Download Binary Ninja v6.0.10601 Personal for Windows

6.0.10601 (2026-09-03)

Major Features
- Performance and Memory: up to 2.16x faster analysis and up to 55% less peak memory
- Analysis Cache: better reuse of cached function analysis
- Database Saving: lower memory use, faster saves, and a fix for file size creep
- MCP: first-party MCP server, both a GUI server over HTTP and a headless binaryninja_mcp stdio server
- Binary Similarity: pluggable binary comparison platform with BinDiff and WARP providers (Ultimate only)
- TMS320C6x: new architecture, bringing the first-party architecture count to 19
- Multiple Global Pointers: track and override more than one global pointer register
- Improved BASE: new sampling mode for much faster base address detection
- Calling Convention Refactor: support for structure parameters and return values, plus Go and Pascal calling conventions
- HLIL_STRUCT_INITIALIZE: new IL instruction and initializer expressions for clean structure initialization
- Type Fragments: bitwise slices of a source type tracked through integer-like storage, rendered as __frag
- Python 3.13: bundled Python on all platforms, now including x86-64 and AArch64 Linux
- Scripting Console: parameter-level hints instead of just the prototype
- Extension Manager: the Plugin Manager rebuilt, with version switching, per-platform downloads, dependency resolution, offline caching, and sorting
- New User Wizard: three-step first-run setup with Ghidra-Like and IDA-Like presets
- Debugger: new Memory Map sidebar, mirrored memory regions, and on-demand symbol loading from the debug adapter
- New in Free: armv8 (AArch64) decompilation, the MCP server, and a Linux ARM64 build
- Packaging: collaboration is now a per-seat Ultimate add-on and Enterprise Servers are managed as server deployments in the portal

Open Source Contributors: appleflyerv3, ArcaneNibble, bloombit-dev, ChrisKader, grant-h, haileys, jonpalmisc, jrozner, owah, SmoothHacker, utkonos, xitska, endeavor

Analysis / Core
- Feature: Added abs, min, and max IL instructions
- Feature: Added bswap, popcnt, clz, ctz, cls and rbit instructions
- Feature: Added an SSA instruction for partial variable writes in HLIL
- Feature: Added support for loading local stack variables from PDB debug info
- Feature: Added type convergence detection to prevent non-converging type inference
- Improvement: Added wmain to analysis.mainFunctionDetection.mainSymbols so navigate-to-main also finds wmain
- Improvement: Added a fast-fail to the Itanium RTTI parser for large unbacked sections
- Improvement: Added an MLIL analysis pass to better separate partial writes when the upper bits are unused
- Improvement: Capped recursive function pointer type growth to a deterministic, parameter less spelling
- Improvement: Improved PDB import to collect locals and parameters from blocks contained in a FrameProcedure
- Improvement: Improved function inlining to handle nonstandard return registers
- Improvement: Improved recovery of sp-based locals during PDB import
- Improvement: Improved the accuracy of the pvs tooltip across all ILs
- Improvement: Introduced BiDiReferenceMap and used it for the code, data and type reference indices, unifying their previously separate forward and reverse halves
- Improvement: Preserved outlined strings with inferred typedefs
- Improvement: Refined type convergence detectors
- Improvement: Simplified clz(x) u>> log2(W) to x == 0 in HLIL
- Improvement: Used variable SSA instead of memory SSA for direct access to array variables or structure fields in HLIL
- Improvement: Wired structured demangler simplification for stdlib templates through the core
- Fix: Fixed HLIL SSA loop condition phi expression mappings
- Fix: Fixed HLIL SSA memory versioning for aliased partial writes and initializers
- Fix: Fixed HLIL SSA missing a memory version increment for nested structures written through a pointer
- Fix: Fixed HLIL null comparisons dropping pointer offsets
- Fix: Fixed IL for functions that referenced an address before a data variable was defined there, requiring re-analysis when the variable's type changed
- Fix: Fixed LLIL SSA to preserve register stack outputs
- Fix: Fixed MLIL stack offsets not being reloaded correctly through local variables
- Fix: Fixed PDB import to only adjust stack-pointer-relative locals on x86_64
- Fix: Fixed original_filename purge option not clearing identifying information from the display_name and virtual path fields
- Fix: Fixed case-insensitive search not matching strings with different casing
- Fix: Fixed custom string types displaying non-ASCII characters as escaped UTF bytes instead of the decoded text
- Fix: Fixed demangling of certain mangled Microsoft x86_64 symbols that were previously left unresolved
- Fix: Fixed incorrect HLIL translation of pointer arithmetic involving lea that produced bogus comparisons like this != -0x10
- Fix: Fixed malformed HLIL structure accessor generated when applying a structure type to a variable computed with consecutive adds instructions
- Fix: Fixed scattered return values not being combined correctly in MLIL/HLIL when a function's return type is wider than a single return register
- Fix: Fixed Find in HLIL missing matches when HLIL line addresses are non-monotonic
- Fix: Fixed GetTypeForAccess returning incorrect fragments for struct accesses spanning multiple fields
- Fix: Fixed a crash caused by deep mutual recursion between DefaultLiftFunction and CheckForInlinedCall when lifting deeply nested inlined calls
- Fix: Fixed a deadlock causing UI freezes when analysis was running while a large number of types were being created
- Fix: Fixed a stack overflow crash in the GNU3/MSVC demanglers when demangling deeply recursive crafted names
- Fix: Fixed a crash caused by cycles in the GNU3 demangler
- Fix: Fixed a crash from malformed LLIL indirect branch targets
- Fix: Fixed a crash from unbounded recursion during function inlining when two functions directly call each other
- Fix: Fixed a few copy assignment operators to correctly handle self-assignment
- Fix: Fixed a potential divide by zero in alignment checks
- Fix: Fixed a race condition in AddDataReferences that could crash due to a missing lock
- Fix: Fixed a use-after-free in the GNU3 demangler when expanding a template parameter pack
- Fix: Fixed a use-after-free involving custom function architecture context
- Fix: Fixed a use-after-free when a function was added to a component and its symbol was retired in the same batch
- Fix: Fixed addition of signed range PossibleValueSets
- Fix: Fixed an assertion failure caused by using a variable ID where a variable index was expected
- Fix: Fixed an out-of-range crash in symbol name truncation used by the disassembly text renderer
- Fix: Fixed calculation of struct bit field member offsets during PDB import
- Fix: Fixed calculation of addition of two UnsignedRange values when both start and end overflow
- Fix: Fixed calculation of the addition of two identical PVS ranges
- Fix: Fixed crashes from a null BinaryViewRef when GetViewOfType raced with view removal
- Fix: Fixed creation of Variables that could not be represented in their compact internal representation
- Fix: Fixed creation of void data variables at call targets that had not yet been typed
- Fix: Fixed demangling of symbols in binaries built with MSVC's /d2FH4 flag
- Fix: Fixed detection of long strings
- Fix: Fixed function type propagation to callers when a committed type change only affected confidence
- Fix: Fixed handling of demangled results with no type information
- Fix: Fixed incoming but resolved partial accesses being incorrectly treated as parameters
- Fix: Fixed indirect stack offset loads in MLIL
- Fix: Fixed invalid IL instruction access in MLIL_STORE_STRUCT_SSA
- Fix: Fixed missing symbol name for __chkstk and other compiler-inserted functions in PE binaries
- Fix: Fixed non-deterministic lifted IL for no-return tail calls
- Fix: Fixed recursive function pointer detection misclassifying refined callbacks as growth
- Fix: Fixed removal of composite parameter variables when they appeared unused
- Fix: Fixed speculative data variable widths depending on function analysis order when two functions access the same address with different widths
- Fix: Fixed stack adjustment analysis to treat an empty value as 0
- Fix: Fixed stack propagation through pointer typedefs
- Fix: Fixed the demangler not creating types referenced from demangled names that don't already exist
- Fix: Fixed the default location not updating when changing the type of a return value
- Fix: Fixed the string-finding analysis pass overwriting existing typed data variables
- Fix: Fixed two bugs caused by function return values being unintentionally discarded
- Fix: Fixed type propagation dropping typedefs during normalization
- Fix: Marked the err family of libc functions as noreturn in the type library, preventing bad disassembly after calls to them

Performance
- Improvement: Improved performance of loading ELF binaries with many sections not mapped into the address space
- Improvement: Improved component tree performance
- Improvement: Improved performance of IsELFDataRelocation for armv7 by using a switch instead of std::map
- Improvement: Improved performance of string annotation detection by skipping constants that aren't mapped addresses
- Improvement: Improved performance of string detection by eliminating unnecessary allocations
- Improvement: Improved symbol throughput by removing non-demangling SymbolQueue consumers
- Improvement: Used a custom allocator for C++ containers in the free edition
- Fix: Cached log row size hints to keep the log view responsive under heavy logging
- Fix: Fixed memory leaks in the Python and Rust APIs
- Fix: Fixed a memory leak of DataRenderer instances
- Fix: Fixed several crashes that occurred when loading a database under low free memory conditions

UI
- Feature: Added Create Struct Member at Offset to the Type View
- Feature: Added a hover preview for extern symbols that includes type information
- Feature: Added a context menu action to remove tags
- Feature: Added a description column to the Project Browser
- Feature: Added a function signature table to the edit function dialog
- Feature: Added a new UI for array-style settings
- Feature: Added a setting to control outline visibility
- Feature: Added an argument assist popup when typing function calls
- Feature: Added an option to disable Snippets
- Feature: Added optional headers to sidebar widgets
- Feature: Added optional size hints for splitters
- Feature: Added support for custom data in flow graphs
- Feature: Added support for diagonal scrolling in graph view
- Feature: Added support for extensible filter actions in the UI
- Feature: Added the ability to change the scrollbar width
- Feature: Grouped extern symbols by originating library in Linear View for Mach-O and PE binaries
- Feature: Open sourced all default themes and added an alpha channel to colors in .bntheme files
- Improvement: Accepted a lone ? as a full-byte wildcard in FlexHex search
- Improvement: Added wmain to the list of entry point names recognized by the navigate to main setting
- Improvement: Added a helper for background sorting and filtering of flat UI models
- Improvement: Added horizontal scrolling to the History View
- Improvement: Added horizontal scrolling to the Stack View
- Improvement: Added the ability to hide columns in the project browser
- Improvement: Allowed the command palette to search project files by their full project path (e.g. Project/File.exe)
- Improvement: Dispatched token double-clicks to plugins in linear and graph views
- Improvement: Displayed the external library name in the sticky header in linear view when many symbols are imported from the same library
- Improvement: Hid the relative address in the goto dialog when it is not needed
- Improvement: Improved Display As and type toggle behavior in the UI
- Improvement: Improved default highlighting and fixed tab order
- Improvement: Improved rendering of tokenized text views
- Improvement: Improved syntax highlighting for code blocks
- Improvement: Improved toggling of integer display signedness
- Improvement: Made the command palette also look up UIAction aliases
- Improvement: Normalized theme handling and added support for stylesheets specified as arrays
- Improvement: Released all default UI themes as open source
- Improvement: Sorted Memory Map segments and sections numerically by address
- Improvement: Sorted switch blocks in graph view by case number
- Fix: Added missing copy shortcuts
- Fix: Darkened string color in the classic theme
- Fix: Fixed Linear view navigation to data added since the last refresh
- Fix: Fixed Linear View losing the current navigation position when word wrapping shifted line layout after toggling the sidebar
- Fix: Fixed Stack View allowing single-item actions when multiple items were selected
- Fix: Fixed Symbol view folders re-expanding after being collapsed
- Fix: Fixed ViewFrame::navigate unconditionally raising and activating the window, causing focus to be stolen when reverting an undo action
- Fix: Fixed context menus for calls when the call target is HLIL_IMPORT
- Fix: Fixed crash in the Add Type Library dialog when canceling without selecting a platform
- Fix: Fixed incorrect possible value set display at MLIL that showed undetermined even though the correct values were available
- Fix: Fixed stack view only allowing selection of the first item when multiple items share the same offset
- Fix: Fixed zero-sized fields no longer showing up in the UI
- Fix: Fixed a crash caused by a null pointer in setHighlightToken
- Fix: Fixed a crash that could occur when displaying the Type Library Explorer
- Fix: Fixed a crash when double-clicking a function header in linear view
- Fix: Fixed a few unintentionally hardcoded colors to use themed colors instead
- Fix: Fixed a lock inversion in the type browser
- Fix: Fixed a scoring bug in the command palette
- Fix: Fixed a strict weak ordering violation in the OptionsDialog view sort comparator
- Fix: Fixed a threading issue when saving navigation history
- Fix: Fixed auto symbols shadowing user-defined symbols in the component tree
- Fix: Fixed content being lost when resizing a view
- Fix: Fixed crash in the UI when the base structure or member type of a named type reference could not be resolved
- Fix: Fixed dropping files or folders onto the project table
- Fix: Fixed horizontal scrolling artifacts
- Fix: Fixed inaccurate possible value set tooltip for variables outside of MLIL SSA
- Fix: Fixed incorrect text shown when undefining a type or field
- Fix: Fixed line wrap width calculation to stop using view width, which the UI could not adapt to without significant rework
- Fix: Fixed multi-line form dialog inputs forcing a minimum width that caused unwanted horizontal scrolling
- Fix: Fixed navigation raising and activating the wrong window when using detached sidebars
- Fix: Fixed tab text and tooltip not refreshing to show updated display names until the next UI event
- Fix: Fixed the Settings Resource dropdown to list each open tab separately instead of collapsing tabs of the same file into one entry
- Fix: Fixed the Symbols view to respect collapsed folders during navigation and selection changes
- Fix: Fixed the Workflow view incorrectly accepting navigation requests it couldn't handle, preventing it from acting as a catch-all navigation sink
- Fix: Fixed the container browser and universal architecture selector to use the project file name instead of the file metadata name
- Fix: Fixed the symbol widget not showing all symbols defined at the same address
- Fix: Fixed truncation of file paths in the triage view
- Fix: Improved default highlighting and fixed tab key order in array settings UI
- Fix: Restored the placeholder helper text in the Create Types from C Source dialog

Architectures and Platforms
- Feature: Added ARM and Thumb lifting for VRHADD and VRECPE, and fixed SBC immediate handling
- Feature: Added FreeBSD PowerPC and RISC-V support
- Feature: Added armv8 support to the free version
- Feature: Added a little-endian octeon MIPS architecture
- Feature: Added architecture callbacks for selecting the initial linear sweep alignment
- Feature: Added architecture-specific linear sweep capabilities
- Feature: Added automatic import and application of JNI types
- Feature: Added big-endian support for the C-SKY v2 architecture and fixed recognition of big-endian M-CORE binaries
- Feature: Added decoding and lifting support for RISC-V Zba, Zbb, and Zbs bitmanip extensions and WCH instructions
- Feature: Added disassembly and lifting support for Apple's vendor-specific aarch64 instructions
- Feature: Added lifting for the ARM vcvt.f64.s32 and vmov.f64 instructions
- Feature: Added return value location handling for the x86/x86_64 ELF ABI
- Feature: Added support for WCH vendor-specific RISC-V extensions, including a hardware-accelerated memory copy and custom compressed instructions
- Feature: Added support for ARM64_RELOC_BRANCH26, ARM64_RELOC_GOT_LOAD_PAGE21, and ARM64_RELOC_GOT_LOAD_PAGEOFF12 relocations on aarch64
- Feature: Added support for big-endian NDS32 architecture
- Feature: Added support for the RISC-V Zbs single-bit bit-manipulation instructions
- Feature: Implemented RISC-V Zba address-generation instructions
- Feature: Implemented some Zbb bit-manipulation instructions for RISC-V
- Feature: Implemented the remaining Zbb instructions for the RISC-V architecture
- Improvement: Added ABI-sized heuristic return sizing for MIPS R5900
- Improvement: Coalesced Thumb IT blocks with trailing conditional branches
- Improvement: Emitted abs instructions during lifting for the csky architecture
- Improvement: Emitted abs, min, and max instructions during aarch64 lifting
- Improvement: Emitted abs, min, and max instructions when lifting Hexagon code
- Improvement: Emitted abs, min, and max instructions when lifting nds32 code
- Improvement: Emitted bswap, clz, and rbit instructions during lifting for armv7
- Improvement: Emitted bswap, popcnt, clz, ctz, cls, and rbit instructions directly during lifting on aarch64 instead of using intrinsics
- Improvement: Emitted bswap, popcnt, clz, and ctz instructions during x86 lifting
- Improvement: Expanded ARM, Thumb, and NEON lifting coverage for the ARMv7 architecture
- Improvement: Improved MIPS n32 ABI support
- Improvement: Improved defaultarch inlining to detect registers set to the caller's return address and treat jumps to them in the callee IL as returns
- Improvement: Improved heuristic return sizing to use ABI-based sizes for MIPS R5900
- Improvement: Improved library tracking for imported symbols in Mach-O binaries
- Improvement: Improved support for the octeon and n32 MIPS ABIs
- Improvement: Improved x86 LLIL flag lifting for arithmetic, test, rotate, and shift instructions
- Improvement: Lifted abs, min, and max instructions for the tricore architecture
- Improvement: Lifted more TriCore instructions added in the 1.8 architecture revision
- Improvement: Preserved native symbols when generating macOS dSYMs
- Improvement: Recovered implicit this parameters in GNU3-mangled symbols
- Improvement: Updated RISC-V Zbb bitmanip lifting to use first-class LLIL operations for min/max, clz/ctz, and popcount
- Improvement: Updated aarch64, armv7 and x86 lifting to emit new bitwise operation IL instructions
- Improvement: Used a 64KiB default page size on AArch64 Linux
- Fix: Added special handling for 0000 in RISC-V disassembly to work around a binary parsing issue
- Fix: Fixed ARMv7 vcvt lifting and added support for lifting scalar vabs directly when lane and register widths match
- Fix: Fixed Thumb2 IT conditional block analysis so subsequent instructions like b are correctly recognized as conditional
- Fix: Fixed ARMv7 rev instruction lifting that lost the initial most-significant byte
- Fix: Fixed DWARF import using the wrong address width for unknown architectures
- Fix: Fixed Thumb-2 ELF functions referenced from .gnu_debugdata being created as ARM functions instead of Thumb-2
- Fix: Fixed WCH RISC-V architecture registration and ELF relocation lookup by renaming it to rv32gc_wch to match the existing RISC-V architecture
- Fix: Fixed IT instruction info in the Thumb2 architecture
- Fix: Fixed full-width bit field instruction lifting for BFI and BFC on ARMv7
- Fix: Fixed incorrect lifting of x86 ANDN/PANDN/VPANDN
- Fix: Fixed incorrect lifting of double precision FMOV immediate on aarch64
- Fix: Fixed stack adjustment for pop r16 on x86
- Fix: Fixed x86 MOVSS lifting to zero-extend the memory-source form
- Fix: Fixed LHA instruction encoding on TriCore
- Fix: Fixed lwpc and restore.jrc lifting for nanoMIPS
- Fix: Fixed a BinaryView leak in VxWorksViewType::IsValidForData
- Fix: Fixed a demangling error for MSVC-mangled operator+ overloads on basic_string
- Fix: Fixed a bounds-checking issue in the Mach-O parser to improve robustness
- Fix: Fixed a crash from a malformed PE exception directory table size
- Fix: Fixed a crash when looking up token hover values for architecture-less items
- Fix: Fixed a crash when reading a malformed CFString in Mach-O binaries
- Fix: Fixed a hang during MIPS ELF symbol lookup caused by a malformed symbol table with a GOT entry outside valid memory regions
- Fix: Fixed a missing CALLI variant in the TriCore architecture added in 1.8
- Fix: Fixed a race condition in x64 platform view initialization on Windows
- Fix: Fixed adding the image base when looking up section-relative symbols in ELF files
- Fix: Fixed alternate names in the PPC32 and thumb2 type libraries and added an API to remove alternate names
- Fix: Fixed an out-of-bounds read during Thumb-2 lifting
- Fix: Fixed analysis giving up on Hexagon functions with Exceeds 'analysis.limits.maxFunctionUpdateCount' errors
- Fix: Fixed correctness issues in the GNU3 demangler
- Fix: Fixed disassembly of RISC-V 0000 trap instructions that some compilers insert after jumps
- Fix: Fixed handling of ARM64_RELOC_GOT_LOAD_PAGEOFF12 and ARM64_RELOC_GOT_LOAD_PAGE21 relocations for aarch64
- Fix: Fixed handling of non-monotonic records in Intel Hex files
- Fix: Fixed inability to override architecture selection for Thumb2 ELF files with an even entry point address
- Fix: Fixed incorrect instruction info for Thumb2 IT instructions
- Fix: Fixed incorrect ordering when popping values from a register stack
- Fix: Fixed inline return detection to avoid treating LLIL_JUMP(reg) as an inline return when the callee uses a nonstandard return register
- Fix: Fixed lift for pop with segment registers on x86
- Fix: Fixed lift of JAL on RISC-V by properly setting the return register
- Fix: Fixed lifting for MOVSS and ANDN on x86
- Fix: Fixed lifting of sbc.s on ARMv7 so the overflow flag is computed instead of left unimplemented
- Fix: Fixed lifting of full-width bit field instructions on ARMv7
- Fix: Fixed out-of-order TriCore disassembly operands for instructions added in 1.8
- Fix: Fixed the GNU3 demangler to use its registered config path
- Fix: Fixed the RISC-V architecture not disassembling the sh2add instruction
- Fix: Fixed the PE loader creating symbols for debugging metadata symbol entries
- Fix: Fixed the ARM/Thumb2 function platform for .gnu_debugdata symbols
- Fix: Fixed the carry flag not being lifted for the ARMv7 lsl.s instruction
- Fix: Fixed the rounding flag not being properly emitted on some x86 floating point instructions
- Fix: Fixed type lookup for Thumb function pointers by normalizing the address before lookup
- Fix: Fixed unimplemented ARMv7/Thumb2 lifting for several multiply/divide, sync primitive, and SIMD/FP instructions including vld1, vst1, vldmia, vstmia, umaal, and clrex
- Fix: Hardened Mach-O parsing against out-of-bounds reads by tightening bounds checks and bounding rebase/bind entry limits
- Fix: Ignored R_RISCV_RELAX relocations on RISC-V
- Fix: Implemented C, P, A, and O flags for sbb.d, lsr.d, and.b, and xor.d instructions
- Fix: Marked _exit as non-returning for iOS Thumb
- Fix: Marked abort and other noreturn functions as __noreturn on Apple platforms to prevent them from appearing to fall through
- Fix: Fixed the default calling convention for MSP430, which was backwards

Core Plugins
- Feature: Added a strings table to the shared cache triage view, showing strings from every image in the shared cache
- Feature: Added a KernelCache workflow activity to rename stubs in __auth_stubs sections based on their target symbol name
- Feature: Added a recursive load button to the Dyld Shared Cache triage view
- Feature: Added an activity to rename objc_msgSend stub functions, helping with stripped binaries such as macOS 27
- Improvement: Added Objective-C support for method type strings using pointers relative to the selector base address, as seen in iOS 27 shared caches
- Improvement: Added back the BinExport command to all paid product versions
- Improvement: Improved UX when loading the shared cache
- Improvement: Improved handling of shared cache files in projects
- Improvement: Reduced log noise when loading iOS/macOS 27 shared caches
- Improvement: Refactored the DSC symbols table to use TriageTablePanel, adding asynchronous loading, filtering, and sorting
- Improvement: Resolved cross-image stub functions to their target image in KernelCache context menu actions
- Improvement: Set region display names for the KernelCache to make it easier to obtain segment bounds
- Improvement: Stored processed Objective-C metadata in the database instead of regenerating it on load
- Improvement: The triage view is now always shown when opening a shared cache or kernel cache
- Improvement: Used the demangler API for exported function names in the binexport plugin
- Fix: Fixed IDB import not being freed
- Fix: Fixed headless loading of a bndb extracted from a container being parsed as Raw/Mapped instead of restoring the analyzed database
- Fix: Fixed miscellaneous crashes in the Objective-C plugin when analyzing malformed binaries
- Fix: Fixed Load /usr/lib/libFoo.dylib context menu action in the Dyld Shared Cache view to resolve cross-image stub functions to their target image
- Fix: Fixed objc_msgSend$stub functions incorrectly appearing in __objc_stubs on iOS/macOS 27 shared caches
- Fix: Fixed a potential object lifetime issue in DSC (Dyld Shared Cache) support
- Fix: Fixed insufficient bounds checking on UTF8 CFStrings in the Objective-C analyzer
- Fix: Fixed missing parameter types on Objective-C methods in shared caches
- Fix: Fixed potential crashes from using invalid plugin objects
- Fix: Fixed resolution of calls via __auth_stubs in the kernel cache for iOS 27 / macOS 27
- Fix: Fixed the Objective-C workflow overriding user-specified call types for objc_msgSend calls, preventing users from refining inferred types to account for variadic arguments
- Fix: Fixed the DSC triage view not being displayed by default when reopening a dyld shared cache from disk
- Fix: Fixed the type library utility plugin not loading

Extension Manager
- Fix: Fixed Extension Manager hanging until a request timed out when closing it while an unreachable third-party repository was configured
- Fix: Fixed installed plugins missing their descriptions in the Extension Manager
- Fix: Fixed a null pointer crash in the plugin install API
- Fix: Fixed a crash when a plugin repository returned a non-JSON response
- Fix: Fixed a null pointer dereference when the plugin repository is missing
- Fix: Fixed handling of empty unofficial repository URLs in the Extension Manager
- Fix: Fixed handling of installed extensions that have since been removed
- Fix: Fixed handling of plugins with no dependencies
- Fix: Fixed installed plugin titles in the Extension Manager not being clickable links to their repositories
- Fix: Fixed license text rendering as plaintext in the Extension Manager
- Fix: Fixed lock ordering issues in the Extension Manager
- Fix: Fixed memory leaks in the Extension Manager
- Fix: Fixed migration to also reinstall legacy plugin dependencies
- Fix: Fixed native wheel installation failures caused by pip not inheriting the system PATH when resolving native dependencies like clang
- Fix: Fixed pip installation errors not being shown in the UI when plugin dependencies fail to install
- Fix: Fixed plugin actions not being available immediately after loading a plugin
- Fix: Fixed plugins without dependency providers failing to load
- Fix: Fixed repository booleans not actually disabling repositories
- Fix: Fixed several situations where the Extension Manager did not select the latest plugin version
- Fix: Fixed the Extension Manager to properly override old repo URLs when new ones are added
- Fix: Fixed the Extension Manager crashing Python when plugin_status.json is invalid
- Fix: Fixed the Python plugin install API to default to the latest version
- Fix: Fixed the UI hanging when disabling or uninstalling a plugin while the Extension Manager is updating
- Fix: Fixed the UI hanging when installing a Python module from the Extension Manager
- Fix: Fixed the dependency install dialog repeatedly prompting to install dependencies that were already installed
- Fix: Fixed the plugin dependency dialog not resolving \n newlines in its JSON output
- Fix: Fixed the Extension Manager writing a failed download's error response to disk as a zip instead of failing early on a non-200 status code
- Fix: Fixed the Extension Manager prompting to force-install plugins even when the installed version satisfies requirements
- Fix: Fixed the Install Python Dependency action hanging the UI by running pip installation as a background task
- Fix: Fixed the deferred uninstall state not resetting after a plugin was reinstalled
- Fix: Fixed the Extension Manager using the wrong target directory when updating plugins
- Fix: Fixed version sorting in the Extension Manager

Collaboration / Projects
- Feature: Added an AuthenticateWithToken API for Enterprise to authenticate directly with a token
- Feature: Added configurable columns to the Project Browser, similar to macOS Finder or Windows Explorer
- Improvement: Changed the Enterprise Server version to a structured VersionInfo type instead of a plain string
- Fix: Fixed Enterprise snapshot mapping lookups on push when connected
- Fix: Fixed project names not resolving on the New Tab page after the project's first open
- Fix: Fixed a crash in collaboration chat during window teardown
- Fix: Fixed crash when the collaboration user list was empty
- Fix: Fixed navigation to an already-open tab instead of the requested container entry when opening multiple entries from the same container in a project
- Fix: Fixed the project table view to accept file and folder drop events instead of trying to open them
- Fix: Fixed the open tab's name and project browser display name not updating live when a project file was renamed
- Fix: Prevented downloading a .bndb before an initial snapshot has been pushed

API
- Feature: Added API for deprecated plugins
- Feature: Added API to reload the database connection
- Feature: Added APIs for measuring Unicode string width in character cells and breaking strings into grapheme clusters, and constrained derived strings to the enabled Unicode blocks
- Feature: Added Python constructors for fragment types
- Feature: Added Binary Similarity APIs
- Feature: Added BNSimplifyDemangledTemplateName API
- Feature: Added new license APIs
- Feature: Added recognize_constant_data to the StringRecognizer API
- Feature: Added type slices, a primitive type representing a byte range within a child type without being a pointer
- Feature: Added Unknown() and IsUnknown() builder functions to Unimplemented IL across LLIL/MLIL/HLIL
- Feature: Added an API to query UIAction aliases
- Feature: Added an API to specify the file to reopen for moved databases
- Feature: Added an API call to remove alternate names from a loaded type library
- Feature: Added support for __typeof__ and decltype to the Clang type parser
- Feature: Added support for populating alias fields into extraSearchableText for UI actions, allowing plugins to namespace their command-palette entries
- Feature: Added support for specifying clang compiler flags when creating BNTLs
- Feature: Added the OnTokenDoubleClicked notification hook to UIContextNotification
- Feature: Exposed flow graph construction to the API
- Feature: Exposed an API for running string detection on arbitrary buffers, enabling detection over an entire shared cache
- Feature: Introduced config-based demangler APIs (BNDemanglerConfig and BNDemanglerResult) with unified demangle and template-simplification functions, replacing the legacy demangler entry points
- Feature: Re-added the License tab and license text field to the API
- Improvement: Added a BinaryView field to LinearDisassemblyLine
- Improvement: Added a reason field to MLIL_FORCE_VER for use in automated variable splitting
- Improvement: Added comparison operators to VersionInfo
- Improvement: Added helper methods to DominatorTree for walking immediate dominators
- Improvement: Added static DataRendererContainer::RenderLinesForData as a replacement for the DataRenderer::RenderLinesForData member function
- Improvement: Consolidated the C++, Python, and Rust demangler APIs around a config-driven design
- Improvement: Extended MLIL call instruction outputs to be expressions
- Improvement: Improved PyInitConfig based Python initialization
- Improvement: Integrated template simplification into the structured GNU3/MSVC demanglers
- Improvement: Made DataBuffer implicitly convert to std::span
- Improvement: Made DefaultWebsocketClient::connect asynchronous instead of blocking
- Improvement: Made basic block accessors lock-free for the C API
- Improvement: Migrated Python demangler bindings to route through the DemanglerConfig/DemangleResult C API, with structured template simplification support
- Improvement: Refactored the MSVC demangler to parse symbols into structured type nodes before finalization
- Improvement: Removed unused path manipulation functions from the C API
- Improvement: Replaced NotImplemented in Architecture patch methods with default values or errors
- Improvement: Replaced the isAuto parameter of BinaryView::StoreMetadata to allow persisting metadata without marking the file as modified
- Improvement: Updated bnpython3 to read from stdin when the input file is -
- Improvement: Updated core demangle APIs to use registered demanglers
- Fix: Added missing fields to BNLicenseAddon
- Fix: Added missing initialization calls in the Python API
- Fix: Fixed Python Metadata object comparisons to use BNMetadataIsEqual
- Fix: Fixed Shiboken warnings caused by bad enum conversions in the Python API
- Fix: Fixed GNU3 demangler template and backref handling by using shared type nodes for substitutions and nested names
- Fix: Fixed Function.set_user_inline_during_analysis raising a TypeError instead of setting the value
- Fix: Fixed GetSystemCacheDirectory to use the documented paths
- Fix: Fixed LowLevelILFunction::AddOverflow to store its operands in the correct fields of the expression
- Fix: Fixed demangle_ms returning invalid types and mishandling attributes for vftables, multiple inheritance, and parameterless functions
- Fix: Fixed leaks caused by unclear ownership of Menu instances
- Fix: Fixed Make Enum storing concrete types instead of named type references
- Fix: Fixed Metadаta::operator== to perform a value comparison instead of a pointer comparison
- Fix: Fixed SESSION_COUNT not incrementing when cloning a Session
- Fix: Fixed _inline_during_analysis_with_confidence not converting InlineDuringAnalysisWithConfidence in the Python API
- Fix: Fixed copy_expr_to and added builder methods for recently-added instructions in the Python API
- Fix: Fixed a crash when registering an Architecture or ArchitectureHook multiple times in Python
- Fix: Fixed a NameError in get_block_lines caused by referencing an undefined instr variable instead of block
- Fix: Fixed a memory leak in the Python API where BNParseExpression errors weren't freed with BNFreeParseError
- Fix: Fixed a parameter swap bug in IsSSAVarLiveAt for MLIL SSA that caused incorrect liveness results
- Fix: Fixed a potential crash caused by an invalid FileContext current frame during close
- Fix: Fixed an overflow error in Shiboken on Linux when converting uint64_t values greater than INT64_MAX
- Fix: Fixed custom demangler dispatch on Python 3.14
- Fix: Fixed demanglers failing to compile on the API side due to an include on core-only unicode.h
- Fix: Fixed exceptions from __del__ on StructureType, EnumerationType, and NamedTypeReferenceType during Python interpreter shutdown
- Fix: Fixed handling of modules parameter when passed as either a list or a string
- Fix: Fixed handling of no-type results in the demangler
- Fix: Fixed handling of zero-width types returned by a custom Demangler in the Python API
- Fix: Fixed incorrect reference counting in the C++ API
- Fix: Fixed leaks caused by missing parenting of Qt objects
- Fix: Fixed missing initialization in several APIs that could leave objects in an uninitialized state
- Fix: Fixed the Visual C++ name demangler failing on certain mangled names, such as those containing @@@
- Fix: Fixed the Python API missing get_default_load_settings_for_data, which was referenced in example code but never implemented
- Fix: Fixed the stub generator to be less strict about leading indentation
- Fix: Guarded against use of disposed BinaryView handles
- Fix: Made loader.syntheticSectionBase writable instead of read-only
- Fix: Re-added the license text field to the API
- Fix: Replaced bare except: clauses with except Exception: in the Python API to fix signal propagation

Rust API
- Feature: Added Rust APIs for custom function lifters
- Feature: Added FlowGraphLayout and accompanying APIs for custom flow graph layouts to the Rust API
- Feature: Added a transform module to the Rust API
- Feature: Added support for owned Settings handles in the Rust API
- Improvement: Migrated the Rust demangler bindings and consumers to the new C contract
- Improvement: Removed the BinaryViewExt trait and its blanket impl from the binary_view module
- Improvement: Refactored the default implementation of BinaryViewBase::save to save raw file contents
- Fix: Fixed Rust plugin dSYMs not preserving native debug symbols for C/C++ dependencies
- Fix: Fixed Activity::new_with_action in the Rust API storing a stack pointer to the callback closure, causing use-after-free when the closure captured variables
- Fix: Fixed load_with_options_and_progress to correctly accept None for options
- Fix: Fixed a missing operand field when round-tripping text tokens in the Rust API
- Fix: Fixed a use-after-free in Function::set_int_display_type in the Rust API
- Fix: Fixed improper use of Ref in collaboration project function signatures in the Rust API
- Fix: Fixed off-by-one accesses to operand lists in MediumLevelILInstruction::lift that could cause a crash or incorrect data being read
- Fix: Fixed the Rust save bindings for custom binary views
- Fix: Removed an unused dependency on libdbus from the Rust secrets provider
- Fix: Renamed Settings::new to Settings::global in the Rust API to remove a foot gun

Debugger
- Feature: Added double-click navigation to a token's runtime address during a debug session
- Feature: Added the ability to go to the previous/next register write in TTD (Time Travel Debugging)
- Improvement: Made the WinDbg/TTD version a setting instead of always downloading the latest
- Improvement: Refined double-click navigation while debugging
- Improvement: Skipped the adapter settings dialog on subsequent debug sessions
- Improvement: Disabled the debugger.useMemoryMapSegments setting by default
- Improvement: Remembered the last checked access types in the TTD next/prev memory access dialog
- Improvement: Rendered debugger dependencies in a readable format instead of a single-line JSON blob
- Fix: Fixed LLDB target creation to use the executable path instead of the analyzed input file when debugging a shared library
- Fix: Fixed breakpoint removal after the debugger exits
- Fix: Fixed unreadable memory during TTD when the readable region is smaller than a cache block
- Fix: Fixed the register cache not being invalidated after a successful register write
- Fix: Fixed incorrect module end addresses on macOS with the LLDB adapter
- Fix: Verified the Authenticode signature of the downloaded WinDbg MSI bundle
- Fix: Fixed LLDB version detection on macOS and Linux
- Fix: Fixed TTD sidebar widgets showing on non-TTD platforms
- Fix: Fixed TTD target termination to occur on the engine thread
- Fix: Fixed a DebuggerController reference leak caused by AttachProcessDialog
- Fix: Fixed a null pointer crash in DebuggerUI::CreateForViewFrame when UIContext::contextForWidget returned null
- Fix: Fixed a strdup memory leak in GetPathBaseName
- Fix: Fixed a bounds check issue in RLE decoding (DecodeRLE)
- Fix: Fixed a bug where deleted debugger controllers were nulled instead of erased from the controller list
- Fix: Fixed a crash caused by DebuggerController being freed while detached worker threads for Launch/Attach/Connect/Go/Step*/RunTo*/Restart/Detach were still running
- Fix: Fixed a crash in CorelliumAdapter::BreakInto when m_rspConnector is null
- Fix: Fixed a crash when reading stack variable parameters for calls in the debugger IL views
- Fix: Fixed a leftover debug thread not being joined in the WindowsNativeAdapter destructor when a debugged process exits on its own
- Fix: Fixed a null pointer dereference in DbgEngAdapter::ReadMemory and WriteMemory
- Fix: Fixed a null pointer dereference in EsrevenAdapter::GetProcessList
- Fix: Fixed crashes from missing null checks on m_rspConnector in WriteMemory and TTD call query
- Fix: Fixed potential crash from missing nullptr checks on returns from the LLDB API
- Fix: Fixed several memory leaks in the debugger
- Fix: Fixed the debugger throwing an exception when parsing certain integers in the remote protocol
- Fix: Rejected a TTD launch when no trace was specified
- Fix: Removed a redundant 100x Release() loop from the DbgEng adapters' Reset()

Documentation
- Feature: Added an example plugin that recognizes and displays Rust string slices
- Improvement: Documented side-by-side installs
- Improvement: Documented the difference between Forget This File and Remove From Recent Files
- Improvement: Documented the difference between unimplemented and unknown LLIL states
- Improvement: Documented the target memory map being mirrored as segments
- Improvement: Improved documentation for context-aware control-flow recovery, lifting, and disassembly
- Improvement: Improved the large file section of the troubleshooting documentation
- Improvement: Made the sidebar navigation collapsible in the Python API docs
- Fix: Corrected the kernel cache support matrix, which incorrectly listed support for iOS versions predating MH_FILESET
- Fix: Fixed the multitool.py file download example to actually save the downloaded file

Other
- Feature: Allowed opening databases without opening a file
- Improvement: Changed linker behavior to more closely match gcc
- Improvement: Compiled jsoncpp into a separate namespace when built as part of core, allowing it to be included in statically linked builds
- Improvement: Improved IDB (IDA Pro database) file support
- Improvement: Renamed the BNTL commands root to Type Library
- Improvement: Updated to Qt 6.11.1, raising the minimum PySide Python version to 3.10
- Improvement: Updated to LLVM 22.1.8 and raised the minimum supported Python version
- Fix: Enabled creation of .pyc files in the system cache directory
- Fix: Fixed Zstd decompression of files with multiple concatenated frames
- Fix: Fixed sys.executable not being properly set for bnpython3
- Fix: Fixed a crash on startup caused by a malformed settings.json
- Fix: Fixed a deadlock on quit between RunGuard teardown and the URL handler thread
- Fix: Fixed crashes caused by unsafe use of printf-style logging calls
- Fix: Fixed incorrect Python code signing on macOS
- Fix: Fixed missing Python entitlement on macOS
- Fix: Fixed normalization of the virtualenv path setting
- Fix: Fixed potential crash in BNPathExists, BNIsPathDirectory, and BNIsPathRegularFile when the filesystem operation throws an exception
- Fix: Fixed update channel detection to use manifests instead of hard-coded GUIDs