Release 1.1.2

.github/workflows/ci.yml

@@ -93,8 +93,11 @@ jobs:
         shell: bash
         run: |
           mkdir -p release
-          cp -rf src/r2ai.dll src/r2ai.exe src/r2ai src/r2ai.dylib src/r2ai.so release/ || true
-          cp -rf src/build/r2ai src/build/r2ai.dylib src/build/r2ai.so release/ || true
+          # Collect common binary artefact names produced by Make/Meson
+          # Include both "r2ai.*" and "libr2ai.*" variants for DLL/dylib/so on all platforms.
+          find src -type f \( -iname "r2ai.dll" -o -iname "libr2ai.dll" -o -iname "r2ai.dylib" -o -iname "libr2ai.dylib" -o -iname "r2ai.so" -o -iname "libr2ai.so" -o -iname "r2ai.exe" \) -exec cp -f {} release/ \; || true
+          # Also check top-level build output directories
+          find . -maxdepth 3 -type f \( -iname "r2ai.dll" -o -iname "libr2ai.dll" -o -iname "r2ai.dylib" -o -iname "libr2ai.dylib" -o -iname "r2ai.so" -o -iname "libr2ai.so" -o -iname "r2ai.exe" \) -exec cp -f {} release/ \; || true
           cp -f decai/decai.r2.js release/ || true
           if command -v zip >/dev/null 2>&1; then
             zip -j "release/r2ai-${{ github.ref_name }}-${{ matrix.os }}-${{ matrix.build_system }}.zip" release/*

README.md

@@ -89,8 +89,11 @@ r2ai -e max_tokens=64000
 
 * There's [a chapter](https://book.rada.re/plugins/r2ai.html) in the official r2book
 * Cryptax on [lmstudio+gptoss](https://cryptax.medium.com/r2ai-with-lmstudio-and-gpt-oss-08efa5ea2476) blog post
-* Malware analysis [with r2ai](https://github.com/cryptax/talks/blob/master/BSidesKristiansand-2025/r2ai.pdf) by Cryptax
+* Malware analysis [with r2ai](https://arxiv.org/pdf/2504.07574) by Cryptax and Daniel Nakov
+* Analysis of [Linux/Trigona ransomware](https://cryptax.medium.com/linux-trigona-analysis-with-r2ai-3e2bd1815e52),  [Linux/Prometei botnet](https://cryptax.medium.com/reversing-a-prometei-botnet-binary-with-r2-and-ai-part-one-3cdb3dc6ffab) and [W32/SkyAI](https://cryptax.medium.com/w32-skyai-uses-ai-so-do-i-d33f04d63534with) with r2ai
 
 ## Videos
 
 - https://infosec.exchange/@radareorg/111946255058894583
+- [De-obfuscation of malware Linux/Ladvix](https://asciinema.org/a/724126)
+- [Analysis of the /fast option inside Linux/Trigona ransomware](https://asciinema.org/a/pBPEaJhp6cunWSKFpBUDTgPt4)

VERSION

@@ -1 +1 @@
-1.1.1
+1.1.2

decai/decai.r2.js

@@ -765,13 +765,20 @@ Use radare2 to resolve user requests.
 
       try {
         const res = http.post(url, [], JSON.stringify(payload));
-        return utils.filterResponse(res.message.content);
-      } catch (e) {
+        if (res.error) {
+          throw new Error(res.error);
+        }
+        if (res.message && res.message.content) {
+          return utils.filterResponse(res.message.content);
+        }
+        throw new Error(JSON.stringify(res));
         if (res.error && res.error.indexOf("try pulling")) {
           const modelName = res.error.split(/"/g)[1];
           res.error += "\n!ollama run " + modelName;
         }
-        return "ERROR: " + (res.error || e.message);
+      } catch (e) {
+        console.error(e.stack);
+        return "ERROR: " + e.message;
       }
     },
 

src/Makefile

@@ -59,17 +59,25 @@ indent:
 
 user-install: user-uninstall
 	mkdir -p $(R2USRPLUGDIR)
-	cp -f r2ai$(DOTLIB) $(R2USRPLUGDIR)
-	cp -f r2ai$(DOTEXE) $(R2BINDIR)
+	mkdir -p $(R2BINDIR)
+	$(MAKE) user-uninstall
+	cp -f r2ai$(DOTLIB) $(R2USRPLUGDIR)/r2ai$(DOTLIB)
+	cp -f r2ai$(DOTEXE) $(R2BINDIR)/r2ai$(DOTEXE)
 
 user-uninstall:
 	rm -f $(R2USRPLUGDIR)/r2ai$(DOTLIB)
+	rm -f $(R2BINDIR)/r2ai$(DOTEXE)
 
 install:
-	cp -f r2ai$(DOTLIB) $(R2SYSPLUGDIR)
+	$(MAKE) uninstall
+	mkdir -p $(R2USRPLUGDIR)
+	mkdir -p $(R2BINDIR)
+	cp -f r2ai$(DOTLIB) $(R2SYSPLUGDIR)/r2ai$(DOTLIB)
+	cp -f r2ai$(DOTEXE) $(R2BINDIR)/r2ai$(DOTEXE)
 
 uninstall:
 	rm -f $(R2SYSPLUGDIR)/r2ai$(DOTLIB)
+	rm -f $(R2BINDIR)/r2ai$(DOTEXE)
 
 r2check:
 	@r2 -qcq --

src/auto.c

@@ -233,7 +233,7 @@ R_API void process_messages(RCore *core, R2AI_Messages *messages, const char *sy
 			// Create a tool call response message
 			R2AI_Message tool_response = {
 				.role = "tool",
-				.tool_call_id = tool_call->id,
+				.tool_call_id = strdup (tool_call->id),
 				.content = cmd_output
 			};
 

src/messages.c

@@ -15,7 +15,7 @@ R_API void r2ai_message_free(R2AI_Message *msg) {
 	}
 
 	free (msg->role);
-	free (msg->content);
+	free ((void *)msg->content); // maybe double free
 	free (msg->reasoning_content);
 	free (msg->tool_call_id);
 

src/openai.c

@@ -161,12 +161,9 @@ R_IPI R2AI_ChatResponse *r2ai_openai(RCore *core, R2AIArgs args) {
 		headers[1] = auth_header;
 	}
 
-	const char *openai_url;
-	if (strcmp (args.provider, "ollama") == 0) {
-		openai_url = r_str_newf ("%s/chat", base_url);
-	} else {
-		openai_url = r_str_newf ("%s/chat/completions", base_url);
-	}
+	const char *urlfmt = strcmp (args.provider, "ollama")
+		? "%s/chat/completions" : "%s/chat";
+	char *openai_url = r_str_newf (urlfmt, base_url);
 	R_LOG_DEBUG ("OpenAI URL: %s", openai_url);
 
 	// Create a messages JSON object, either from input messages or from content
@@ -274,6 +271,7 @@ R_IPI R2AI_ChatResponse *r2ai_openai(RCore *core, R2AIArgs args) {
 	int code = 0;
 	res = r2ai_http_post (core, openai_url, headers, complete_json, &code, NULL);
 	free (complete_json);
+	free (openai_url);
 
 	if (code != 200) {
 		R_LOG_ERROR ("OpenAI API error %d", code);

src/r2ai.c

@@ -1032,7 +1032,7 @@ RCorePlugin r_core_plugin_r2ai_client = {
 		.name = "r2ai",
 		.desc = "r2ai plugin in plain C",
 		.author = "pancake",
-		.version = "1.1.1",
+		.version = "1.1.2",
 		.license = "MIT",
 	},
 	.init = r2ai_init,

src/r2ai.h

@@ -40,14 +40,14 @@ typedef struct {
 } R2AI_ToolCall;
 
 typedef struct {
-	const char *type;
-	const char *id;
-	const char *name;
-	const char *input;
-	const char *data;
-	const char *thinking;
-	const char *signature;
-	const char *text;
+	char *type;
+	char *id;
+	char *name;
+	char *input;
+	char *data;
+	char *thinking;
+	char *signature;
+	char *text;
 } R2AI_ContentBlock;
 
 typedef struct {
@@ -56,12 +56,12 @@ typedef struct {
 } R2AI_ContentBlocks;
 
 typedef struct {
-	const char *role;
+	char *role;
 	const char *content;
-	const char *reasoning_content;
-	const R2AI_ContentBlocks *content_blocks;
-	const char *tool_call_id;
-	const R2AI_ToolCall *tool_calls;
+	char *reasoning_content;
+	R2AI_ContentBlocks *content_blocks;
+	char *tool_call_id;
+	R2AI_ToolCall *tool_calls;
 	int n_tool_calls;
 } R2AI_Message;