chore(deps): update dependency radareorg/radare2 to v6

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
radareorg/radare2	major	5.9.6 → 6.2.0

---

Release Notes

radareorg/radare2 (radareorg/radare2)

v6.2.0

Compare Source

Release Notes

Codename: "Febrer Deams"
Version: 6.2.0
Previous: 6.1.8
AbiDiff: 110-132 (22)
Commits: 503
Contributors: 25

curl -Ls https://github.com/radareorg/radare2/releases/download/6.2.0/radare2-6.2.0.tar.xz | tar xJv
radare2-6.2.0/sys/install.sh

Highlights

More details

Authors

AGhebrea Abhi Anton Bolshakov Claude Evgeny Kolmakov Hissssst MiKi Mohammed Hassan Mohammed Hassan OrbisAI Security ProMix Ricardo J. Rodríguez ada-l0velace arhwx dependabot[bot] gogolovefish neil nnguyen609 pancake pancake pancake phix33 phix33 potato ryawa

Changes

abi

• Pahole more structs to drop gaps and reduce struct size
• Make RCons authoritative for command help rendering
• Unify the struct and union member model into RAnalTypeMember
• Use BE bool flag (instead of int le) for utf16->utf8

anal

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Name the stack canary from a register write index instead of trace position
• Fix cc stack arg slot offsets and bound the argslot scans
• Fix the double return-address skip in the callargs stack walk
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Keep fail-only fallthrough edges in the function graph
• Fix arm64 =SN syscall register alias to follow asm.os
• Use stateful decoding in the /r, aea and aespc linear sweeps
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Unify struct and union field picking and simplify the const retype in aaft
• Propagate callee types into struct and union fields during aaft behind types.fields
• Add anal.gpseed to seed a PIC base register during ESIL analysis
• Use r_anal_block_successor_addrs_foreach to build the function graph
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument access patterns (afts)
• Better call clobbered register detection for arm64
• Honor calling convention clobbers in ESIL analysis
• Add r_anal_cc_isclobber API
• Emulate bbs in CFG order for the type matcher
• Add callconv for all archs (updates clobber and preserve info)
• Fix pdb/dwarf union parsing to fill the union member vec
• Add clobber and preserve register for ppc and arm callconv
• Dont pick ppc TOC pointers as function argument registers
• Mark variadic libc functions properly and fix caller arg over-recovery
• Restore arm32 AAPCS register args r0-r3 in calling convention

analysis

• Don't treat register moves as argument uses in rarg extraction
• Warn the user analyzing non-executable maps
• Use the target word size for pointer types in the anal type api
• Select the MIPS calling convention from the ELF o32/n32 abi
• Keep the function frame size in second passes
• Honor anal.vars.newstack in the esil analysis
• Stop treating ARM stack restores as arguments
• Resolve emu call arguments through the calling convention layer
• Restore bb regstate for the type propagation
• Test nested struct field typing from arm64 return value stores
• Add the ppc64 ELFv2 calling convention and select it from the ELF ABI
• Fix powerpc calling conventions
• Make the afvs stack delta frame relative like afvb
• Keep pointer dereference count in callee argument
• Add r_anal_cc_argslot and argval APIs resolving stack arg slots
• Meet conflicting pointer facts at void pointer regardless of rank and float conflicts at double
• Unify type ranking, memoize block reachability and make the parallel type meet order independent
• Merge conflicting type facts from parallel paths with an explicit lattice
• Follow deref chains when typing struct fields from return values
• Fix UCALL bitmask misuse in aaft that skipped return-value stores
• Add asm.cmt.reguse comments
• Expose dyncc register role APIs
• Add reguse analysis hints
• Synthesize struct types from pointer-argument access patterns (afts)
• Better call clobbered register detection for arm64
• Honor calling convention clobbers in ESIL analysis
• Add r_anal_cc_isclobber API
• Emulate bbs in CFG order for the type matcher
• Add callconv for all archs (updates clobber and preserve info)
• Add clobber and preserve register for ppc and arm callconv
• Dont pick ppc TOC pointers as function argument registers
• Mark variadic libc functions properly and fix caller arg over-recovery
• Restore arm32 AAPCS register args r0-r3 in calling convention

api

• Use the formatted sdb setters
• Use the new formatted SDB getters -200LOC

arch

• Fix opcode decoding and endian selection in the ppc.gnu plugin
• Pseudo for ppc ctr branch
• Add the missing operand count to the PowerPC lfiwax pseudo rule
• Keep every operand in the mips and sparc pseudo fallbacks
• Widen the PowerPC word rotate masks to the full ISA MASK
• Simplify the cr0 and trap helpers in the PowerPC pseudo filter
• Decode hex trap conditions and the folded unconditional trap forms
• Fix the rldicr rotate mask being taken from the rldic rule
• Dispatch the PowerPC pseudo fixups by mnemonic instead of table position
• Keep every operand when no PowerPC pseudo rule matches
• Add the missing isel rule to the PowerPC pseudo table
• Fix PowerPC bclrl link register handling
• Support the capstone v6 PowerPC operand and branch predicate model
• Write LR on the linking conditional branch-to-ctr forms even when not taken
• Workaround ppc.cs UB bug causing random esil test fail (capstone followup)
• Fix x86 rip-relative ptr for zero-displacement destination operands
• Fix PPC mfspr/mtspr decoding, stwu/stdu stack detection and vle archinfo
• Type arm64 flag-setting adds/adcs/subs/ands/bics in ESIL analysis
• Remove capstone v3 support, capstone 4 is the minimum
• Fix the v35 plugin build and stop typing valid arm64 instructions as ILL
• Fix MIPS conditional branch-and-link (bgezal/bltzal) jump target
• Fix arm.gnu Thumb branch and svc/udf imms
• Gate PPC toc_map TOC with RArchOpMask.STATEFUL and wire it into aar
• Early error handling when arch is not initialized
• Fix PPC conditional lr/ctr branch aliases incorrectly decoded as jmp2zero
• Add RArchOpMask.STATEFUL and RArchSession.reset
• Invalidate the toc_map base register on PPC update-form loads and stores
• Invalidate the cached t9 call target on untracked writes and drop the mips.gnu decoder state
• Accept MIPS ISA CPU names

bin

• Fix signed underflow case for ppc elf imports
• Preserve PE section names when COFF strings are unavailable
• Strictier coff magic check
• Gate the ppc64 opd and glink logic by ELF ABI and fix the ELFv2 stub stride
• Fix out-of-bounds read on the SOM dynamic loader string table
• Fix uninitialized .NET stream sizes
• Pack bin vector element structs
• Better DEX header and string validation with less code
• Reject malformed DEX headers before string parsing
• Add v128, ref and reftype support for wasm
• Initial implementation of the rust v0 demangler
• Implement iuo command to open resoUrces inline
• The old iU is now under iu, same goes for rabin2 -u
• Move the rabin2 -u feature into an env var
• Some binfiles require custom resource retrievals
• Add raw resource extraction controls
• Add iU, table output and handle invalid subcommands
• Add support for encoded resources and extraction
• List demangler plugins as part of rbin
• Make RBin demanglers pluggable and selectable
• Handle macho resources on 64bit fat slices too
• Add support for GLib Resources inside ELF files
• Expose macho code signature and certificate as resources
• Add dir.binsdb (from binpath/dirprefix) for PE/MDMP ordinal lookups
• Parse and expose PE/CLR Resources
• Add OS/2 LE/LX resource support
• Add ix command for extract sections, segments and resources
• Rename iR to iU and add iUx extraction
• Implement resource extraction api wired to rabin2
• Fix leak and harden the Java parser to not parse too much garbage
• Better QNX header check
• List and extract QNX LMF resources
• Add resources support for the Pebble
• Expose PE resources from mdmp
• Extract resources with rabin2 -xU
• List resource metadata and paddr
• Deprecate the old sdb metadata for resources
• Preserve generated NE entry symbols (bin.unnamed=false)
• Honor 32bit NE absolute addressing for > 64k tables
• Reject invalid NE resource shifts
• Expose and harden NE binary resources
• Use the generic resource API for iR commands
• Expose PE resources through the generic API
• Add generic binary resource API
• Fix #​23827 - oba not loading bin info from fat macho headers
• Add error if pdb7 root size negative or zero
• Fix PE version string parsing on big-endian hosts
• Utf16 strings in minidumps are always little endian
• Fix infinite loop in the NE fixup parser
• RBinPluginAny is now "null" for consistency and no longer uses LibMagic
• Decode PEF relocs lazily, add more bounds and overflow checks
• Fix AArch64 ELF relocation patching
• Stop parsing invalid PE import libraries
• Fix PE library import deduplication slowdown
• Fix warnings parsing zero-sized PE import directories
• Only do the right PE msvcseh checks for given arch/bits
• Fix bits in arm64 PE
• Name defined dynsym GOT slots in section-less ELFs
• Name global GOT slots to resolve relative GOT loads in mips.gp

build

• Add MiKNix platform support
• Fix #​26312 - Compile against zydis 4.1 ... 5dev
• Improve jslinux build times, linking only the r2blob
• Add docker for dist/jslinux to compile on macOS
• Add dist/jslinux using temu/rv64
• Dont force x86.pseudo on single-arch-non-intel
• Build fixes for empty muta, egg, fs plugin lists
• Fixes for Windows XP
• Add libandroid-spawn to Termux package installation
• Select CS_ROOT after including config-user.mk so configure --with-capstone-next takes effect
• • Add android-sdk script for multiabi toolchain
• Fix #​24090 - Android ARM64 static compilation
• Autodetect NDK from Android Studio in sys/android-*.sh
• Use an alternative windows ci action with newer deps
• Ignore the test_anal_types unit test binary
• Silence nullability extension warnings with GCC

ci

• Publish Android SDK in releases
• Specify ref to checkout testbins
• Dont build for filc in PRs

cons

• Use sorted RVec to store themes
• Update statically compiled color themes
• Detect terminal capabilities with COLORTERM
• Isolate new task command handlers with child consoles
• Isolate consoles and share console state in ctx cloning
• Fix edge cases of the sort comparator
• Make case-insensitive grep modifiers stage-local
• Fix chained grep range and column stage ordering
• Fixed multi-digit $:NN parsing
• Fix sort and uniq grep counts
• Fix ?. after filtered output
• XML formatting leaves a stale buffer capacity
• Expose cancel and failure states for RConsEditor
• Fix editor line-list ownership
• Remove global RConsEditor state
• Fix TAB help prompt redraw

core

• Route task output through parsed command contexts
• Keep task identity local to command execution
• Fix windows build (strset is declared in mingw and msvc string.h)
• Structure only natural loops in the pdc region AST
• Select core.pseudo in all plugin profiles that keep pdc
• Build a region AST for pdc with a pdct debug dump
• Move the pdc pseudo decompiler into a core plugin
• Fix #​26245 - Handle waitpid failures in r_sys_cmd_str_full()
• Report invalid analysis subcommands

crash

• Memory exhaustion bug parsing malformed kernelcaches
• Fix #​26390 - Bound HFS+ btree records and catalog names
• Fix #​26390 - ASAN OOBR when namelen > 30 in hsfplus
• Fix #​26374 - Stack oobread in print_insn_tic6x
• Fix oobread in ELF’s PN_XNUM
• Fix UAF in oc -;oc -
• Use dynamic base64 encoding in command callers
• Reject empty r2agent HTTP auth tokens
• Fix OOB reads in ropchain/pxb/ptb/px3 print commands
• Fix OOB reads in print commands and Apple cache parsers
• Fix OOB reads in dyldcache dep carving
• Fix #​26343 - heap OF using _dyn variants in ?b64[-]
• Fix stack overflow, offbyone, UB and leaks in the visual mountpoint code
• Fix #​26342 - stack overflow in tinycc include
• Fix pxd8 and pxu8 short-buffer reads
• Fix off-by-one in the http socket api
• Fix #​26325 - NULL realname dereference in disasm flag comments
• Prevent pipe and redirect injection after escaped quotes
• Fix r2agent authentication fallthrough
• Fix 1 byte oobwrite bug in the gdbclient
• Fix heap over-read at buffer end when parsing gdb regs
• Fix oobwrite in gdb register bounds
• Fix OOM crash in the gdbserver xml register
• Fix stack exhaustion gdbserver in xi:include href=self.xml
• Fix oobread in vFile pread gdbserver responses
• Same oobread for the P register packet parsing
• Fix oobread in gdbserver p/P register handlers
• Fix oobread in gdbserver p/P register handlers
• Fix #​26255 - heap overflow write in our gdb server
• Fix #​26258 - punycode encoder oobread
• Refactor and harden LE/LX page decoding
• Harden LE/LX section and relocation parsing
• Validate uleb128 parsing in the DEX debug-local operands
• Fix #​26240 - egg include parser buffer underflow
• Fix #​26241 - null deref on dex memory exhaustion
• Fix #​26243 - Handle REgg initialization failure
• Fix #​26246 - fdleak when pipe(2) fails in lang_pipe_run
• Detect NE relocation chains infinite loops
• Bound NE counted string parsing
• Harden lua parser fixing many oobreads
• Fix Lua function parser OOB reads
• Fix oobread in Mach-O protocol list pointer parsing
• Fix Swift Mach-O invalid type metadata parsing
• Fix Swift Mach-O member metadata bounds check
• Fix Swift Mach-O field metadata bounds check
• Fix null+1 bug in afvt parsing
• Fix bplist Unicode string conversion
• Fix oobwrite by one (final null byte) in RStrStore
• Always null terminate utf16->utf8 strings
• Validate Mach-O LC_DATA_IN_CODE ranges
• Fix oobread when skipping subtests in softmagic match
• Fix segfault in malformed dwarf
• Fix malformed pyc refs crash and discarded ELF reloc leak
• Fix oobread in ELF PN_XNUM phdr count handling
• Validate dmp64 page counts against dump size
• Fix pyc marshal interned ASCII handling and validate code object section sizes
• Fix heap write overflow in Python loader
• Reject truncated PEF relocation tables

debug

• Fix windows build and debugstop on unix
• Implement dcut command to continue until time
• Fix getreg/setreg on wxp
• Fix ptrace requests on NetBSD
• Fix the FreeBSD build of the syscall trace mask
• Fix typo in desil exprmatchreg == handling
• Fix wrong size used in realloc
• Handle arv as a mirror of drv, to handle vector registers
• dc calls aec when cfg.debug is false
• Initialize subprocess env when not available for nix-ld

disasm

• Derive emu comment stack args from the calling convention layout
• Resolve stack-located format strings and scalar call args in emu comments
• Unify pd/pi/pdj backward walk and align the map-start window
• Harden backward disasm corner cases near file start and blocksize
• Fix #​26262 - backward pdi/pdj drift when the window contains invalid instructions
• Add asm.cmt.invalid to comment invalid instructions
• Fix #​26262 - pdj and pdi with negative count on aligned archs
• Expand printf-family varargs from the format string in emu call comments

esil

• Fix mips.gnu REGIMM branch targets and unconditional link
• Fix MIPS bgezal/bltzal to always write the link register
• Fix mips.gnu jal ESIL empty jump target
• Set cr0 on PPC record-form instructions and fix sraw/srawi word sign extension in ESIL
• Fix mips.gnu add/mult decode fallthrough and add missing hi/lo registers
• Fix mips signed mult high word and add srav ESIL
• Add arm64 BICS ESIL and type BIC as AND
• Fix mips.gnu slt-family ESIL dstreg and signed comparison
• Fix x86 SHL/SAL and NEG condition flags in ESIL (incl. memory destinations)
• Fix arm32 CMN flags and MOVT top-halfword replacement in ESIL
• Fix arm64 sbc ESIL carry sense and add sbcs/ngc/ngcs with NZCV flags
• Fix NZCV flags for arm64 flag-setting ops and carry-in for adc/adcs in ESIL
• Fix PPC extsb/extsh/extsw ESIL to always sign-extend into the destination
• Encode full-width compare results in the PPC cr ESIL model
• Apply the delayed branch when the delay slot op emits no ESIL
• Fix arm halfword and byte load widths in ESIL
• Fix ppc64 ld ESIL to not update the base register
• Propagate stop reason for esil debugging
• Stop ESIL continue at unmapped PC

graph

• Point switch case graph edges at the case jump target

http

• Improve the launcher webui style
• Prevent stale WebUI assets
• Fix HTTP browser launcher selection
• Update the Material WebUI from latest radare2-webui
• Empty lines in http auth file let pass any password
• Protect with auth the r2agent web sessions spawns

io

• Initial io.ebpf for Linux-x64,arm64,rv64
• Fix #​26411 - oobwrite in io.gprobe
• Preserve permissions in io.xattr

lang

• Avoid null language plugin lookups

magic

• Run text magic rules after binary misses
• Fix #​26164 - libfile 5.47 deprecated regex/c

port

• Add dist/netbsd to boot r2 in the browser

project

• Fix new project script for meta, hint and var
• Add 'prj list' subcommand
• Complete Ct commands and project persistence
• Lossless Ct base64/json serialization

projects

• Fix new project script for meta, hint and var
• Add 'prj list' subcommand
• Lossless Ct base64/json serialization

pseudo

• Convert only whitespace-preceded semicolons to comments in pdc
• Bring back the orphan block in pdc
• Fix zero-width pdcj annotation ranges in the pseudo decompiler
• Use strbuf padding for pdc indentation instead of a fixed buffer
• Return NULL instead of false in the dalvik pseudo parser
• Fix #​26392 - oobread in asm_filter
• Initial h8300 pseudo decompilation
• Emit structured if/else in pdc
• Implement pdc* comment output

r2pm

• Add R2_LIBS with the library flags from R2_LDFLAGS

search

• Fix #​26294 - Search stops on 0xffffffff data when io.cache is enabled
• Fix disassembly regex parsing and validation
• Preserve instruction boundaries across disassembly search blocks
• Apply search alignment to disassembly hit starts
• Global search.maxhits in disassembly search (not reset after each map)
• Fix multi-regex disassembly sequence search
• Make text magic scan optional with /mt

shell

• Check r2p in basename for r2pipe calls
• Cleanup dollar files apis
• Iterate command aliases directly in the hashtable
• Port echo to task-owned command contexts
• Fix #​26377 - rm command silently ignoring -r and -rf flags
• Change b64: command behaviour and add b64:'
• Fix -j? and wire subcommands to js
• Accept parenthesis in temporal heading seek expressions
• Implement the heading @ syntax support
• Bring back the command substitution execution
• Improve cmd syntax test coverage and fix separator bugs
• Keep command substitution output opaque
• Support raw calls inside command substitutions
• Support literal commands after && and ||
• Normalize raw calls at command boundaries
• New CtxOnly RCmd API callbacks and add generic subcommands helpers
• Use the new cmdapi in the agD plugin
• Validate raw call addresses and faster quote strip
• Remove the deprecated double-quote raw call
• Preserve shell preprocessing and internal pipe chains
• Unify r2 and system shell command boundaries
• Support && and || command short-circuiting
• Add lazy argument slices to command contexts
• Add contexts for the new command handlers
• Keep command dispatch results structured internally
• Implement the new cmd api for trie based commands
• Make inline double quotes transparent before dispatch
• Preserve literal escapes in echo pipelines
• Fix the use of ', " and \ with lots of tests
• Prevent command injection in quoted spans
• Fix grouped grep after json format
• Fix subcommand parsing + help for z-
• Fix parsing /ad search subcommands modifiers
• Handle ed/-E errors and both behave equally
• Sync buffer length to avoid unnecessary strlens
• Respect cursor position in Tab, and autocomplete afvn varnames
• Fix exact autocomplete lookup for command arguments

sync

• Support thread conds on Windows 95/XP
• Add timeout support for r_th_cond_wait

test

• Avoid shared .tmp directory races between parallel tests
• Escape colon in count greps now that ~? honors line ranges
• Split the struct synthesis tests out of the overgrown types test file
• Add r2r test proving pdb unions survive the anal base-type path

tests

• Avoid shared .tmp directory races between parallel tests

tools

• Show -Os in 'r2 -v' for size optimized builds
• Add more vars for r2 -H
• Slurp raw stdin before converting it with rax2 -S
• Fix #​24090 - Android toolchain reuse across architectures
• Centralize rcfile path construction and update -E/ed doc
• Document r2 -E flag
• Make rasm2 -L exit 0 like r2 -L and rafind2 -L

types

• Regenerate c2 golden files and test in CI
• Accept multiline function signature definitions
• Parse function pointers within function parameters
• Store variadic args as both forms
• Fix ctypes argument store for fnptr members and (void) prototypes
• Remove redundant null checks before free in the C types parser
• Expose type signedness and variadic checks in the r_type api
• Type the variable receiving the malloc'd pointer in afts
• Resolve the type matcher arg location and slot offset from one lookup
• Resolve stack arg slots via the cc argslot API in the type matcher
• Synthesize allocator return objects in afts
• Report size-function provenance in aftsj sizehints
• Cleanup the size-fn harvesting code in anal_tp
• Harvest object sizes from memset-style call sites
• Support long return types with > 64chars
• More comma based types support for structs, surviving sizeof, pf and tsc
• Support member fields with types containing commas
• Parse hex array dimensions in struct and union members
• Unify struct/union sdb serialization between the C parser and base types
• Expose and use real type size and field alignment details
• Strip wrapping quotes from the afvt type argument
• Struct redefinitions replace the saved members
• Preserve struct member array counts through the base-type sdb roundtrip

util

• Add non-recursive thread lock support for Windows
• Preserve partial stdin reads and remove dead newline code
• r_stdin_readline: correct EOF handling
• Add RSys.open(), a reusable system opener API
• Fix duplicate separators in r_file_root paths
• Fix r_num_units integer check for 80bit long doubles
• Disable log colors on legacy Windows consoles
• Implement strict vs tolerant base64 parsing modes
• Fix #​26359 - out-of-range shifts and rotates in RNumMath
• Fix hex string escape decoding
• Document tolerant base64 decoding
• Initial import of the Trie data structure
• New r_sys_exepath and more portable pidpath api
• Add r_str_filter_file API for project names
• Fix #​26244 - Prevent r_sys_cmd_str_full pipe hangs
• Fix dominator tree construction and add unit tests
• Add r_str_printfmt and the pfp command to map printf formats to vararg types
• Preserve callback RNum errors in math parser
• Fix math tokenizer race condition in RNum
• Add the new RStrPnlen for printable length strings
• Match unstripped function names in type guesser so afs protos resolve
• Optimize strbuf with less strlen and better weakref uses
• Format large strbuf appends in place

visual

• Implement scr.drag to click+drag to scroll in disasm/hex/graph
• Fix null dereference on prompt exit in visual find
• Fix visual disassembly scrolling across middle boundaries
• Fix disasm scroll bug over metadata
• Lock horizontal scroll in hexdump/disasm with scr.wheel.hscroll
• Fix visual disasm reverse scroll over metadata rows
• Fix visual disasm scroll stuck inside metadata

windows

• Add dist/reactos to create live web images for r2
• Fix debugger bugs for w32 (io read, attach and maps listing)
• Parse more ansi escape codes for non-vt terminals
• Disable more ansi codes on non-vt terminals
• Fix RCons.clearLine performance on legacy w32

zignatures

• anal: fix zignature drop for functions with empty-typed vars or varargs

v6.1.8

Compare Source

Release Notes

Codename: "Exploit Twist"
Version: 6.1.8
Previous: 6.1.6
AbiDiff: 107-110 (3)
Commits: 236
Contributors: 18

curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.8/radare2-6.1.8.tar.xz | tar xJv
radare2-6.1.8/sys/install.sh

Highlights

More details

Authors

Abhi Evgeny Kolmakov Jon Palmisciano Kevin Stubbings Lazar Aleksic Luisss003 Nitan Alexandru Marcel Ole André Vadla Ravnås ada-l0velace bdunahu dependabot[bot] pancake pancake pancake phix33 phix33 potato randomjack94dev

Changes

abi

• The sdb_remove has been deprecated as dupe for sdb_unset

analysis

• Keep duplicate single-instruction import trampolines distinct on name collision
• Autoname import call stubs after the imported function
• Don't create string metadata at addresses inside analysed functions
• Add pebble script for stub scans
• Optimize SDB key renames in analysis metadata
• Ship the syscall tables for PebbleOS
• Render array stack var element accesses as name[i] in disasm
• Shadow phantom stack vars overlaid by an array-typed variable's extent
• Optimize a:six and add more tests for it
• Fix afv mislabeling DWARF register locals as args by honoring isarg
• Fix PPC bctrl losing CALL type under capstone6 via BCCTR/BCCTRL alias ids

arch

• Harden PPC64 TOC tracking by invalidating toc_map on register clobber, call and return
• Invalidate the PPC TOC register cache on function return
• Validate asm.cpu against plugin CPU list
• Default cpu for avr is now ATxmega128a4u
• Fix PIC disassembler on big endian hosts
• More ARM big endian fixes
• Update capstone v5/next, bigendian, m68k and x64 fixes

asm

• Apply the pseudo filter only once in rasm2 and pad

bin

• Fix obf reload stacking duplicate bin objects and io maps
• Autoresolve anal.gp for ppc32 via small-data
• Handle as cyclic memory the raw string map address wraparounds
• Honor paddr in raw strings
• Fix raw string rebasing for non-VA sections
• Fix #​10722 - Respect mapaddr on raw strings
• Optimize dyldcache local symbol matching
• Fix #​26079 - Local symbols missing in dyldcache
• In ftab/gns1 use segment tags for proper archinfo
• Harden GNS1 loader
• Add FTAB extractor plugin
• Improve GNS1 detection to solve dyldcache false positives
• Require spaced arguments for iz+
• Fix dyldcache local symbol offset matching
• Add R_DYLDCACHE_NO_DEPS option for shallow filtering
• Auto-resolve PPC64 TOC base (anal.gp) for ET_REL and ELFv2
• Fix fuzzed PE timeout bug, clamping vsize
• Reduce false positives in the PL PEs id
• Add Rust and D demanglers
• Add new C++ demangler
• Add IBM XL demangler
• Add ARM ABI demangler
• Add ldmap.r2.js script to load sourceline from ldscript map files
• Fix more bigendian parsing bugs for PE
• Fix kernelcache parsing on bigendian
• Fix SFC parsing on big endian
• Fix big endian parsing bug for MDT
• Implement idd command
• Apply PPC64 TOC16 relocations to addis/ld immediates on ET_REL
• Clean LE endian-safe parser
• Detect ppc32 e500/e500mc cpu from .PPC.EMB.apuinfo note
• Fix memory leaks in the mdmp parser
• Fix misaligned PPC ET_REL REL24/REL14 relocation targets

build

• Fix riscv_cs capstone mode detection for all capstone versions
• Move Nix stuff into dist/nix
• switch to rev for sdb
• Bump softprops/action-gh-release from 3.0.0 to 3.0.1
• update zydis subproject url for nix
• Add Nix flake and dev shell support
• Use #ifdef CS_VERSION_PRE_RELEASE instead of CS_NEXT_VERSION version guard for riscv_cs capstone mode
• Fix subproject updates
• Meson use_sys_zydis: find library as capital "Zydis"
• Detect system zydis without pkgconfig + ppc fixes

cons

• Use RStrConstPool for RConsMark names
• Fix console context races and UAF when running background tasks
• Fix bluy theme color for swi/new instructions
• Fix #​25984 - Support negative internal grep columns
• Reset terminal with RCons in a portable way

core

• Fix numvar reference math state handling

crash

• Fix HFS+ filename UTF-8 buffer sizing
• Fix null deref when RBinInfo callback is null
• Fix p= sparse map allocation crash
• Fix len multiply overflow in r_str_utf16_encode
• Fix len multiply overflow in r_str_escape_utf
• Fix len multiply overflow in escape_utf8
• Fix sz multiply overflow in r_str_escape_raw
• Fix #​26047 - allocation size overflow in r_str_word_get0set
• Fix count overflow in x examine command
• Fix blocksize multiply overflow in pfb command
• Fix integer overflow in pxAv print command
• Fix signed overflow and null deref in pv print command
• Fix #​26048 - integer overflow in pb
• Fix #​26051 - oobread on truncated mdmp files
• Fix #​26049 - cmd.load descriptor UAF in bin load
• Fix #​26045 - r_str_append signed length overflow
• Fix #​26044 - UAF in pde, regprofile changing inside the loop
• Fix more OOB read bugs in the java parser
• Fix #​26043 - 2 byte oobread bug in RBinJava line number table parser
• Fix #​26042 - Fix aos opcode count overflow
• Fix #​26046 - Harden and optimie RStr.replace for irreal 2 milion length strings cases
• Fix #​26035 - Oobsfaults in omba, ombd and ombg commands
• Fix more empty buffer issues in bin2strdup callers
• Fix assert with 0 length quoted strings in w

debug

• Fix cons push leak in RDebugIo reg profile
• Open self with api instead of commands in r2preload
• Fix GDB register cache bounds and ownership checks

diff

• Use RCons.printf in core/gdiff

disasm

• Support hexdump/disasm addresses in octal base
• Unify asm.addr.base10/36 into asm.addr.base
• Fix overlapped strings length using RAnalOp.ptrSize
• Apply the pseudo filter only once in the disasm pipeline
• Preserve spaces in constructed string comments

esil

• Model PPC XER.CA ESIL for add/subtract-with-carry and algebraic shift-right
• Isolate ESIL registers for type link propagation
• Use local ESIL for type link propagation
• Unify ESIL constructors behind an REsilOptions struct
• Use core ESIL step-back for dsb
• Consolidate ESIL step-back history and tests
• Report ESIL step-over stop status
• Improve stepover and more aeso tests
• Print ESIL cmd handler values in hexadecimal
• Honor esil.iotrap in core ESIL stepping
• Rewrite ESIL stepping around core single step
• Get rid of esil.verbose
• Use ESIL voyeurs to track refs
• Reload core ESIL callbacks on arch changes
• Fix PPC indexed load/store, shift/rotate/divide and sign-extend ESIL
• Add ESIL for PPC scalar floating-point load/store/arith/convert ops
• Fix floating point emulation bug on 32bit
• Fix error handling in esil poke
• Fix esil poke on big endian hosts
• Add ESIL for PPC integer/logical/rotate/mod ops and fix subfze/nor/nand
• Add ESIL for the PPC isel conditional-select instruction
• Pass ESIL instances to arch callbacks
• Use local ESIL stats for ROP classification
• Tighten core ESIL step and trap handling
• Clean up core ESIL config and interface plumbing
• Treat unreadable pin PCs as handled in core ESIL
• Fix ESIL alias voyeurs seeing updated registers
• Add core ESIL lifecycle and stepback support

fs

• Fix HFS+ catalog filename conversion
• Avoid heap allocation in HFS+ catalog key compare
• Expose addrline dwarf info in the r2 virtual filesystem
• Fix ntfs utf16 filenames on bigendian

http

• Fix prefix and www root fallbacks

io

• The dsc io plugin is not a block device
• Fix memory leak in io.self on close
• Fix windows block device identify

muta

• Fix endian bugs in the serpent

print

• Implement pFJ for JWT token decoding
• Add the CLd for source baked decompiler command
• Add RTableOptions.wrap and more markdown improvements
• Extend all p-/p= with json and better bounds
• Fix #​26034 - pf beyond blocksize prints zeros

pseudo

• Simplify pdc helpers and remove redundant null checks
• Refactor pdc line emission and loop goto filtering
• Resolve pdc global folds from analysis metadata
• Recover varnames with gp relative globals for pdc signatures
• Hold asm.addr.base for pdc too
• Reset asm.addr.relto in pdc to not break pseudo disasm
• Fold resolved TOC global loads into flag names in pdc

r2r

• Fix token test terminal reset expectation

refactor

• Use r_read_ble32 in rtti_msvc

reg

• Document lowercase register roles for dyncc

search

• Use isolated ESIL VM for gadget search
• Use local ESIL in search commands
• Preserve gadget class details
• Unify gadget class storage
• Fix legacy ROP classification correctness

shell

• Add r2vsql in the fallback command handler
• Shorten alias help messages
• Fix 'join' command argument parsing

socket

• Fix PTY dynapi initialization in socket redirection

tests

• Improve and document REQUIRE in r2r
• Some tests require zydis

tools

• Fix binary number parsing in rasm2
• Rafs2 wasnt included in binr/blob

types

• Fix type lookups for long function names
• Add 'tsn' to lookup struct names by size
• Add ten command for enum lookup by numeric value
• Support union offsets in type member lookup

util

• Optimize RStrBuf.slice - 30% faster
• Render inline markdown codeblocks/spans
• Render markdown attributes in table cells
• Add table trim option with ellipsis
• Fix markdown table emoji widths
• Fix custom float roundings and endian issues

windows

• Port the r2preload thing to Windows

v6.1.6

Compare Source

Release Notes

Codename: "lospatos2"
Version: 6.1.6
Previous: 6.1.4
AbiDiff: 83-107 (24)
Commits: 455
Contributors: 25

curl -Ls https://github.com/radareorg/radare2/releases/download/6.1.6/radare2-6.1.6.tar.xz | tar xJv
radare2-6.1.6/sys/install.sh

Highlights

More details

Authors

AGhebrea AGhebrea Abhi Claude Dirk Mueller Dirk Mueller Hinotobi Mattia Galuppi Michał Mnich Ole André Vadla Ravnås Priyanshu Kumar WearyTraveller42 aviciano condret davidpolverari dependabot[bot] orbisai0security pancake pancake pancake phix33 phix33 potato randomjack94dev s-zaizen

Changes

abi

• Add command file string API
• Migrate RBinSymbols from RList to RVec
• Get rid of the backward compat r_core_cmd_calls (Use r_core_call)

anal

• Rename anal.flagstop to .flagbounds and clarify diff w/ anal.flagends
• Add anal.flagstop function boundary option
• Fix PPC positive conditional branches
• Fix garbage upper bits in xref/heap table size columns (ut64 casts)
• Add and test static x86 clobber cc metadata
• Add static x86 calling convention preserve metadata
• Add static x86 calling convention stack cleanup metadata
• Improve static and indirect call convention analysis
• Improve static x86 calling convention stack cleanup
• Stabilize register index ordering
• Honor calling convention register clobbers
• Track callee-popped stack arguments
• Resolve dynamic calling conventions lazily
• Add dynamic calling convention parser
• Generalize calling convention location accessors
• Use dyncc calling convention for isvm archs
• Add tests for static calling convention multi-return
• Fix static calling convention argument lookup
• Handle two-operand imul and idiv
• Use indexed return registers in calling conventions
• Initial support for multireturn in calling conventions
• Recover ObjC inheritance in analysis classes
• Better default fcn names, respect symbols
• Extend RBinMeta for Java/Dalvik/MSIL dynamic callconvs
• Stack based dynamic calling convention fix for Java
• Support dynamic calling conventions for Java and Dalvik
• Fix switch analysis for latest DEX
• Show branch cases in afbtj
• Speed up function basic block lookup a bit
• Keep SwitchOp.dependency ops in afbt, Vc and pdc
• Reduce type propagation churn and false positives
• Simplify type propagation backtrace state
• Tighten type trace access matching
• All public var apis use RVec now
• Configurable jumptable maxcases
• Fix stale Rust jump table bounds
• Fix x86 jump table autosizing for Rust niche switches
• Refactor jump table decoding and case analysis
• Clamp switch case counts and borrow register names
• Fix afbt script output and sparse zero entries
• Redesign and extend the jump/switch table API and commands
• Rename afj to afbt and add a test
• Fix arch value handling for stack operations
• Tighten x86 stack operand analysis
• Populate Xtensa value metadata for stack analysis
• Populate RISC-V stack value metadata
• Populate MIPS value metadata for stack analysis
• Fix ARM stack variable substitution
• Populate ARM value metadata for stack analysis
• Rewrite stack variable extraction around values
• Stop using ESIL in function analysis
• Fix MIPS register argument recovery
• Fix bug in 'as command' not showing the right syscall
• • The afbc forces the address to be the first of the basic block if any
• ArenaPushPop uses CoW optimization
• Fix infinite loop in the codemeta
• Support pining functions with custom emojis
• Fix CID 1654963,1654964,1654965 - check r_esil_get_parm_strs retval in set_mem dfg
• Fix CID 1654968 - check r_esil_get_parm_strs retval in esil_dfg
• Add missing anal.plugins.pre config var

analsys

• Rename anal.flagstop to .flagbounds and clarify diff w/ anal.flagends

analysis

• Add anal.flagstop function boundary option
• Fix PPC positive conditional branches
• Add and test static x86 clobber cc metadata
• Add static x86 calling convention preserve metadata
• Add static x86 calling convention stack cleanup metadata
• Improve static and indirect call convention analysis
• Improve static x86 calling convention stack cleanup
• Stabilize register index ordering
• Honor calling convention register clobbers
• Track callee-popped stack arguments
• Resolve dynamic calling conventions lazily
• Add dynamic calling convention parser
• Generalize calling convention location accessors
• Use dyncc calling convention for isvm archs
• Add tests for static calling convention multi-return
• Fix static calling convention argument lookup
• Handle two-operand imul and idiv
• Use indexed return registers in calling conventions
• Initial support for multireturn in calling conventions
• Recover ObjC inheritance in analysis classes
• Better default fcn names, respect symbols
• Extend RBinMeta for Java/Dalvik/MSIL dynamic callconvs
• Stack based dynamic calling convention fix for Java
• Support dynamic calling conventions for Java and Dalvik
• Fix switch analysis for latest DEX
• Show branch cases in afbtj
• Keep SwitchOp.dependency ops in afbt, Vc and pdc
• Reduce type propagation churn and false positives
• Simplify type propagation backtrace state
• Tighten type trace access matching
• All public var apis use RVec now
• Configurable jumptable maxcases
• Fix stale Rust jump table bounds
• Fix x86 jump table autosizing for Rust niche switches
• Refactor jump table decoding and case analysis
• Clamp switch case counts and borrow register names
• Fix afbt script output and sparse zero entries
• Redesign and extend the jump/switch table API and commands
• Rename afj to afbt and add a test
• Fix arch value handling for stack operations
• Tighten x86 stack operand analysis
• Populate Xtensa value metadata for stack analysis
• Populate RISC-V stack value metadata
• Populate MIPS value metadata for stack analysis
• Fix ARM stack variable substitution
• Populate ARM value metadata for stack analysis
• Rewrite stack variable extraction around values
• Stop using ESIL in function analysis
• Fix MIPS register argument recovery
• Fix bug in 'as command' not showing the right syscall
• • The afbc forces the address to be the first of the basic block if any
• ArenaPushPop uses CoW optimization
• Fix infinite loop in the codemeta
• Support pining functions with custom emojis
• Fix CID 1654963,1654964,1654965 - check r_esil_get_parm_strs retval in set_mem dfg
• Fix CID 1654968 - check r_esil_get_parm_strs retval in esil_dfg
• Add missing anal.plugins.pre config var

api

• Move markdown rendering code into a separate file

arch

• Add OpType/ESIL for PPC dword shifts, X-form ld/st, cntlz, mulh, CR moves
• Fix signed/endian branch-target analysis in vax, dalvik, xap, arm.gnu and java
• Fix sparc.gnu endian disassembly
• Fix capstone v5 M68K patch application
• More BE fixes even for capstone
• m68k big endian capstone bug patch
• More arch goodies for virtual regs
• Update wasm3 support for try/mmx ops
• Fix aarch64 big endian be8
• Update capstone v5/next for the x86 perf boost
• Fix STM8 pointer offset operands and jump targets
• Add opt-in Zydis x86 arch plugin
• Optimize the cs_len_prefix_opcode helper for x86
• Add RArchInfo.WODST for archs with write-only destination operands
• Stack allocate insn to avoid malloc/free in arm.cs
• V850 ESIL: Fix flags, sign-extension, bit ops, shifts
• Fix v860 esil sign, bit ops like shifts and update flags

asm

• Cleanup ppc.nz handlers and emit_ppc comments
• Add ppc.nz r_asm encoder plugin
• Refactor r_num_math error handling in asm
• Fix memory leak in x86_nz parseOpcode error paths

bin

• Add remove class ..field/:inheritance info with ic[+-]
• Fix per-section reloc cap dropping relocs on multi-section ET_REL objects
• Fix signed-char Swift super-class and field-type parsing in mach0
• Fix iS/iSS flags column showing garbage upper bits
• Emit dynamic calling conventions from bin metadata
• Implement RBinPlugin.getCc for dotnet,java,dex,python and wasm
• Parse valid wasm sections 12 and 13 (datacount + tag)
• RBinStrings are now stored in a vector
• Speed up COFF bigobj loading
• Preallocate flag storage from cbin
• Store flag names in arena and fix DEX leaks
• Keep trimmed RBinString.length sync
• Fix objc/macho/swift parsing bugs on big endian
• Dettach reloc_fixups from load_unnamed
• Migrate RBinSection store from RList to RVec
• Invalidate addr2klassmethod when ic- removes a method
• Use RVec for Mach-O reloc fixups
• Add r_bin_class_add_method and surface class methods
• Use chained fixup page size for mach0 swizzle chunks
• Fix Coverity static analysis findings
• Avoid stale COFF relocation symbol pointers
• Fix integer overflows in dex_parse_class_method_addrline
• Add bin.meta config var to permit disabling the codemeta info
• Lazy-load DEX addrline debug info
• Extend 'ies' for Dalvik onCreate symbol entrypoints
• Skip abstract methods when listing dalvik entrypoints
• Add bin.classes.namesonly option to skip method/field parsing
• Fix macho-swift/objc metadata leaks
• Map DEX code sections after method headers
• Limit DEX_PROTO_STACK_PARAMS to 64
• Fix the MAX_DEX_PARAMS warning happening in some dex
• Fix huge macho chained fixup memory leak
• Add bin.relocs.xrefs to avoid creating them if not needed
• Parse side support for binunnamed for elf, som, dyldcache and more
• Extend bin.unnamed to other file formats
• Add RBinOptions.loadUnnamed via bin.unnamed to not load unnamed symbols
• Preserve xtr bin info when metadata is partial
• Add bin.flags to skip bin symbol flags
• Fix double free in r_bin_import_free
• Fix DWARF compilation directory metadata leak
• Guard large id* scripts, reduce dwarf memory usage more and fix ^C trap
• Warn on huge DWARF debug info loads
• Dont do drama when loading libraries without entrypoint
• Trim bin startup metadata with the help of a profiler
• Handle more PPC64 reloc types and BE-aware reloc patching
• Port the sep64 binxtr plugin to fs
• Initial refactoring of the binxtr plugins as rfs ones
• Ignore fatmacho magics in the java bin plugin
• Fix #​25859 - entrypoint with overlapped elf segments
• Fix CID 1654967 - widen addr_sym_table to ut64 in load_symbols_from_phdr
• Add ii+ and ii- to add/remove imports at will
• Fixes v2p/p2v conversion for in-memory ELFs
• Handle ABS32 and GLOB_DAT relocs for arm32
• Force fallback to phdr parsing when stringtab fails in ELF
• Fix buffer size when parsing binaries from memory
• Reduce double derefs in dex for perf reasons
• Fix detection of stripped Swift machos
• Reduce double derefs in elf for perf reasons
• Parse and display DER signatures in macho (iC command)
• Expose DYLD_ENVIRONMENT, __RESTRICT and MH_APP_EXTENSION_SAFE via sdb
• Kill the hacky RABIN2_CODESIGN_VERBOSE hack using rbinoptions
• Expose macho signing type in the sdb
• Reduce double derefs i macho for perf reasons
• Support globs in the symclass patterns
• Add fortify and asan symbol names
• Refine mach0 is_pie and has_nx (heap and stack) checks

build

• Fix all warnings spotted by GCC-15. Hello Ubuntu26
• Hide otezip symbols from libr_util
• Fix the dist tarball and test it in the ci
• This slots naming is a Qt keyword conflicting with iaito

ci

• Allow Coverity Scan workflow failures
• Publish tcc r2r report in CI
• Run more tests and fix crossmbuild mipsbe
• Avoid libatomic when linking wasm r2r
• Add big endian testsuite runs
• Link Zydis in iOS blob build
• • Disable Zydis in Fil-C builds
• • Link bundled Zydis in static builds

cons

• Add R_PRINTF_CHECK to r_cons_printf and fix the format-width bugs it surfaces
• Add strikethrough support the markdown renderer
• Support italic and bold markdown
• Fix terminal mouse escape parsing

core

• Clean up line seek cache rebuild
• Expose dynamic calling convention inspection
• Double free in visual mode when highlighting string >= 32 chars
• Prompt to rebuild outdated r2pm plugins
• Report invalid dotted eval keys
• Iterate over the external plugin system once again
• Custom internal plugin reorder and unify plugin storage

crash

• Fix gdb's stop reason exec path lifetime
• Fix #​25992 - Sanitize library names in il* and add obf base64:
• Use strbuf for GDB XML register profiles
• Fix #​25974 - oversized GDB XML code pointer aliases
• Fix #​25977 - oversized GDB register cache writes
• Fix parseCodeDirectory OOB Read
• Avoid unbounded memcpy in gdb’s handle_vFile_pread
• Fix Mach-O chained fixups starts bounds
• Fix Dalvik get_name ownership mismatch
• Dont crash when RMagic dataset is not installed
• Stabilize bin vectors before reloc creation
• Fix use-after-free when commenting in visual mode
• Fix double free in r_bin_import_free
• Fix #​25918 - Fix out of bounds read in RBin.PE.getName
• Preallocating 7GB of DWARF dies makes kernels unhappy
• Fix memcpy UB with 0 and sign type for winkd
• Fix #​25886 - null deref in corrupted dwarf
• Fix #​25872 - null deref in r2fload
• Fix int ovf allocation macho bugs spotted by @​apkunpacker
• Fix memory exhaustion on corrupted DEX
• Fix CID 1655150 - clamp num_annotations and dedupe rtv/rti helpers in shlr/java
• Fix null deref in default cc
• Fix lot of vulns in shlr/java
• Fix integer overflow in java extract_type_value
• Fix #​25840 - OOB read in Java class parser and simplify ref-name building
• Fix #​25835 and #​25836 - UAFs in the gdb remote protocol
• Properly null-terminate readlink() buffer - fixes UB in r2pm
• Fix an offby1 in rasm2+stdin with r_str_ntrim

debug

• Enforce syscall number lookup and add more tracing tests
• Fix register response too large warning in gdb client
• Reduce DWARF debug info memory usage
• Group debugger configuration in RDebugOptions
• Add support for syscall tracing in FreeBSD
• Add Linux fasttime debugger support
• Add syscall enter and leave hooks
• Add parameter format for all syscalls
• Add checkpoint replay api and commands
• Fix dx restore
• Ignore unknown breakpoints by default and show some help
• Add missing eiz register for the x64-32 profile
• Sync cpu flags definitions in all the intel reg profiles
• Fix YMM stitching loop to iterate 8 regs for 32-bit targets
• Fix print_fpu to use runtime bits check instead of compile-time
• Add missing vec64 mm0-mm7 and vec128 xmm0-xmm7 to x64-32 regprofile
• Fix FPU st0-st7 register size from .64 to .80 in x64-32 regprofile
• Fix i386 syscall calling convention aliases in x64-32 regprofile
• Fix 4 byte oobread in ptrace_setregs for Linux-x86_64_32
• Fix #​9995 and #​15255 - DRX regprofile for 32 on 64-bit hosts

disasm

• Memoize the current basic block in RDisasmState
• Fix big-endian bugs in the disasm refs
• Add ahie to specify an enum type hint for imms
• Use disasm api instead of commands in pdr
• Use RVec in Reflines
• Dynamically pick the needed decoding features in the disassembler
• Display function pins in the disassembly

doc

• Document dynamic calling conventions

egg

• Refactor ppc emitter helpers; default ragg2 endian from arch
• Add REggEmit priv hooks; move ppc emitter state off file-scope statics
• Update ppc emitter for REggEmit RStrBuf migration
• Treat -c bigendian without value as truthy in ragg2
• Add PowerPC support to ragg2
• Fix #​15468 - ragg2 -P/-B/-w now work on archs without an egg backend
• Add example programs and ragg2 regression tests for egg
• Rewrite the ESIL backend in ragg2/egg as an expression compiler
• Add raw-register syntax and parser cleanups in ragg2/egg

esil

• Add ESIL for ppc byte-reverse loads/stores and fix opex

✂ Note

PR body was truncated to here.