With scr.interactive on, P- asks "Confirm project deletion? (Y/n)" on the
console (r_core_project_delete) and waits. A DELETE FROM projects therefore
blocked the statement, and over =h the request with it. The DELETE is the
confirmation: switch scr.interactive off around P- and restore it.
The libr full scan walked each analysed function's own refs, so it missed
references whose source lies outside every function (a call past a
function's last analysed block). WHERE to_addr = X and WHERE from_addr = X
read radare2's global xref store, so the plans disagreed: on a real 64-bit
PE, to_addr = X returned 157 rows and the filtered scan 148.
Scan the same store (r_anal_refs_get(anal, UT64_MAX), what axj lists) and
resolve from_func per row with the same owner lookup the pushdowns use. A
source address inside two functions is now one row, not one per function.
- r2 -i <plugin> fails on Windows with radare2 6.2.2, which reads a .dll
given to -i as a script ('Invalid l subcommand'). The examples now load
it with -c 'L <path>', which works on every platform
- libxsql is pinned to a release tag (v1.0.21) in all three builds, no
longer 'a current libxsql'
- the core library links radare2's r_util since r_name_check, so it is no
longer backend-neutral
- 'may lag; see below' pointed at nothing
This series needs libxsql 1.0.21 (exact_int64 / exact_text /
Int64KeyRange). All three build paths fetched libxsql main, so a later
libxsql change could break a build of this exact source. CMake's
GIT_TAG, the meson wrap's revision and the Makefile's clone now name the
release tag; bump them together.
Comments pointed at research notes, named by directory and file, that a
reader of this repository cannot open. The measurements are kept; only
the pointers go.
SQLite hands a virtual table's constraint values over with no column
affinity, and every plan here sets omit=1, so it never re-checks a row.
Reading them with as_int64()/as_c_str() answered wrongly: `addr = 4096.5`
looked up 4096, `pattern = NULL` searched for "", a blob was read as its
bytes. The factories of byte_search, read_cstr, assemble, search_asm,
rop_gadgets, demangle and the instructions start_addr/count window now use
libxsql 1.0.21's exact_int64 / exact_text / Int64KeyRange: a value nothing
can equal yields no rows and issues no command, while '4096' and 4096.0
still mean 4096.
byte_search's window used -1 for "unset", so an address at or above 2^63
(a kernel image; negative in the int64 addr column) silently disabled the
bound. It is now an Int64KeyRange in the column's own signed order.
INSERT values get no affinity either, so `INSERT INTO comments(addr, ...)
VALUES ('main', ...)` wrote at address 0. Integer INSERT arguments of
comments, flags, bookmarks, funcs, patches and io_maps, and the bytes
UPDATE value, are now taken exactly or refused.
On radare2 6.2 a join or correlated subquery onto funcs timed out: every
probe rebuilt the whole table, and r_anal_function_cost (which decodes
every instruction) was ~70% of each build.
- funcs: filter_eq on addr -> func_at (libr: r_anal_get_function_at;
r2pipe: afij @ X, refusing an address inside a function), rowid = addr,
row_lookup, and key-based mutation snapshots so a multi-row
UPDATE/DELETE stays correct with the filter in place
- libr: funcs_scan and func_at share fill_func_row, and the pipe path's
aflj and afij rows share func_row_from_json, so a looked-up row cannot
drift from a scanned one
- cost is computed only when the query reads that column
Pairs with libxsql 1.0.21, which builds a query-scoped table once per
cursor instead of once per xFilter.
- libr data-dir probe: an explicit prefix is probed as given. radare2
6.2's r_sys_prefix(arg) returns the executable-derived prefix instead
of arg, so the probe checked the wrong directory and types, syscalls
and calling conventions came back nearly empty
- relocs: io->cachemode is a bool, so 'cachemode & R_PERM_W' was always
0 and io.cache was always switched on; test the bool
- bininfo.file is SQL NULL when radare2 reports no file, not ''
- CMake: the core library's table sources now include <r_util.h> for
r_name_check, but the r2xsql target had no radare2 include path or
library, so eight files failed with 'r_util.h: No such file'. Link it
to Radare2::r_util (the Makefile and meson builds already pass
radare2's flags to every source)
- r_io_desc_info replaced r_io_desc_is_dbg in radare2 38e23d0018 (ABI
144); 6.2.2, which CI pins, is ABI 142. Pick by R2_ABIVERSION
- restore json_utils::r2_quote, which the demangle commit removed but
the types table's td fallback still calls
- the name-rule error messages describe r_name_check's rule
r2xsql exposes a radare2 analysis session as live SQL virtual tables: every
query re-issues the JSON form of the relevant r2 command (aflj, izj, axtj, ...)
against the current core, so results are never a stale dump. Reads are SELECTs;
annotation is ordinary SQL writes -- rename functions, set prototypes, comments,
flags, locals, types, bookmarks, patches -- and work saves back through
radare2's native project format.
Two interchangeable flavors over one SQL surface:
- r2xsql portable; drives radare2 over r2pipe, needs only the radare2
binary on PATH at runtime. Always built.
- r2xsql-full in-process (libr) build; also ships core_r2xsql, an in-r2
plugin that adds the `sql` command inside radare2. ABI-locked
to the radare2 it was built against.
~48 tables and 13 views span functions, blocks, instructions, xrefs, strings,
imports/exports, sections/segments, flags, comments, types, classes, relocs,
registers, syscalls, calling conventions, ROP gadgets, ESIL, and decompilation.
An always-on HTTP REST endpoint and an MCP server expose the same surface to
tooling and agents.
Build with CMake (both flavors, MCP, tests), or -- for the plugin alone -- a
radare2-native Makefile / meson build (plugin paths from `r2 -H`, radare2 via
pkg-config r_core). Agent skills for driving r2xsql live in
radareorg/radare2-skills.
Developed by Elias Bachaalany, in collaboration with the radare2 project (radareorg).
Elias Bachaalany