

    The hash tool's JSON mode works for files again

    What was broken
    Asking the hash tool for one JSON object per file printed only the file name and nothing else.
    What I changed
    The JSON object is now printed for files, the same as for text given on the command line.
    Why it matters
    Scripts that read the tool's JSON output get the hashes they asked for.

    see the code, #26958 (opens in a new tab)

  24. 13 Oct 2026

    The hash tool now prints entropy in every output mode

    What was broken
    The toolkit's hash tool can measure a file's entropy, a sign of whether data is packed or encrypted. In quiet, JSON and some other modes it printed nothing, or random bytes from memory, instead of the number.
    What I changed
    Every output mode now uses one shared step for entropy and the other special cases.
    Why it matters
    Scripts that ask for entropy in JSON or quiet mode get the real number.

    see the code, #26957 (opens in a new tab)

  25. 12 Oct 2026

    Negative numbers now work with every option of the number converter

    What was broken
    Giving the number converter a negative number, like -1, made it ignore the option you asked for, such as decimal output or a size like 'g' for gigabytes, and just print hex.
    What I changed
    Negative numbers now go through the same steps as positive ones.
    Why it matters
    Converting -1 to decimal gives -1, not a long hex number.

    see the code, #26948 (opens in a new tab)

  26. 12 Oct 2026

    The number converter shows the right old-style address

    What was broken
    The toolkit's number converter also shows an address in the split format early PCs used. It dropped part of the number, so it showed a different address than the main tool did.
    What I changed
    It now uses the same calculation as the main tool.
    Why it matters
    Both parts of the toolkit agree, and the address shown is the right one.

    see the code, #26947 (opens in a new tab)

← every project