Rizin

No entries match these filters. Clear filters

1. v0.9.0 Jun 21, 2026 · release notes

   Adds JOP/COP gadget search, per-block statistical histograms, marks subsystem, and value constraints for variables in Rizin v0.9.0.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.9.0 https://github.com/rizinorg/rizin.git
   # already have the repo? check out this version:
   $ git checkout v0.9.0

   └──▷ TRY IT
   Search for JOP gadgets to bypass traditional ROP chain detection in exploit development.
   copy

   $ /J

   Analyze data distribution using statistical indicators beyond simple entropy to identify encryption or compression boundaries.
   copy

   $ p==Mv

   Constrain the range of a local variable to aid control-flow graph analysis.
   copy

   $ afvcs var0 ">0,<=9"

   • Adds /J, /C subcommands to list and search for Jump-Oriented (JOP) and Call-Oriented (COP) gadgets alongside existing ROP search
   • Adds m family of commands (e.g., m, ml, mc) to create, list, color, and name marks (named locations) in the binary
   • Adds p=C, p=I, p=M, p=S (vertical) and p==C, p==I, p==M, p==S (horizontal with minimap) to render χ², index of coincidence, min-entropy, and serial-correlation histograms
   • Adds rz-find -R <cmd> to execute a Rizin command for each search hit, complementing -E's shell execution
   • Adds plF print path to output Unicode-enabled RzIL (intermediate representation) of the current function

   +2 more show less

   • Adds support for TMS320C54x disassembly, classic BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. (cBPF), SuperH-3 (asm.cpu), M680X CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., MCS96 ISA, and C166/MIL-STD-1750 architectures
   • Adds new binary format parsers for STABS debug info, Lua bytecode (Luac 5.0–5.5, LuaJIT 2.1), CaRT, Amiga hunk, MDT, PEF, and ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. coredumps for multiple architectures

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The dmh*, dmw*, and dmx* heap inspection commands are renamed to dmhg*, dmhw*, and dmhj* respectively, organized by allocator namespace
   • !Configuration variables rop.* (e.g., rop.cache) are renamed to gadget.* (e.g., gadget.cache)
   • !ESIL-based search command /E is removed in favor of RzIL
   • !The on-disk project format version is bumped from 19 to 25, requiring migration for older projects
   • !Legacy RzAsm struct is dropped from the public API; consumers must use new RzArch APIs
2. advisory CVE-2026-22780 Feb 1, 2026 · issue 128
   • CVE-2026-22780: Heap overflow on mach0_chained_fixups.c (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.4, affects < 0.8.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
3. v0.8.0 Apr 27, 2025 · release notes

   Rizin v0.8.0 adds RzIL uplifting for 5 new architectures, 3 new ISAs, multithreaded search, and a batch of new commands.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.8.0 https://github.com/rizinorg/rizin.git
   # already have the repo? check out this version:
   $ git checkout v0.8.0

   └──▷ TRY IT
   Run entropy search across a firmware image to locate compressed or encrypted regions.
   copy

   $ rizin -qc '/ce' <firmware.bin>

   • Adds RzIL uplifting support for MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware., PIC, MSP430, Xtensa, and Hexagon architectures; improves Tricore to cover all floating-point instructions.
   • Adds three new architectures: DEC Alpha, nanoMIPS, and LoongArch.
   • New /cm command searches for cryptographic material in binaries.
   • New /ce and /cef commands perform entropy-based searches.
   • New /z command unifies string search with support for Unicode 16, regex, and multiple encodings.

   +15 more show less

   • Search commands (strings, bytes, cryptographic material) now dispatch work across threads, improving performance on large files.
   • New dcco command continues execution until a call instruction.
   • New aezsue command steps until PC equals a given address and outputs RzIL VM state changes.
   • New aLc command lists features and CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. for an RzArch plugin; rz-asm -m provides the same from the command line.
   • New izx command lists strings referenced from other locations in the binary.
   • New fdt command prints extended information about a flag.
   • New dbtt command prints breakpoint information in table mode.
   • Adds rz-find -E flag to execute a command on every match found.
   • Adds MS-DOS and Win32 timestamp conversion to rz-ax.
   • Adds linker version to rz-bin -I output.
   • Adds parsing support for PE relocations.
   • Adds support for Python 3.11–3.13 bytecode versions.
   • Shows scrolling progress as a percentage in visual interfaces such as Vv.
   • Analysis now checks for jumps to function preludes by default.
   • ESIL is marked deprecated and will be removed in the next release.

   20 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The RAP protocol has been removed.
   • !NIOS-II architecture support has been removed.
   • !The fb command has been removed.
   • !The dta command has been removed.
   • !The /w command has been removed (use /z instead).
   • !The /!, /b, /f, /+, /cd, /ca, /cr search modifier commands have been removed.
   • !The obr command has been removed.
   • !The rizin -Q flag has been removed.
   • !The avg command is renamed to avgl.
   • !The / command is renamed to /z.
   • !The /e command is renamed to either /z or /xr.
   • !Config variable str.search.encoding is renamed to str.encoding.
   • !Config variable str.search.max_threads is renamed to search.max_threads.
   • !Config variable str.search.raw_alignment is renamed to search.str.raw_alignment.
   • !Config variable str.search.min_length is renamed to search.str.min_length.
   • !Config variable str.search.buffer_size is renamed to search.str.max_length.
   • !Config variable str.search.max_region_size is renamed to search.str.max_region_size.
   • !Config variable str.search.check_ascii_freq is renamed to search.str.check_ascii_freq.
   • !Config variable str.search.max_uni_blocks has been removed.
   • !A new dependency on the SoftFloat3 library is required for RzFloat and RzIL floating-point operations.
4. advisory CVE-2024-53256 Dec 21, 2024 · issue 128
   • CVE-2024-53256: Command injectionCommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. via RzBinInfo bclass due legacy code (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.3, affects < 0.7.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
5. v0.7.0 Feb 24, 2024 · release notes

   Rizin v0.7.0 adds RzIL uplifting for new arches, debuginfod support, and a config overhaul

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.7.0 https://github.com/rizinorg/rizin.git
   # already have the repo? check out this version:
   $ git checkout v0.7.0

   └──▷ TRY IT
   List RzIL instructions for the current function
   copy

   $ plf

   Download debug info from a server for binary analysis
   copy

   $ rz-bin -dd ./binary

   • plf command to list all RzIL instructions in the current function
   • agF and agCi commands to print control flow graphs (CFGCFGControl Flow Graph — a directed graph representing all paths execution can take through a program, used by analysis tools to reason about reachability, dead code, and vulnerability patterns without running the code. and interprocedural CFG)
   • avgx command to print references to a global variable
   • afvll and afvlt extensions for afvl to output long and table formats with DWARF storage info
   • pfs <dot>format syntax to recognize named formats in pf commands

   +8 more show less

   • pfn command to define, list, or print definitions of named formats
   • pfw command (instead of pf/pf.) to write data using named formats
   • New rz-bin -dd flag to download DWARF from a debuginfod server
   • str.search.reload, str.search.max_threads, and other new str.search.* config keys
   • bin.dbginfo.debuginfod and bin.dbginfo.debuginfod_urls config keys for debuginfod integration
   • RzIL uplifting support for Infineon Tricore, NEC V810, NEC(Renesas) V850, GameBoy, and x86 floating point (experimental)
   • New architectures: Renesas RX, Renesas RL78, Renesas RH850
   • Support for SM3, SM4 hash/encryption algorithms

   13 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !bin.maxstr option removed
   • !scr.rainbow option removed
   • !bin.minstr renamed to str.search.min_length
   • !bin.maxstrbuf renamed to str.search.buffer_size
   • !bin.str.enc renamed to str.search.encoding
   • !Capstone 3 (and below) support removed, defaulting to Capstone 6
6. v0.6.3 Oct 18, 2023 · release notes

   Rizin v0.6.3 adds K mnemonic to x86 assembler and improves env command.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.3 https://github.com/rizinorg/rizin.git
   # already have the repo? check out this version:
   $ git checkout v0.6.3

   • Implement add r#, K in the x86 assembler
   • Improvements in w? help and env command

   2 details in Everything

7. advisory CVE-2023-40022 Aug 19, 2023 · issue 128
   • CVE-2023-40022: Integer Overflow in C++ demangler logic (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.3, affects <=0.6.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
8. v0.6.1 Aug 19, 2023 · release notes

   Adds the $$ command in Rizin v0.6.1 for managing local variables via $varname syntax.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.1 https://github.com/rizinorg/rizin.git
   # already have the repo? check out this version:
   $ git checkout v0.6.1

   └──▷ TRY IT
   Manage local state in a Rizin session using variable references.
   copy

   $ %$ var1=42
   %$ var2=var1 + 10

9. v0.6.0 Aug 5, 2023 · release notes

   Rizin v0.6.0 adds RzIL commands aoi/agI, class analysis aaC, entropy visualization p=r, and Borland C++/Rust demangling.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.6.0 https://github.com/rizinorg/rizin.git
   # already have the repo? check out this version:
   $ git checkout v0.6.0

   • Adds aoi command to show RzIL in text form
   • Adds agI command to show RzIL in graph form
   • Adds aaC command to run classes analysis
   • Adds p=r command to display entropy edges
   • Adds interactive variants of p== commands by appending the v suffix

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !tl commands and typelinks are removed; use avg global variables instead.
   • !asm.dwarf.* options were moved to asm.debuginfo.*.
   • !Evaluation commands previously under ? subcommands are now in % space.
10. advisory CVE-2023-27590 Mar 14, 2023 · issue 128
    • CVE-2023-27590: Stack-based buffer overflow when parsing GDB registers profile files (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <=v0.5.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
11. v0.5.0 Feb 18, 2023 · release notes

    Rizin v0.5.0 adds stack pointer visualization, stack-based variable addressing, and new Eco color themes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/rizinorg/rizin.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    └──▷ USE IT
    Switch to the new Nord color theme for analysis sessions
    shell copy

    rizin <binary> -c 'eco nord'

    • asm.stackptr variable enables visualization of absolute stack pointer value and instruction delta in disassembly
    • New color themes: Nord (eco nord) and Mars (eco mars)

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !zignatures are removed; use F[al] instead of aaF[l] and F[sdc] instead of zf[sdc]
12. advisory CVE-2022-36043 Sep 2, 2022 · issue 128
    • CVE-2022-36043: Double Free in bobj.c when using QNX binary plugin (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <=0.4.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
13. advisory CVE-2022-36040 Sep 2, 2022 · issue 128
    • CVE-2022-36040: Out-of-bounds Write in pyc/marshal.c (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <=0.4.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
14. v0.4.0 Jun 25, 2022 · release notes

    Rizin v0.4.0 adds FLIRT signature creation/usage, automated firmware base address detection via B command, and the new RzIL intermediate language.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/rizinorg/rizin.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    └──▷ USE IT
    Generate FLIRT signatures from a debug binary and save them as .pat for use in other sessions.
    shell copy

    $ rz-sign -aa -o /tmp/curl.pat curl-example-dbg

    Identify likely base addresses for a raw firmware binary (e.g. STM32) without proper headers.
    shell copy

    $ rizin -e log.level=3 -qc B stm32f103-dapboot-v1.20-bluepill.bin

    Lift ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. assembly to the new RzIL intermediate language for semantic analysis or SMT solving.
    shell copy

    $ rz-asm -a arm -b 32 -I 1233a0e1

    • rz-sign subcommand can now create .sig and .pat FLIRT files from analyzed binaries
    • zfc Rizin command creates FLIRT signature files (.sig, .pat) during analysis sessions
    • FLIRT signatures are automatically applied when placed in the installation prefix's sigdb directory or via e flirt.sigdb.path=<path> config key
    • New B command identifies candidate base addresses for raw firmware binaries using pointer and string heuristics
    • Automatic golang function and string recovery for x86/x64/PowerPC/MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware./ARM/RISC-V adds the sym.go.* flag namespace

    +3 more show less

    • RzIL intermediate language is now available, enabling ARM32, ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead., AVR, and 6502 code lifting via rz-asm -I
    • rz-libyara is available as a RzCore plugin for parsing and creating YARA rules
    • -Duse_gpl=false build option allows disabling GPL code during Rizin compilation

    8 details in Everything

15. v0.3.3 Jan 7, 2022 · release notes

    rz-diff gains -e flag to set config variables; adds cleanup dist script

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.3 https://github.com/rizinorg/rizin.git
    # already have the repo? check out this version:
    $ git checkout v0.3.3

    └──▷ USE IT
    Pass a specific config variable to rz-diff without modifying global defaults
    shell copy

    rz-diff -e analysis.jmp.cref=1 bin1 bin2

16. advisory CVE-2021-43814 Dec 13, 2021 · issue 128
    • CVE-2021-43814: Heap-based OOB write when parsing dwarf DIE info in Rizin (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <=0.3.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
17. v0.3.1 Nov 17, 2021 · release notes

    Rizin v0.3.1 adds it output entropy values, rz_core_cmd_new API, and rz_run pid option

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.1 https://github.com/rizinorg/rizin.git
    # already have the repo? check out this version:
    $ git checkout v0.3.1

    └──▷ TRY IT
    Run a command with rz-run using a boolean pid flag to control process execution.
    copy

    $ rz-run --pid --pidfile /tmp/rz.pid <your_command>

    Use the new C API to initialize TSLanguage outside the core context.
    c copy

    rz_core_cmd_new()

    • Adds pid and pidfile options to rz-run man page, making the pid option a boolean flag
    • Adds new rz_core_cmd_new() API for moving TSLanguage initialization

    2 details in Everything

18. v0.3.0 Sep 25, 2021 · release notes

    Rizin v0.3.0 adds RzType module, rizin = for memory files, global vars via avg, -H hex diff, and new ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. parsing logic

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/rizinorg/rizin.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    • rz-diff now has a hexadecimal view via the -H option.
    • Rizin starts without opening a file by default; = opens a malloc-ed file in memory.
    • Initial support for multidex APK files is added.

    3 details in Everything

19. v0.2.0 Apr 8, 2021 · release notes

    Rizin v0.2.0 adds afb-* block deletion, Lua/Python bytecode plugins, and newshell syntax.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.2.0 https://github.com/rizinorg/rizin.git
    # already have the repo? check out this version:
    $ git checkout v0.2.0

    • Adds afb-* command to delete all basic blocks of a function
    • Implements Lua 5.4 bytecode disassembly/analysis/binary plugins (luac)
    • Enables Python bytecode (pyc) support and covered by tests

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The o: command is renamed to oC to avoid :
    • !The s: command is renamed to spad to avoid :
    • !The =: and =&: commands are renamed to =r and =&r to avoid :
    • !The sH commands are renamed to sh
    • !The tfc command is removed; use tf instead, new subcommand tfk added
    • !The tna and tnn commands are removed
    • !The join command is removed
    • !The head command is removed
    • !The less command is removed; use ls directly
    • !The touch command is removed
    • !The axF command is removed
    • !Whitespace Asm+Analysis Plugins (ws) are removed
20. v0.1.0 Jan 22, 2021 · release notes

    Rizin v0.1.0 first release introduces Projects, newshell parser, and many new commands and configuration options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.0 https://github.com/rizinorg/rizin.git
    # already have the repo? check out this version:
    $ git checkout v0.1.0

    └──▷ USE IT
    Enable autocompletion for commands converted to the new newshell parser.
    shell copy

    e cfg.newshell.autocompletion=true

    • Introduces Projects implementation for saving and loading reverse engineering context.
    • Adds opr, opn, and opp commands to open next and previous files in a project sequence.
    • Adds Lp command to list parser plugins.
    • Adds om.j command variant for JSON output of map information at the current offset.
    • Adds aecb command to continue backwards in ESIL emulation mode.

    +9 more show less

    • Adds -I option to rz-ax to convert from/to LONG and IP address formats.
    • Introduces cfg.newshell.autocompletion config variable to enable/disable autocompletion based on newshell data.
    • Introduces cfg.seek.silent config variable to prevent seek commands from saving movements in seek history.
    • Introduces cfg.seek.histsize config variable to set the maximum size of the seek history.
    • Adds analysis.cc and analysis.syscc configuration variables to set current calling and syscall conventions.
    • Adds zign.match.* configuration variables, replacing previous zign.{graph,bytes,offset,refs,hash,types} keys.
    • Adds dbg.create_new_console config variable to create a new console window for the debugee on debug start.
    • Adds cfg.json.* variables for JSON encoding settings.
    • Adds asm.hint.call.indirect config variable to make indirect calls follow the target address.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !s- (seek undo) is renamed to sHu.
    • !s+ (seek redo) is renamed to sHr.
    • !sl (seek line) command is removed.
    • !prl command is removed.
    • !e?, e*, and ej help/eval commands are removed in favor of el (eval list).
    • !e, command is removed; use e with multiple arguments instead.
    • !ev and evj commands are removed in favor of ell and elJ.
    • !ed config file command is removed.
    • !The s command no longer accepts relative syntax like +10; use sd for seek delta.
    • !Commands converted to newshell no longer accept syntax without a space between command name and argument (e.g., s+3 won't work).
    • !asm.filter config variable is renamed to asm.sub.names.
    • !zign.graph, zign.bytes, zign.offset, zign.refs, zign.hash, and zign.types config variables are moved to zign.match.*.
    • !http.sync, http.ui, http.sandbox, scr.tts, scr.demo, file.desc, file.md5, file.location, dbg.libc.dbglib, cmd.xterm, lines.*, cmd.pdc, and cmd.log config variables are removed.
    • !cfg.r2wars mode/config is removed.
    • !pdc pseudo decompiler command is removed.