diff options
| author | blasty <blasty@local> | 2026-08-07 15:18:56 +0200 |
|---|---|---|
| committer | blasty <blasty@local> | 2026-08-07 15:18:56 +0200 |
| commit | 4f0e17c69c5424f307ecf2ef4ffb278e775c8349 (patch) | |
| tree | 43d561beb58b18a1859beb915fed84ed495e0c0d /ida-codemode-mcp.patch | |
| parent | Merge the IDA Code Mode port (diff) | |
| download | ida-tui-4f0e17c69c5424f307ecf2ef4ffb278e775c8349.tar.gz ida-tui-4f0e17c69c5424f307ecf2ef4ffb278e775c8349.tar.xz ida-tui-4f0e17c69c5424f307ecf2ef4ffb278e775c8349.zip | |
Stop tracking the upstream port patch
It was swept into the tree by a broad 'git add -A' during the port. The merge
itself plus docs/CODEMODE_PORT.md are the record; a 251KB patch of superseded
content is not. Still on disk, now ignored.
Diffstat (limited to '')
| -rw-r--r-- | ida-codemode-mcp.patch | 5848 |
1 files changed, 0 insertions, 5848 deletions
diff --git a/ida-codemode-mcp.patch b/ida-codemode-mcp.patch deleted file mode 100644 index 82a9b3b..0000000 --- a/ida-codemode-mcp.patch +++ /dev/null @@ -1,5848 +0,0 @@ -From 0db18f870a45c0355ca1b28db1a2e763b60f6226 Mon Sep 17 00:00:00 2001 -From: Duncan Ogilvie <mr.exodia.tpodt@gmail.com> -Date: Fri, 31 Jul 2026 01:40:21 +0200 -Subject: [PATCH] WIP: vibeslop ida-codemode port - ---- - README.md | 100 +-- - TODO | 17 +- - docs/CODEMODE_PORT.md | 175 +++++ - docs/PAGING_FINDINGS.md | 54 +- - docs/PROJECTS.md | 41 +- - docs/SPLIT_VIEW.md | 12 +- - experiments/worker_smoke.py | 104 ++- - ida-tui | 7 +- - idatui/__init__.py | 5 +- - idatui/app.py | 206 +++--- - idatui/codemode_client.py | 1107 +++++++++++++++++++++++++++++ - idatui/domain.py | 194 +++-- - idatui/drive.py | 3 +- - idatui/errors.py | 10 +- - idatui/launch.py | 92 +-- - idatui/pane.py | 92 +-- - idatui/pool.py | 100 +-- - idatui/project.py | 35 +- - idatui/worker.py | 233 ------ - idatui/worker_client.py | 234 ------- - pyproject.toml | 17 +- - server/patch_server.py | 1248 --------------------------------- - tests/test_codemode_client.py | 137 ++++ - tests/test_pool.py | 61 +- - tests/test_project.py | 2 +- - tests/test_scenarios.py | 18 +- - uv.lock | 65 +- - 27 files changed, 2055 insertions(+), 2314 deletions(-) - create mode 100644 docs/CODEMODE_PORT.md - create mode 100644 idatui/codemode_client.py - delete mode 100644 idatui/worker.py - delete mode 100644 idatui/worker_client.py - delete mode 100644 server/patch_server.py - create mode 100644 tests/test_codemode_client.py - -diff --git a/README.md b/README.md -index 7d7d8d7..47d5366 100644 ---- a/README.md -+++ b/README.md -@@ -1,13 +1,13 @@ - # ida-tui - - A minimal, keyboard-first (mouse-capable) **TUI frontend for IDA Pro**, built with --[Textual](https://textual.textualize.io/) and driving **idalib** (IDA headless). -+[Textual](https://textual.textualize.io/) and using -+[ida-codemode-mcp](../ida-codemode-mcp) as a Python library. - --Opening a binary spawns our own **idalib worker** — a private subprocess talking a --unix socket (`idatui/worker.py` + `WorkerClient`), ~50–100× cheaper per call than --an HTTP transport. It reuses [ida-pro-mcp](https://github.com/mrexodia/ida-pro-mcp)'s --tool implementations in-process; the old ida-pro-mcp HTTP server/supervisor path --has been **removed**. -+ida-tui attaches to databases through `ida_codemode.client.DatabaseHandle`. A -+matching database already open in the IDA GUI is reused; otherwise Code Mode -+reuses or starts a shared managed idalib worker. The TUI owns only a client lease, -+never the GUI or worker process. - - ## ⚠️ Status: not ready for public consumption - -@@ -31,7 +31,7 @@ don't file expectations. **Use at your own risk.** - - A unified **IDA-style listing** (continuous disassembly interleaved with data / - undefined heads) as the default code view; `F5`/`Tab` drops into the - **decompiler (pseudocode)** for the function under the cursor. Both are -- line-virtualized and page lazily over the worker. -+ line-virtualized and page lazily over the Code Mode database. - - A **Ghidra-style split view** (`s`): listing and pseudocode side by side, kept - in cursor sync — the focused pane drives and the other highlights the linked - region (every instruction a C line owns), following you across functions. -@@ -49,46 +49,58 @@ don't file expectations. **Use at your own risk.** - - ## Architecture (three layers, kept separate) - --- **`idatui/worker.py` + `idatui/worker_client.py`** — the backend. `worker.py` -- opens one DB with idalib (on its main thread) and serves ida-pro-mcp's tool -- functions over a unix socket; `WorkerClient` spawns it and is a stdlib-only -- drop-in client (length-prefixed pickle, calls serialized under a lock). Shared -- error types + the `Session` model live in `idatui/errors.py`. --- **`idatui/domain.py`** — paging/caching over the worker client (`FunctionIndex`, -- `DisasmModel`, `ListingModel`, `decompile`, xrefs, resolve). Synchronous, -- thread-safe. Tools ida-pro-mcp lacks (`heads`, `read_raw`, `resolve_names`, -- `xref_types`, …) are injected by `server/patch_server.py`, which the worker -- runs itself on startup. -+- **`idatui/codemode_client.py`** — lifecycle and execution adapter. It leases a -+ registered GUI/idalib instance with `DatabaseHandle`, waits for autoanalysis, -+ normalizes errors, saves, and releases the lease. Address-centric operations -+ are sent through Code Mode's `execute_python` surface and use its preloaded -+ `ida-domain` `db` object. -+- **`idatui/domain.py`** — synchronous, thread-safe paging/caching -+ (`FunctionIndex`, `DisasmModel`, `ListingModel`, decompile, xrefs, resolve). -+ It has no process/database ownership logic. - - **`idatui/app.py`** — the Textual app (virtualized `ScrollView`s, shared cursor/ - search/nav mixins, modals). - --The domain + worker-client layers are intentionally **stdlib-only** (the worker --process links idalib); only the TUI layer pulls in Textual + Pygments. -+`idatui/pool.py` retains LRU project leases. Releasing an entry never kills a GUI -+or another client's worker. See `docs/CODEMODE_PORT.md` for what maps to public -+ida-domain APIs and which remaining features require IDAPython inside the Code -+Mode execution sandbox. - - ## Requirements - - - Python ≥ 3.11 --- A working **IDA Pro** with **idalib** and **ida-pro-mcp** installed (the worker -- reuses ida-pro-mcp's tool implementations in-process — no server runs). --- Textual ≥ 8 and Pygments ≥ 2 for the TUI (`pip install -e '.[tui]'`). -+- IDA Pro 9.4+ with idalib configured -+- `ida-codemode-mcp` installed in the TUI environment (this checkout uses the -+ editable sibling path `../ida-codemode-mcp`) -+- The ida-codemode IDA plugin installed so GUI databases register themselves -+- Textual ≥ 8 and Pygments ≥ 2 (`uv sync` installs both) - --Two python environments are expected: one with **textual + idapro** for the TUI --(`~/ida-venv`, override `$IDATUI_PYTHON`) and one with **idapro + ida_pro_mcp** --for the worker (auto-detected, override `$IDATUI_WORKER_PYTHON`). -+Code Mode's own worker launcher carries the correct Python environment; ida-tui -+no longer searches for a second Python or imports `ida_pro_mcp`. - - ## Running - --One command — it spawns a private idalib worker for the binary (which opens + --auto-analyzes it in its own process over a unix socket) and drops you into the --TUI behind a loading overlay: -+Install the project and its TUI dependencies: - - ```sh --./ida-tui /path/to/binary # open a binary and drive it — that's it -+uv sync - ``` - --It uses `~/ida-venv/bin/python` for the TUI (override with `$IDATUI_PYTHON`) and --resolves binary paths against your real cwd. The binary's directory must be --writable (idalib writes a `.i64` there). -+Pass an executable/IDB path. If the plugin has registered a matching GUI session, -+ida-tui attaches to it; otherwise Code Mode opens a managed idalib database: -+ -+```sh -+./ida-tui /path/to/binary -+``` -+ -+With exactly one registered database, the path may be omitted: -+ -+```sh -+./ida-tui -+``` -+ -+When several databases are registered, the launcher lists their paths and asks -+for one explicitly. A newly managed single-binary database still needs a writable -+output location; projects stage binaries and IDBs in their sidecar directory. - - Headerless blobs need to be told what they are — a raw firmware dump has no - format to detect, and IDA falls back to x86 at address 0, which analyses to -@@ -102,15 +114,16 @@ ARM images that use Thumb need one more thing: press `t` on the listing to switc - ARM/Thumb decoding at the cursor (it sets IDA's `T` register, and the segment to - 32-bit, since Thumb doesn't exist in AArch64). - --`--base` is a real address (IDA's own `-b` is in paragraphs; the conversion is --done for you). In a project the options are recorded per binary, which is what a --multi-image firmware wants. They apply to the first open only — after that the --`.i64` records how the image was loaded. See `docs/PROJECTS.md`. -+`--base` is a real address (Code Mode's typed loading address is also natural, -+so no paragraph conversion crosses the dependency boundary). In a project the -+options are recorded per binary. They apply only when Code Mode must create the -+first database; a registered or existing IDB already records them. Arbitrary -+`--ida-args` are rejected because `DatabaseHandle.open()` has no equivalent; -+processor, base, and loader/file type are the supported import surface. - --> Recovering a wedged database: if a worker was hard-killed it leaves unpacked --> `foo.id0/.id1/.id2/.nam/.til` next to `foo.i64`, and the `.i64` then refuses to --> reopen. Delete those stale files (never the `.i64`) and retry — `ida-tui` does --> this automatically. -+ida-tui never deletes unpacked IDA scratch files during discovery: those files -+may belong to a registered GUI or another Code Mode client. Registry locks and -+health probes are the ownership authority. - - ## Execution traces - -@@ -166,8 +179,8 @@ See `docs/RPC.md` for the full protocol. - - ## Tests - --A headless Textual `Pilot` suite lives in `tests/`; it spawns a worker on the --given binary (default `targets/echo`): -+A headless Textual `Pilot` suite lives in `tests/`; it attaches through Code Mode -+(or starts a managed worker) for the given binary: - - ```sh - python tests/test_scenarios.py targets/echo # full UI suite -@@ -177,6 +190,7 @@ python tests/test_scenarios.py --only hex,rename - ## Docs - - - `docs/RPC.md` — the RPC protocol --- `docs/PAGING_FINDINGS.md` — idalib tool paging/scale quirks -+- `docs/CODEMODE_PORT.md` — port coverage, API gaps, and lifecycle semantics -+- `docs/PAGING_FINDINGS.md` — historical paging/scale findings - - `docs/TEXTUAL_NOTES.md` — Textual pitfalls encountered - - `docs/TUI_DRIVING_BLUEPRINT.md` — generalizing the driving layer -diff --git a/TODO b/TODO -index 58b4693..c578cff 100644 ---- a/TODO -+++ b/TODO -@@ -4,14 +4,15 @@ - bugs: - - current: --[~] DITCH ida-pro-mcp -> our own idalib worker (idatui/worker.py + WorkerClient) -- [x] worker + WorkerClient (drop-in for IDAClient, same tool shapes) -- [x] --backend {worker,mcp}; worker is now the DEFAULT for opening a binary -- [x] worker spawns under the IDA python; {"result":...} wrapping to match MCP -- [ ] run the pilot suite against --backend worker (blocked: idalib reaping here) -- [ ] progress reporting during analysis (worker streams notes to the overlay) -- [ ] once solid: delete client.py, server/patch_server.py, spawn.sh, and -- launch.py's whole supervisor/ensure_server/lock-sweep dance -+[x] PORT TO ida-codemode-mcp as a library dependency -+ [x] DatabaseHandle discovery prefers registered GUI sessions -+ [x] shared managed idalib workers + SSE lease lifecycle -+ [x] domain operations execute against ida-domain through Code Mode -+ [x] delete the private pickle worker and ida-pro-mcp patch injection -+ [x] stop sweeping/reaping resources that may belong to another client -+ [ ] run the full live Pilot suite against both GUI and managed backends -+ [ ] add database revision/change notifications for cross-client cache invalidation -+ [ ] decide how "discard changes" should work (Code Mode final workers save) - [x] RPC endpoint for robot-spectator-ida - -> progressssss - -diff --git a/docs/CODEMODE_PORT.md b/docs/CODEMODE_PORT.md -new file mode 100644 -index 0000000..4b4bc45 ---- /dev/null -+++ b/docs/CODEMODE_PORT.md -@@ -0,0 +1,175 @@ -+# ida-tui → IDA Code Mode port -+ -+This port is an experiment: can ida-tui be implemented as an ordinary client of -+`ida_codemode`, sharing GUI databases and managed idalib workers instead of -+owning a private worker and depending on ida-pro-mcp tool functions? -+ -+## Result -+ -+Yes for the database lifecycle and the complete current TUI feature set, with a -+small number of operations implemented using IDAPython inside Code Mode's -+`execute_python` sandbox because ida-domain does not yet expose the required -+behavior. -+ -+The old components are gone: -+ -+- `idatui/worker.py` (private pickle/socket idalib process) -+- `idatui/worker_client.py` -+- `server/patch_server.py` (ida-pro-mcp tool injection) -+ -+The replacement is `idatui/codemode_client.py`. -+ -+## Lifecycle mapping -+ -+`CodeModeClient.connect()` calls `ida_codemode.client.DatabaseHandle.open()`. -+Resolution is therefore Code Mode's resolution, not ida-tui's: -+ -+1. Match a registered GUI by executable path. -+2. Otherwise match the owner of the expected IDB. -+3. Otherwise serialize creation and start a managed `ida-codemode-worker`. -+4. Establish an authenticated SSE lease. -+5. Wait through the public autoanalysis route. -+ -+The handle's registry entry supplies the backend, PID, executable path, IDB path, -+and record ID used by the status/pool layers. -+ -+Closing ida-tui closes only its lease. It never closes a GUI or kills an idalib -+process. A managed worker saves and exits under Code Mode's own policy after its -+last lease disappears. A second agent or TUI can keep using the same instance. -+ -+This also changes project pooling semantics. `DatabasePool` is an LRU pool of -+leases, not process ownership. Managed-IDB save-on-evict remains; budget eviction -+does not implicitly save a GUI. Eviction cannot force a shared worker to exit, -+and GUI process memory is only advisory. -+ -+## ida-domain coverage -+ -+The remote snippets receive Code Mode's preloaded `db` (`ida_domain.Database`). -+The following TUI needs map to public ida-domain entities: -+ -+| TUI need | ida-domain surface | -+|---|---| -+| Function paging, lookup, names, sizes | `db.functions` | -+| Segments and names | `db.segments` | -+| Instructions and plain disassembly | `db.instructions`, `db.functions.get_instructions()` | -+| Heads and item classification | `db.heads`, `db.bytes` | -+| Bytes and strings | `db.bytes`, `db.strings` | -+| Symbol resolution and rename | `db.names`, `db.functions` | -+| Comments | `db.comments` | -+| Imports and exports | `db.imports`, `db.entries` | -+| Xrefs and fine type predicates | `db.xrefs` / `XrefInfo` | -+| Named types, members, parse/apply | `db.types` | -+| Function prototypes and local variables | `db.pseudocode`, `PseudocodeFunction.local_variables` | -+| Decompilation text and object references | `db.pseudocode` | -+ -+All values are reduced to JSON primitives inside the database process. No SWIG -+or ida-domain object crosses the Code Mode boundary. -+ -+## Remaining IDAPython gaps -+ -+Code Mode intentionally allows regular Python imports, so these features still -+work, but they identify useful additions to ida-domain: -+ -+1. **Rich continuous listing** -+ - ida-domain enumerates defined heads and renders plain disassembly. -+ - ida-tui also needs coalesced undefined runs, IDA colour-tag spans, function -+ banners, code-label rows, file-region offsets, and expanded struct members. -+ - The `heads` operation uses `ida_bytes`, `ida_lines`, and related modules for -+ this presentation model. -+ -+2. **Instruction/function carving** -+ - Creating an instruction and walking a speculative decode run requires -+ `ida_ua.create_insn` and processor flow/return checks. -+ - Function creation exists in ida-domain; the explicit-end fallback still -+ needs lower-level item boundaries. -+ -+3. **ARM/Thumb state** -+ - T-register ranges and segment addressing use `ida_segregs`, `ida_idp`, and -+ `ida_segment`. There is no equivalent ida-domain operation. -+ -+4. **Detailed decompiler diagnostics and line maps** -+ - Pseudocode text, ctree objects, and the address map are available through -+ ida-domain. -+ - Reproducing IDA's per-rendered-line coverage uses -+ `cfunc.get_line_item`; obtaining the exact Hex-Rays failure description -+ uses `hexrays_failure_t`. -+ -+5. **A few type/item primitives** -+ - Deleting a named local type and some exact item-undefinition/data-creation -+ behavior still use `ida_typeinf`/`ida_bytes` directly. -+ -+These uses are isolated in `idatui/codemode_client.py`; the paging and Textual -+layers do not import IDAPython. -+ -+## API limitations exposed by the port -+ -+### No rollback or close-without-save -+ -+A Code Mode lease has no rollback operation. Closing a GUI handle leaves the GUI -+state as-is. A managed idalib worker currently saves when its final lease closes. -+Consequently ida-tui's old “discard & quit” guarantee cannot be implemented. -+The UI now labels this choice “leave as-is & quit” and does not explicitly save, -+but managed-worker policy may still persist the changes. -+ -+A true discard action would need a Code Mode/database API for transaction-like -+rollback, a close policy on a newly-owned worker, or a TUI-managed disposable DB -+copy. -+ -+### Typed loader options only -+ -+`DatabaseHandle.open()` supports processor, natural loading address, file type, -+output database, and fresh-database selection. It does not support ida-tui's -+arbitrary `ida_args` escape hatch. The adapter rejects unsupported switches -+rather than silently loading at the wrong architecture/base. -+ -+### No database-change notification stream -+ -+The lease reports liveness, not mutations. If a GUI user or another Code Mode -+client renames/retypes content while ida-tui is open, already-materialized TUI -+caches are not invalidated automatically. TUI-originated edits invalidate their -+own caches correctly. A database revision counter or change feed would make -+shared interactive editing robust. -+ -+### Discovery requires a path for ambiguity -+ -+`ida-tui` with no path attaches automatically when exactly one database is -+registered. With several registrations it lists them and requires an explicit -+executable/IDB path. There is not yet a pre-connection database picker in the -+Textual UI. -+ -+### `DatabaseHandle` import stability -+ -+The usable library primitive currently lives at -+`ida_codemode.client.DatabaseHandle`; `ida_codemode.__init__` exports nothing. -+The port therefore depends on a submodule path. Exporting the handle and public -+client exceptions from the package root would make the supported library API -+clearer. -+ -+## Safety differences -+ -+ida-tui no longer removes `.id0/.id1/.id2/.nam/.til` files before opening. That -+was only defensible when the TUI exclusively owned a private process; it is -+unsafe when a GUI or another client may own the database. Code Mode registry -+locks, health probes, and IDA itself now arbitrate ownership. -+ -+The old pane “reap private workers” behavior is obsolete. A TUI crash closes its -+lease at the socket/kernel boundary; Code Mode decides whether a managed worker -+still has clients and when it should stop. -+ -+## Verification surfaces -+ -+The non-IDA suite verifies project staging, LRU lease behavior, load-option -+translation, and adapter response/error normalization. The existing live suites -+remain the end-to-end contract: -+ -+```sh -+uv run python tests/test_codemode_client.py -+uv run python tests/test_pool.py -+uv run python tests/test_project.py -+uv run python tests/test_scenarios.py /path/to/binary -+``` -+ -+For GUI reuse, open the same binary in an IDA with the Code Mode plugin, confirm -+it appears in `ida_codemode.registry.discover_instances()`, then launch -+`ida-tui /path/to/binary`. The TUI status/`CodeModeClient.backend` should report -+`gui`, and closing the TUI must leave IDA open. -diff --git a/docs/PAGING_FINDINGS.md b/docs/PAGING_FINDINGS.md -index bcde583..bd6c38f 100644 ---- a/docs/PAGING_FINDINGS.md -+++ b/docs/PAGING_FINDINGS.md -@@ -2,10 +2,10 @@ - - Measured against a real target: `libcrypto.so.3` (5.7 MB, **10,092 functions**, - biggest function **52,120 instructions**). These constraints drive the domain / --paging layer. They describe the ida-pro-mcp *tool functions* (`list_funcs`, --`disasm`, `decompile`, `xref_query`, …) which the idalib worker now calls --in-process (`idatui/worker.py`) — the shapes and caps below are the tools' --behaviour and are unchanged by dropping the HTTP transport. -+paging layer. The measurements below came from the former ida-pro-mcp tool -+backend. The Code Mode port preserves the adapter response shapes and conservative -+page sizes, but executes enumeration through ida-domain; old server caps and RTT -+numbers are historical rather than Code Mode constraints. - - ## Response shape (list_* / *_query tools) - -@@ -93,32 +93,26 @@ disasm totals are **top-level** fields, not under `asm`: - (correct). The pseudocode view must handle "decompilation failed" gracefully — - fall back to the disassembly view or show an error panel. - --Normal decompile bodies are server-truncated with a `[N chars total]` marker --(still to be solved for full-body display — see Phase 2). -- --## Worker lifecycle (idatui's own idalib worker) -- --idatui no longer uses ida-pro-mcp's shared HTTP supervisor. `idatui/worker.py` --opens exactly **one** database with `idapro.open_database(...)` in its own process --and serves tool calls over a unix socket (`WorkerClient`). Consequences vs the --old supervisor model, which several design choices here were built around: -- --* **No `max_workers` cap, no cross-session contention.** Each TUI owns its -- worker; there is no "Maximum idalib worker count reached" and no shared license -- slot to free. --* **No idle self-exit / keepalive dance.** The old per-worker `WorkerLifecycle` -- watchdog (`idle_ttl_sec`, default 600s) and the `KeepAlive` heartbeat that -- fought it are gone with the supervisor. The worker lives as long as the TUI -- holds the socket and dies with it. `WorkerClient.keepalive()` is a no-op kept -- for API parity, and `--ttl` is passed through but the single owned worker does -- not self-reap. --* **A crashed worker drops the socket**, surfacing as `IDAConnectionError`; the -- app's `_reconnect` respawns a fresh worker (re-opening + re-analyzing the -- binary). The hard-kill lock recovery below still applies. -+Code Mode returns the complete execution result directly; ida-tui no longer -+needs MCP structured-content/download-URL recovery for large pseudocode bodies. -+ -+## Code Mode lifecycle -+ -+`CodeModeClient` owns an authenticated SSE lease on a registered database: -+ -+* A matching GUI is preferred and remains open when the TUI exits. -+* Otherwise Code Mode reuses or starts a shared managed idalib worker. -+* Releasing one lease never terminates another client's session. A managed -+ worker saves and exits after its final lease under Code Mode's grace policy. -+* Lease loss surfaces as `IDAConnectionError`; reconnect performs discovery -+ again and may bind a newly-created instance. It does not silently swap the -+ handle underneath an operation. -+* `--ttl` and the old keepalive flag are compatibility no-ops; the lease itself -+ carries heartbeats. - - ## Writable path requirement (operational) - --`idb_open` writes the `.i64` next to the input binary, so the path must be --**writable**. Opening from read-only dirs (e.g. `/usr/lib`) fails with --`"Failed to open database"`. Copy targets into a writable dir first --(`targets/` in this repo). -+Attaching to a registered GUI does not require ida-tui to write beside the input. -+Creating a managed database does require a writable output path. Multi-binary -+projects provide one in their sidecar. ida-tui does not sweep IDA scratch files, -+because another registered session may own them. -diff --git a/docs/PROJECTS.md b/docs/PROJECTS.md -index fe6c2a8..0efee31 100644 ---- a/docs/PROJECTS.md -+++ b/docs/PROJECTS.md -@@ -7,9 +7,11 @@ search across all of them, and (later) follow calls from one into another. - - ## The constraint that shapes everything - --`idatui/worker.py` is `serve(sock, binpath)` — **one worker process holds exactly --one database** (idalib is main-thread-only and single-DB). So N binaries = N --worker processes, each with the analyzed DB resident. -+IDA still exposes one active database per GUI/idalib process. Code Mode makes -+those instances discoverable and shareable: each project entry retains one -+`DatabaseHandle` lease, which may target a registered GUI or a managed idalib -+worker. N resident project databases can therefore mean up to N processes, but -+ida-tui no longer owns or terminates them. - - Measured cost (this box, `targets/`): - -@@ -30,13 +32,13 @@ crypto library. - - Two capabilities that feel like one, but aren't: - --1. **Switching** to a binary needs a *live worker*. -+1. **Switching** to a binary needs a *live Code Mode lease*. - 2. **Searching across** binaries does *not* — if a per-binary index (functions, - strings, imports/exports) is cached on disk. - - That split is the unlock: project-wide search stays instant across every binary, - including ones never opened this session, and only *jumping* to a hit costs a --worker spawn. -+Code Mode attach/open. - - ## Layout - -@@ -83,17 +85,16 @@ basename and must be unique (it names the staged file). - - ## Runtime - --- **`WorkerPool`** — one `WorkerClient` per binary, spawned lazily on first -- switch, kept resident until the memory budget is exceeded, then LRU-evicted. -- Eviction **saves the DB first**, so returning to a binary is a DB load, not a -- re-analysis. Binaries can be pinned to stay resident. -+- **`DatabasePool`** — one `CodeModeClient` lease per resident binary, attached -+ lazily on first switch and LRU-released when the advisory memory budget is -+ exceeded. Eviction explicitly saves managed IDBs but never implicitly saves a -+ GUI. Closing a lease never kills a GUI or another client's managed worker; -+ Code Mode owns final worker shutdown. - - **`BinaryState`** — per binary: `client, program, nav, cur, func_index, - pref/active/split, filter`. Switching snapshots the current state and restores -- the target's. `_after_reconnect` already does exactly this swap (client + -- program, reload the index, re-open the entry) — switching reuses that seam. --- **Clean shutdown** — the worker currently does `close_database(save=False)` and -- is hard-killed on exit, which is why wedge files accumulate. Projects need -- save-on-evict and an orderly close anyway, so that gets fixed here. -+ the target's. `_after_reconnect` provides the client/program swap seam. -+- **Clean shutdown** — release all leases. Managed idalib workers save/close on -+ their own main thread after the final lease; GUI sessions remain open. - - ## UI - -@@ -109,8 +110,8 @@ basename and must be unique (it names the staged file). - ## Phases - - **Phase 1 — project model + switching. DONE.** Project file + staging --(`idatui/project.py`), `WorkerPool` with budget eviction / save-on-evict / --clean shutdown (`idatui/pool.py`), `BinaryState` snapshot+restore and the switch -+(`idatui/project.py`), `DatabasePool` with budgeted lease release and -+save-on-evict (`idatui/pool.py`), `BinaryState` snapshot+restore and the switch - itself, the `Ctrl+O` switcher palette, the active binary in the status line, and - `--project` (which creates the project when given binaries). One active binary; - no cross-binary search yet. -@@ -118,9 +119,9 @@ no cross-binary search yet. - Project mode is **additive**: with no `--project` the app is byte-for-byte the - single-binary tool it was, which is what keeps the 167-check pilot honest. - Switching reuses the `_after_reconnect` shape — swap client+program, rebuild the --index, reopen the entry. A binary whose worker is still resident restores --instantly (its `Program` and index are still in memory); an evicted one comes --back with a fresh worker but keeps its nav history, since that is just addresses. -+index, reopen the entry. A binary whose lease is still resident restores -+instantly (its `Program` and index are still in memory); an evicted one attaches -+again but keeps its nav history, since that is just addresses. - - **Phase 2 — index cache + project-wide search. (symbols done)** - `idatui/index.py` keeps one **SQLite FTS5 trigram** index at -@@ -222,7 +223,7 @@ records nothing — that's not navigation. - *Pre-warm follows the linkage graph, not list order.* When a binary finishes - indexing, `_prewarm_provider` warms the binary that provides the most of its - imports — where a follow is most likely to take you, so its startup is paid --before you ask. `WorkerPool.prewarm()` refuses rather than evicting: spending a -+before you ask. `DatabasePool.prewarm()` refuses rather than evicting: spending a - binary you visited on one you haven't is a straight downgrade, and it would throw - away that binary's caches too. At a tight budget pre-warm simply does nothing. It - estimates the cost of a not-yet-spawned worker from the largest resident one, -diff --git a/docs/SPLIT_VIEW.md b/docs/SPLIT_VIEW.md -index de37dc1..c421656 100644 ---- a/docs/SPLIT_VIEW.md -+++ b/docs/SPLIT_VIEW.md -@@ -29,11 +29,11 @@ Ghidra highlights **all** instructions a C line owns. We have one ea per line - (the marker), not the set. Getting the set is the only real work, and it's a - known technique: - --ida-pro-mcp derives the per-line marker via -+The old ida-pro-mcp backend derived the per-line marker via - `cfunc.get_line_item(line, col=0, …).get_ea()`. To get the **full set**, sweep - every column of the line (`get_line_item(line, x, …).get_ea()` for `x` in --`0..len`) and collect distinct non-`BADADDR` EAs. Same proven API, swept across --the line. A custom `decomp_map(ea)` tool in `server/patch_server.py` returns -+`0..len`) and collect distinct non-`BADADDR` EAs. The Code Mode adapter's -+`decomp_map(ea)` operation returns - `[{line, primary_ea, eas:[…]}, …]`; invert for `ea → line`. - - ## State model -@@ -78,14 +78,14 @@ decomp→listing uses `ListingModel.ensure_ea`. Tab re-links from the new driver - Still single-ea per line (one instruction highlighted); the region comes in - phase 3. - --**Phase 3 — rich highlight. DONE.** `decomp_map` custom tool --(`server/patch_server.py`) sweeps `cfunc.get_line_item` across every column of -+**Phase 3 — rich highlight. DONE.** The Code Mode `decomp_map` operation -+(`idatui/codemode_client.py`) sweeps `cfunc.get_line_item` across every column of - each pseudocode line and collects the EAs from each item's `dstr()` (`'EA: desc'` - — the same source as the `/*ea*/` marker, so it aligns). `Program.decomp_map(ea)` - returns the per-line ea lists (cached by name-gen); the app loads it async into - `_split_eamap` / `_split_ea2line` and `_sync_split` bands the **whole** instruction - region of a C line (and uses the exact ea→line inverse for the reverse). Falls --back to the single marker until the map lands. Verified on the pilot's real worker -+back to the single marker until the map lands. Verified on a real Code Mode database - (alignment + multi-instruction region band). - - **Phase 4 — polish. DONE.** -diff --git a/experiments/worker_smoke.py b/experiments/worker_smoke.py -index b215a57..9b55138 100644 ---- a/experiments/worker_smoke.py -+++ b/experiments/worker_smoke.py -@@ -1,58 +1,56 @@ --"""Runnable read-path smoke: drives the REAL domain.Program through WorkerClient --(our idalib worker over a unix socket). Run when idalib can spawn: -- ~/ida-venv/bin/python experiments/worker_smoke.py --""" --import os, sys, shutil, time --REPO=os.path.expanduser("~/dev/ida-tui-maybe"); sys.path.insert(0, REPO); os.chdir(REPO) --# fresh copy so the worker's idalib doesn't fight any running server --src=f"{REPO}/targets/echo"; tmp="/tmp/echo_worker" --shutil.copy(src, tmp) --for e in ".i64 .id0 .id1 .id2 .nam .til".split(): -- try: os.remove(tmp+e) -- except OSError: pass -- --from idatui.worker_client import WorkerClient --from idatui.domain import Program -- --print("spawning worker + opening echo…", flush=True) --t=time.time() --cl=WorkerClient(tmp) --cl.connect(progress=lambda m: None) --print(f" worker ready in {time.time()-t:.2f}s session={cl.resolve_db()}", flush=True) --prog=Program(cl) -- --# --- drive the REAL domain layer through the worker (read path) --- --main=prog.resolve("main") --print("resolve('main') =", hex(main), flush=True) -+"""Exercise the real domain.Program through an IDA Code Mode lease. - --idx=prog.functions(); idx.load_all() --print("functions() ->", len(idx), "funcs", flush=True) -- --fn=prog.function_of(main) --print("function_of(main) ->", fn.name, hex(fn.addr), "size", fn.size, flush=True) -- --b=prog.read_bytes(main, 16) --print("read_bytes(main,16) ->", b.hex(), flush=True) -- --lm=prog.listing(main) --for _ in range(3): lm.load_next_page() --rows=[lm.get(i) for i in range(min(6,len(lm)))] --print("listing() first rows:", flush=True) --for h in rows: -- if h: print(" ", hex(h.ea), h.kind, repr(h.text[:44]), flush=True) -+A matching registered GUI is reused; otherwise Code Mode starts a managed -+idalib worker. Usage: ``uv run python experiments/worker_smoke.py FILE``. -+""" -+from __future__ import annotations - --d=prog.decompile(main) --print("decompile(main) -> failed?", d.failed, "lines:", len((d.code or '').splitlines()), flush=True) -+import os -+import sys -+import time - --regs=prog.file_regions() --print("file_regions ->", len(regs), "segments", flush=True) -+from idatui.codemode_client import CodeModeClient -+from idatui.domain import Program - --# xrefs to a called function --callee=next((f.addr for f in idx.all_loaded() if f.name.startswith("sub_")), None) --if callee: -- xr=prog.xrefs_to(callee) -- print("xrefs_to(", hex(callee), ") ->", len(xr), "refs", flush=True) - --ok = (fn.name=="main" and len(idx)>100 and b and not d.failed and len(regs)>0) --print("VERDICT:", "OK — domain.Program runs unchanged on the worker" if ok else "FAIL", flush=True) --cl.close() -+def main() -> int: -+ target = os.path.abspath(sys.argv[1] if len(sys.argv) > 1 else "experiments/fibonacci.elf") -+ print(f"attaching Code Mode to {target}…", flush=True) -+ started = time.time() -+ client = CodeModeClient(target) -+ client.connect(progress=lambda message: print(f" {message}", flush=True)) -+ print( -+ f" ready in {time.time() - started:.2f}s; backend={client.backend}; " -+ f"session={client.resolve_db()}", -+ flush=True, -+ ) -+ program = Program(client) -+ try: -+ index = program.functions() -+ index.load_all() -+ print(f"functions() -> {len(index)}", flush=True) -+ first = index.get(0) -+ if first is None: -+ print("VERDICT: FAIL — no functions", flush=True) -+ return 1 -+ fn = program.function_of(first.addr) -+ data = program.read_bytes(first.addr, 16) -+ decompilation = program.decompile(first.addr) -+ print(f"function_of() -> {fn}", flush=True) -+ print(f"read_bytes() -> {data.hex()}", flush=True) -+ print( -+ f"decompile() -> failed={decompilation.failed}; " -+ f"lines={len((decompilation.code or '').splitlines())}", -+ flush=True, -+ ) -+ print(f"file_regions() -> {len(program.file_regions())}", flush=True) -+ ok = fn is not None and bool(data) and bool(program.file_regions()) -+ print(f"VERDICT: {'OK' if ok else 'FAIL'}", flush=True) -+ return 0 if ok else 1 -+ finally: -+ program.close() -+ client.close() -+ -+ -+if __name__ == "__main__": -+ raise SystemExit(main()) -diff --git a/ida-tui b/ida-tui -index 9ceb949..a488cac 100755 ---- a/ida-tui -+++ b/ida-tui -@@ -3,10 +3,9 @@ - # - # ./ida-tui foo.elf # open a binary and drive it — that's it - # --# Opening a binary spins up our own idalib worker (a unix-socket subprocess; --# no HTTP, no supervisor). Uses the venv python that has textual (override with --# $IDATUI_PYTHON); the worker auto-picks the python that has ida_pro_mcp --# (override with $IDATUI_WORKER_PYTHON). -+# The launcher leases a registered IDA GUI or shared managed idalib worker -+# through ida_codemode. The selected Python must have ida-tui's dependencies; -+# override it with $IDATUI_PYTHON. - set -eu - - SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) -diff --git a/idatui/__init__.py b/idatui/__init__.py -index 2cbdde8..7da28b3 100644 ---- a/idatui/__init__.py -+++ b/idatui/__init__.py -@@ -1,5 +1,4 @@ --"""idatui — a minimal keyboard-first TUI for IDA Pro, driving idalib via a --private unix-socket worker (idatui.worker / WorkerClient).""" -+"""idatui — a keyboard-first TUI using shared IDA Code Mode databases.""" - - from .errors import ( - IDAError, -@@ -11,6 +10,7 @@ from .errors import ( - IDASessionError, - Session, - ) -+from .codemode_client import CodeModeClient - from .domain import ( - Program, - FunctionIndex, -@@ -25,6 +25,7 @@ from .domain import ( - ) - - __all__ = [ -+ "CodeModeClient", - "Program", - "FunctionIndex", - "DisasmModel", -diff --git a/idatui/app.py b/idatui/app.py -index 1edc65e..984140f 100644 ---- a/idatui/app.py -+++ b/idatui/app.py -@@ -10,8 +10,8 @@ Design notes: - without ever materializing 52k lines in a widget. - * All network/domain work runs in Textual worker threads; the UI never blocks. - * An address-history stack backs Enter (follow) / Esc (back), IDA-style. --* On startup we bump the worker idle-TTL and run a keepalive heartbeat so the -- session never gets reaped while we chill. -+* Database lifecycle is lease-based through ida_codemode: matching GUI sessions -+ are reused, otherwise a shared managed idalib worker is opened on demand. - """ - - from __future__ import annotations -@@ -30,7 +30,7 @@ from textual import work - from textual.app import App, ComposeResult - from textual.binding import Binding - from textual.command import DiscoveryHit, Hit, Provider --from textual.containers import Grid, Horizontal, Vertical, VerticalScroll -+from textual.containers import Horizontal, Vertical, VerticalScroll - from textual.geometry import Region, Size - from textual.message import Message - from textual.reactive import reactive -@@ -46,8 +46,8 @@ from textual.widgets.option_list import Option - from .highlight import highlight_c - - from .errors import IDAToolError, IDAConnectionError --from .worker_client import WorkerClient --from .domain import DisasmModel, Func, Head, ListingModel, Program, Struct -+from .codemode_client import CodeModeClient, registered_database -+from .domain import Func, Head, ListingModel, Program, Struct - - # Styles for the disassembly listing. - _S_ADDR = Style(color="#6b7684") -@@ -126,8 +126,8 @@ _ADDR_MARK_STRIP_RE = re.compile(r"\s*/\*\s*0x[0-9A-Fa-f]+\s*\*/") - @dataclass - class BinaryState: - """Everything that makes one project binary's session resumable across a -- switch. Addresses outlive the worker, so nav history survives eviction; the -- Program/index only survive while that worker is still resident.""" -+ switch. Addresses outlive a database lease, so nav history survives eviction; -+ the Program/index only survive while that lease remains resident.""" - - label: str - program: object | None = None -@@ -812,9 +812,9 @@ class ListingView(SearchMixin, NavMixin, ColumnCursor, ScrollView, can_focus=Tru - def _span_segments(h: Head, fallback: Style): - """Segments for a row's disassembly text. - -- Uses IDA's own token classification when the worker supplied it; falls -- back to the old mnemonic/rest split so an older worker (or a row whose -- spans didn't match the text) still renders. -+ Uses IDA's own token classification when Code Mode supplies it; falls -+ back to the mnemonic/rest split when spans are absent or disagree with -+ the plain text. - """ - if h.spans: - return [Segment(t, _S_SPAN.get(k, fallback)) for k, t in h.spans] -@@ -2228,12 +2228,16 @@ _HELP = ( - - - class QuitScreen(ModalScreen): -- """Asked before exiting with unsaved database changes. Dismisses with -- "save", "discard" or None (stay).""" -+ """Asked before exiting with unsaved database changes. -+ -+ Code Mode clients cannot roll a shared database back. The ``d`` choice means -+ "do not explicitly save": a GUI keeps the changes dirty, while a managed -+ idalib worker may persist them when its final lease closes. -+ """ - - BINDINGS = [ - Binding("s", "save", "Save & quit"), -- Binding("d", "discard", "Discard & quit"), -+ Binding("d", "discard", "Leave & quit"), - Binding("escape,c", "cancel", "Cancel"), - ] - -@@ -2250,7 +2254,7 @@ class QuitScreen(ModalScreen): - for label in self._labels: - body.append(f" \u2022 {label}\n", _S_LABEL) - yield Static(body, id="quit-list") -- yield Static("s save & quit d discard & quit Esc cancel", -+ yield Static("s save & quit d leave as-is & quit Esc cancel", - id="quit-help") - - def action_save(self) -> None: -@@ -3392,15 +3396,16 @@ class IdaTui(App): - self._index = None # project-wide symbol/string index - if project is not None: - from .index import ProjectIndex -- from .pool import WorkerPool -- self._pool = WorkerPool(project, ttl=ttl) -+ from .pool import DatabasePool -+ self._pool = DatabasePool(project, ttl=ttl) - self._index = ProjectIndex( - os.path.join(project.index_dir, "project.db")) - self._binary = project.refs[0].label - open_path = project.refs[0].staged - self._open_path = open_path - self._ttl = ttl -- self._load_args = load_args or "" # IDA switches for a headerless blob -+ self._load_args = load_args or "" # first-open options for a headerless blob -+ self._new_database = False # Ctrl+L asks Code Mode for a fresh IDB - self._title = (os.path.basename(open_path) if open_path else "") - self._trace_path = trace_path or "" # Tenet execution trace to explore - self._trace = None # the loaded Trace, once analysed -@@ -3414,7 +3419,7 @@ class IdaTui(App): - self._do_keepalive = keepalive - self._rpc_path = rpc_path - self._rpc = None -- self.client: WorkerClient | None = None -+ self.client: CodeModeClient | None = None - self.program: Program | None = None - self._loading_screen: LoadingScreen | None = None - self._ka = None -@@ -3512,8 +3517,8 @@ class IdaTui(App): - if self._rpc_path: - self._start_rpc() - # A file no loader recognises has to be described before it can be -- # opened, so ask BEFORE the worker starts — once IDA has made a database -- # the answer is baked in and changing it means deleting the .i64. -+ # opened, so ask BEFORE Code Mode creates it — once IDA has made a database -+ # the answer is baked in and changing it requires a fresh-IDB reopen. - if self._project is not None: - ref = self._pending_load_ref() - if ref is not None: -@@ -3544,6 +3549,11 @@ class IdaTui(App): - if os.path.exists(self._open_path + ".i64") or os.path.exists( - os.path.splitext(self._open_path)[0] + ".i64"): - return False -+ try: -+ if registered_database(self._open_path): -+ return False -+ except Exception: -+ pass # connect() will surface registry failures with full diagnostics - return needs_load_options(self._open_path) - - def action_load_options(self) -> None: -@@ -3557,7 +3567,11 @@ class IdaTui(App): - forward. - """ - if not self._can_reload(): -- self._status("nothing to reload") -+ if self.client is not None and self.client.backend == "gui": -+ self._status( -+ "reload unavailable for a GUI-owned database — reopen it in IDA") -+ else: -+ self._status("nothing to reload") - return - n = len(self._func_index) if self._func_index else 0 - note = ("this image has no functions, so nothing is lost" -@@ -3576,10 +3590,13 @@ class IdaTui(App): - ref = self._project.by_label(self._binary) - if ref is not None: - path, label = ref.source, ref.label -- # Drop the worker first: it holds the database open, and the .i64 can't -- # be removed (or rebuilt) underneath a live one. -- self._release_worker() -- self._drop_database() -+ # Release our lease first. Code Mode waits for a managed worker's final -+ # lease grace, then creates the replacement IDB atomically. A GUI-backed -+ # database is rejected by _can_reload(): the TUI must never close it. -+ self._release_database() -+ self._new_database = True -+ if label is not None and self._pool is not None: -+ self._pool.recreate_on_next_open(label) - self._reset_for_reload() - self._load_args = "" - if label is not None and self._project is not None: -@@ -3591,7 +3608,9 @@ class IdaTui(App): - self._pending_switch = None - self._ask_load_options(path, label=label) - -- def _release_worker(self) -> None: -+ def _release_database(self) -> None: -+ if self.program is not None: -+ self.program.close() - if self._pool is not None and self._binary is not None: - try: - self._pool.evict(self._binary, save=False) -@@ -3605,23 +3624,6 @@ class IdaTui(App): - self.client = None - self.program = None - -- def _drop_database(self) -> None: -- """Remove the .i64 (and any unpacked scratch) so the next open re-reads -- the raw image with new options.""" -- base = self._open_path -- if self._project is not None and self._binary is not None: -- ref = self._project.by_label(self._binary) -- if ref is not None: -- base = ref.staged -- if not base: -- return -- for suffix in (".i64", ".id0", ".id1", ".id2", ".nam", ".til"): -- for cand in (base + suffix, os.path.splitext(base)[0] + suffix): -- try: -- os.remove(cand) -- except OSError: -- pass -- - def _reset_for_reload(self) -> None: - self._no_functions = False - self._func_index = None -@@ -3665,6 +3667,11 @@ class IdaTui(App): - if os.path.exists(ref.db) or os.path.exists( - os.path.splitext(ref.staged)[0] + ".i64"): - return None # already analysed: the .i64 records how -+ try: -+ if registered_database(ref.staged, output_database=ref.db): -+ return None -+ except Exception: -+ pass - from .formats import needs_load_options - return ref if needs_load_options(ref.source) else None - -@@ -3718,10 +3725,6 @@ class IdaTui(App): - - asyncio.get_running_loop().create_task(_serve()) - -- async def on_unmount(self) -> None: -- if self._rpc is not None: -- await self._rpc.stop() -- - # -- status helper ----------------------------------------------------- # - def _status(self, text: str, priority: bool = False) -> None: - """Write the status bar. ``priority`` marks the RESULT of something the -@@ -3786,9 +3789,10 @@ class IdaTui(App): - - # -- connection loss / recovery --------------------------------------- # - def _handle_exception(self, error: BaseException) -> None: -- """Intercept a lost-connection error from any worker so the whole app -- doesn't die when the analysis server goes away (it can idle out, be -- killed, or the box can sleep). Everything else crashes as usual.""" -+ """Intercept a lost Code Mode lease so the app can rediscover the DB. -+ -+ Everything unrelated to database connectivity crashes as usual. -+ """ - from textual.worker import WorkerFailed - orig = error.error if isinstance(error, WorkerFailed) else error - if isinstance(orig, IDAConnectionError): -@@ -3820,15 +3824,15 @@ class IdaTui(App): - - @work(thread=True, exclusive=True, group="reconnect") - def _reconnect(self) -> None: -- # The worker died (segfault -> dropped socket). Respawn it: it re-opens -- # and re-analyzes the binary in a fresh process, then we rebuild. -+ # The registered instance disappeared. Rediscover it; Code Mode may find -+ # a GUI/replacement worker, then we rebuild caches against the new handle. - try: - if self._open_path is None: - self.app.call_from_thread(self._reconnect_failed, - "no binary to reopen") - return -- client = WorkerClient(self._open_path, ttl=self._ttl, -- load_args=self._load_args) -+ client = CodeModeClient(self._open_path, ttl=self._ttl, -+ load_args=self._load_args) - client.connect(progress=lambda m: self.app.call_from_thread( - self._conn_note, m)) - except Exception as e: # noqa: BLE001 -@@ -3836,7 +3840,7 @@ class IdaTui(App): - return - self.app.call_from_thread(self._after_reconnect, client, Program(client)) - -- def _after_reconnect(self, client: "WorkerClient", program: "Program") -> None: -+ def _after_reconnect(self, client: "CodeModeClient", program: "Program") -> None: - self.client = client - self.program = program - self._reconnecting = False -@@ -3856,13 +3860,13 @@ class IdaTui(App): - @work(thread=True, exclusive=True, group="connect") - def _connect(self) -> None: - try: -- client = self._open_worker_client() -+ client = self._open_database_client() - if client is None: - return # the opener already reported + dismissed the overlay - module = client.health().get("module", "?") - if self._do_keepalive: -- # Keep the session warm while we run; don't make it immortal, so -- # it's reclaimed after the TUI closes. (No-op for the worker.) -+ # Compatibility shim: DatabaseHandle's SSE lease already owns -+ # liveness and heartbeat behavior. - self._ka = client.keepalive(interval=120.0).start() - program = Program(client) - except Exception as e: # noqa: BLE001 -@@ -3877,14 +3881,14 @@ class IdaTui(App): - return - self.client = client - self.program = program -- self.app.call_from_thread(self._status, f"{module} — loading functions…") -+ self._new_database = False -+ self.app.call_from_thread( -+ self._status, f"{module} [{client.backend}] — loading functions…") - self._load_functions() - -- def _open_worker_client(self): # type: ignore[no-untyped-def] -- """Our idalib-worker path: spawn the worker (it opens + analyzes the -- binary in its own process) and connect. Returns the client, or None.""" -- from .worker_client import WorkerClient -- if self._pool is not None: # project mode: the pool owns the workers -+ def _open_database_client(self): # type: ignore[no-untyped-def] -+ """Attach through Code Mode, reusing a GUI or managed idalib database.""" -+ if self._pool is not None: # project mode: the pool owns the leases - label = self._binary or self._project.refs[0].label - client = self._pool.get(label, progress=lambda m: - self.app.call_from_thread(self._status, m)) -@@ -3895,14 +3899,15 @@ class IdaTui(App): - return client - if not self._open_path: - self.app.call_from_thread( -- self._status, "the worker backend needs a binary path") -+ self._status, "Code Mode needs a database or executable path") - self.app.call_from_thread(self._dismiss_loading) - return None - base = os.path.basename(self._open_path) - self.app.call_from_thread( -- self._status, f"starting worker — initial auto-analysis of {base}…") -- client = WorkerClient(self._open_path, ttl=self._ttl, -- load_args=self._load_args) -+ self._status, f"discovering Code Mode database for {base}…") -+ client = CodeModeClient(self._open_path, ttl=self._ttl, -+ load_args=self._load_args, -+ new_database=self._new_database) - client.connect(progress=lambda m: self.app.call_from_thread( - self._status, m)) - return client -@@ -3974,7 +3979,7 @@ class IdaTui(App): - @work(thread=True, exclusive=True, group="index") - def _index_binary(self) -> None: - """Fold this binary's symbols + strings into the project index, so it can -- be searched later even when its worker is gone.""" -+ be searched later even when its Code Mode lease is gone.""" - if self._index is None or self._project is None or self._binary is None: - return - ref = self._project.by_label(self._binary) -@@ -3992,7 +3997,7 @@ class IdaTui(App): - imps, exps = self.program.linkage() - entries += [(KIND_IMPORT, i.addr, i.name) for i in imps] - entries += [(KIND_EXPORT, e.addr, e.name) for e in exps] -- except Exception: # noqa: BLE001 -- an old worker has no list_linkage -+ except Exception: # noqa: BLE001 -- indexing is best-effort - pass - try: - n = self._index.reindex(self._binary, entries, source=ref.source) -@@ -4077,7 +4082,13 @@ class IdaTui(App): - cursor=0, push=True, is_region=True) - - def _can_reload(self) -> bool: -- """Whether we're able to re-open this binary with different options.""" -+ """Whether Code Mode can replace this IDB with different options. -+ -+ A GUI database is owned by the user and has no remote close/rollback -+ route. Managed idalib databases can be released and reopened fresh. -+ """ -+ if self.client is not None and self.client.backend == "gui": -+ return False - if self._project is not None and self._binary is not None: - return True - return bool(self._open_path) -@@ -4267,6 +4278,9 @@ class IdaTui(App): - - def _on_quit_choice(self, choice: str | None) -> None: - if choice == "discard": -+ # Code Mode has no rollback/close-without-save operation. For GUI -+ # sessions this leaves changes dirty in IDA; a managed worker owns -+ # its final save policy and may persist them on final lease release. - self._save_on_exit = False - self.exit() - elif choice == "save": -@@ -4283,7 +4297,7 @@ class IdaTui(App): - if self._pool is not None: - self._pool.close_all(save=True) # saves each resident worker - elif self.program is not None: -- self.program.client.call("idb_save", timeout=600.0) -+ self.program.client.save_database() - except Exception as e: # noqa: BLE001 -- still exit, but say so - self.app.call_from_thread(self._status, f"save failed: {e}") - self.app.call_from_thread(self._finish_exit) -@@ -4323,7 +4337,7 @@ class IdaTui(App): - self._ask_load_options(ref.source, label=label) - return - # Snapshot what we're leaving so coming back restores the view, then let -- # the pool hand us a worker (spawning + evicting as the budget dictates). -+ # the pool hand us a lease (attaching + evicting as the budget dictates). - if self._binary is not None: - self._states[self._binary] = BinaryState( - label=self._binary, program=self.program, -@@ -4344,8 +4358,8 @@ class IdaTui(App): - self.app.call_from_thread(self._switch_failed, label, str(e)) - return - st = self._states.get(label) -- # The Program (and its caches) only survive while that worker does; a -- # binary that was evicted comes back with a fresh one. Either way the nav -+ # The Program (and its caches) only survive while that lease does; an -+ # evicted binary reattaches. Either way the nav - # history is just addresses, so it always survives. - reuse = (st is not None and st.program is not None - and getattr(st.program, "client", None) is client) -@@ -4382,7 +4396,7 @@ class IdaTui(App): - self._did_auto_land = False - self._auto_land() - return -- # Cold (first visit, or the worker was evicted): rebuild the index, then -+ # Cold (first visit, or the lease was evicted): rebuild the index, then - # land back where we were via _pending_restore. - self._cur = None - self._func_index = None -@@ -4439,28 +4453,6 @@ class IdaTui(App): - return - self._goto_ea(addr, push=True) # land on the literal in the listing - -- def on_descendant_focus(self, event) -> None: # type: ignore[no-untyped-def] -- """Keep ``_active`` in step with focus while split. -- -- Tab moves both together, but focus also moves on its own — a click, or a -- pane focusing itself after a load — and then ``_active`` still names the -- pane you're NOT in. Everything downstream trusts ``_active``: follow -- resolves the word under that pane's cursor and pushes history for it, so -- Enter in the pseudocode would follow something from the listing and the -- next Esc got spent undoing it. -- """ -- if not self._split: -- return -- w = self.focused -- mode = ("decomp" if isinstance(w, DecompView) -- else "listing" if isinstance(w, ListingView) else None) -- if mode is None or mode == self._active: -- return -- self._active = mode -- self._sync_split(mode) # re-link the band from the new driver -- if not self.query_one(DecompView).loading: -- self._status_for_cur("split") # never clobber "decompiling…" -- - def action_toggle_view(self) -> None: - """Tab: switch the code pane between disassembly and pseudocode (or leave - the hex view back to the preferred code view).""" -@@ -4807,7 +4799,7 @@ class IdaTui(App): - def _cross_binary_impl(self, name: str) -> tuple[str, int] | None: - """``(binary, addr)`` of a project binary that EXPORTS ``name``. - -- Reads the on-disk index, so a provider resolves even when its worker was -+ Reads the on-disk index, so a provider resolves even when its lease was - evicted — the whole reason the index exists. - """ - if self._index is None or self._project is None or not name: -@@ -4980,7 +4972,7 @@ class IdaTui(App): - def _foreign_importers(self, subj: int, subj_name, fn): # type: ignore[no-untyped-def] - """Project binaries that IMPORT the symbol at ``subj`` — the other half - of the phase-3 join, read from the on-disk index so a caller shows up -- whether or not its worker is resident. -+ whether or not its database lease is resident. - - Only for a symbol this binary actually exports: a local name that - happens to collide with another binary's import isn't a caller of ours. -@@ -5422,7 +5414,7 @@ class IdaTui(App): - kind = "stack" - batch = {"stack": {"func_addr": hex(cur.ea), "old": old, "new": new}} - try: -- res = prog.client.call("rename", batch=batch) -+ res = prog.client.invoke("rename", batch=batch) - except IDAToolError as e: - self.app.call_from_thread(self._status, f"rename failed: {e.message}") - return -@@ -5438,7 +5430,6 @@ class IdaTui(App): - self.app.call_from_thread(self._after_rename, kind, addr, old, new) - - def _after_rename(self, kind: str, addr: int | None, old: str, new: str) -> None: -- cur = self._cur - # A renamed symbol can appear in many functions, so invalidate globally; - # each function refreshes its names the next time it's viewed. - self.program.bump_names() -@@ -5465,7 +5456,7 @@ class IdaTui(App): - — unlike the symbol-by-name path, this names the address directly.""" - assert self.program is not None - try: -- res = self.program.client.call( -+ res = self.program.client.invoke( - "rename", batch={"data": {"addr": hex(addr), "new": name}}) - except IDAToolError as e: - self.app.call_from_thread(self._status, f"name failed: {e.message}") -@@ -5729,7 +5720,6 @@ class IdaTui(App): - screen row, so the eye tracks straight across. - """ - lst = self.query_one(ListingView) -- dec = self.query_one(DecompView) - if lst.model is None: - return False - row = lst.model.ensure_ea(pc) -@@ -6022,7 +6012,7 @@ class IdaTui(App): - def _save(self) -> None: - assert self.program is not None - try: -- self.program.client.call("idb_save", timeout=300.0) -+ self.program.client.save_database() - except Exception as e: # noqa: BLE001 - self.app.call_from_thread(self._status, f"save failed: {e}") - return -@@ -6951,7 +6941,9 @@ class IdaTui(App): - "(c code · p func · u undefine · Enter follow)") - - # -- teardown ---------------------------------------------------------- # -- def on_unmount(self) -> None: -+ async def on_unmount(self) -> None: -+ if self._rpc is not None: -+ await self._rpc.stop() - if self._ka is not None: - self._ka.stop() - if self.program is not None: -@@ -6963,7 +6955,7 @@ class IdaTui(App): - elif self.client is not None: - if self._save_on_exit is None and self._dirty: - try: # unexpected teardown with edits: don't drop them -- self.client.call("idb_save", timeout=600.0) -+ self.client.save_database() - except Exception: # noqa: BLE001 - pass - self.client.close() -diff --git a/idatui/codemode_client.py b/idatui/codemode_client.py -new file mode 100644 -index 0000000..ab4e698 ---- /dev/null -+++ b/idatui/codemode_client.py -@@ -0,0 +1,1107 @@ -+"""Client adapter from ida-tui's domain operations to IDA Code Mode. -+ -+``DatabaseHandle`` is the lifecycle boundary: it discovers an already-registered -+GUI database, reuses a shared managed idalib worker, or starts one when needed. -+The TUI never owns or terminates an IDA process. Closing this client releases -+only its lease. -+ -+The Code Mode transport intentionally exposes one broad operation, -+``execute_python``. ``CodeModeClient.invoke`` turns the small, address-centric -+operations needed by the paging layer into self-contained snippets. The -+snippets prefer the public ``ida-domain`` ``db`` object. A handful of features -+that ida-domain does not currently expose (IDA-coloured listing rows, creating -+instructions, ARM T-state, and detailed Hex-Rays line maps/failures) use the -+IDAPython modules that Code Mode deliberately makes importable. -+""" -+from __future__ import annotations -+ -+import json -+import os -+import shlex -+import threading -+import time -+from textwrap import dedent -+from typing import Any -+ -+from ida_codemode.client import ( -+ ClientError, -+ DatabaseHandle, -+ InstanceDisconnectedError, -+ RemoteError, -+) -+from ida_codemode.registry import ( -+ REGISTRY_DIR, -+ FileLock, -+ RegistryEntry, -+ canonical_path, -+ idb_key, -+ scan_instances, -+) -+from ida_codemode.resolver import IdbBusy, expected_idb_path -+ -+from .errors import IDAConnectionError, IDATimeoutError, IDAToolError, Session -+ -+ -+def registered_database(path: str, output_database: str | None = None) -> bool: -+ """Whether a live/lock-held Code Mode instance owns this target.""" -+ source = canonical_path(path) -+ expected = canonical_path(output_database) if output_database else expected_idb_path(source) -+ expected_key = idb_key(expected) -+ for instance in scan_instances(timeout=0.5): -+ entry = instance.entry -+ if entry.idb_key == expected_key: -+ return True -+ if not output_database and entry.backend == "gui" and entry.exe_path: -+ if canonical_path(entry.exe_path) == source: -+ return True -+ return False -+ -+ -+class _NoopKeepAlive: -+ """Compatibility shim: the DatabaseHandle's SSE lease is the heartbeat.""" -+ -+ def __init__(self) -> None: -+ self.beats = self.failures = 0 -+ -+ def start(self) -> "_NoopKeepAlive": -+ return self -+ -+ def stop(self) -> None: -+ pass -+ -+ -+def _parse_load_args(value: str) -> tuple[str | None, int | None, str | None]: -+ """Translate ida-tui's legacy first-open switches to Code Mode options. -+ -+ Code Mode has typed options for processor, natural loading address and file -+ type. It deliberately has no arbitrary command-line escape hatch; reject -+ switches we cannot represent instead of silently loading a blob wrongly. -+ """ -+ processor: str | None = None -+ loading_address: int | None = None -+ file_type: str | None = None -+ unsupported: list[str] = [] -+ try: -+ words = shlex.split(value or "", posix=os.name != "nt") -+ except ValueError as exc: -+ raise ValueError(f"invalid IDA load options: {exc}") from exc -+ for word in words: -+ if word.startswith("-p") and len(word) > 2: -+ processor = word[2:] -+ elif word.startswith("-b") and len(word) > 2: -+ try: -+ # IDA's -b is in 16-byte paragraphs. DatabaseHandle expects the -+ # natural address, which is the safer public API. -+ loading_address = int(word[2:], 16) << 4 -+ except ValueError as exc: -+ raise ValueError(f"invalid IDA loading address: {word!r}") from exc -+ elif word.startswith("-T") and len(word) > 2: -+ file_type = word[2:] -+ else: -+ unsupported.append(word) -+ if unsupported: -+ joined = " ".join(unsupported) -+ raise ValueError( -+ "ida-codemode cannot represent arbitrary IDA load options: " -+ f"{joined!r}; use processor/base/file type options instead" -+ ) -+ return processor, loading_address, file_type -+ -+ -+def _script(args: dict[str, Any], body: str) -> str: -+ """Bind JSON arguments without interpolating user text into Python code.""" -+ encoded = json.dumps(args, ensure_ascii=False, separators=(",", ":")) -+ return f"import json\na = json.loads({encoded!r})\n{dedent(body).strip()}\n" -+ -+ -+# Rich flat-listing generation is the largest ida-domain gap in this port. -+# ida-domain can enumerate heads and render plain disassembly, but it does not -+# expose undefined runs, IDA colour spans, function banners, or expanded UDT -+# members. Keep that IDAPython-only logic isolated in this one operation. -+_HEADS = r''' -+import ida_bytes, ida_funcs, ida_idaapi, ida_lines, ida_name, ida_nalt, ida_segment, ida_typeinf -+start = int(str(a["addr"]), 16) -+count = max(1, min(int(a.get("count", 200)), 2000)) -+offset = max(0, int(a.get("offset", 0))) -+annotate = bool(a.get("annotate", False)) -+seg = db.segments.get_at(start) -+if seg is None: -+ result = {"addr": a["addr"], "error": "no segment", "heads": [], "cursor": {"done": True}} -+else: -+ lo, hi = int(seg.start_ea), int(seg.end_ea) -+ if a.get("end"): -+ hi = min(hi, int(str(a["end"]), 16)) -+ -+ span_names = { -+ "insn": ("SCOLOR_INSN", "SCOLOR_KEYWORD", "SCOLOR_ASMDIR", "SCOLOR_MACRO"), -+ "reg": ("SCOLOR_REG",), -+ "num": ("SCOLOR_NUMBER", "SCOLOR_CHAR", "SCOLOR_BINPREF"), -+ "str": ("SCOLOR_STRING",), -+ "name": ("SCOLOR_DATNAME", "SCOLOR_CODNAME", "SCOLOR_LOCNAME", "SCOLOR_IMPNAME", -+ "SCOLOR_DEMNAME", "SCOLOR_LIBNAME", "SCOLOR_CNAME", "SCOLOR_DNAME", -+ "SCOLOR_CREF", "SCOLOR_DREF", "SCOLOR_CREFTAIL", "SCOLOR_DREFTAIL"), -+ "seg": ("SCOLOR_SEGNAME",), -+ "cmt": ("SCOLOR_AUTOCMT", "SCOLOR_REGCMT", "SCOLOR_RPTCMT", "SCOLOR_VOIDOP"), -+ "punct": ("SCOLOR_SYMBOL", "SCOLOR_ALTOP", "SCOLOR_HIDNAME"), -+ "err": ("SCOLOR_ERROR",), -+ } -+ tag_kinds = {} -+ for kind, names in span_names.items(): -+ for name in names: -+ value = getattr(ida_lines, name, None) -+ if isinstance(value, str) and value: -+ tag_kinds[value[0]] = kind -+ elif isinstance(value, int): -+ tag_kinds[chr(value)] = kind -+ -+ def spans(tagged): -+ on, off, esc = "\x01", "\x02", "\x03" -+ addr_tag = chr(getattr(ida_lines, "COLOR_ADDR", 0x28)) -+ addr_len = int(getattr(ida_lines, "COLOR_ADDR_SIZE", 16)) -+ out, stack, buf = [], [], [] -+ def flush(): -+ if buf: -+ out.append([stack[-1] if stack else "text", "".join(buf)]) -+ buf.clear() -+ i = 0 -+ while i < len(tagged): -+ ch = tagged[i] -+ if ch == on and i + 1 < len(tagged): -+ tag = tagged[i + 1] -+ if tag == addr_tag: -+ i += 2 + addr_len -+ continue -+ flush(); stack.append(tag_kinds.get(tag, "text")); i += 2; continue -+ if ch == off and i + 1 < len(tagged): -+ flush() -+ if stack: stack.pop() -+ i += 2; continue -+ if ch == esc and i + 1 < len(tagged): -+ buf.append(tagged[i + 1]); i += 2; continue -+ buf.append(ch); i += 1 -+ flush() -+ collapsed, previous_space = [], False -+ for kind, text in out: -+ acc = [] -+ for ch in text: -+ if ch.isspace(): -+ if previous_space: continue -+ acc.append(" "); previous_space = True -+ else: -+ acc.append(ch); previous_space = False -+ if acc: collapsed.append([kind, "".join(acc)]) -+ if collapsed: -+ collapsed[0][1] = collapsed[0][1].lstrip() -+ collapsed[-1][1] = collapsed[-1][1].rstrip() -+ return [[kind, text] for kind, text in collapsed if text] -+ -+ def row(ea): -+ flags = ida_bytes.get_flags(ea) -+ kind = "code" if ida_bytes.is_code(flags) else ("data" if ida_bytes.is_data(flags) else "unknown") -+ tagged = ida_lines.generate_disasm_line(ea, 0) or "" -+ text = " ".join(ida_lines.tag_remove(tagged).split()) if tagged else "" -+ item = {"ea": hex(ea), "kind": kind, "size": int(ida_bytes.get_item_size(ea)), "text": text} -+ if tagged: -+ rich = spans(tagged) -+ if " ".join("".join(x[1] for x in rich).split()) == text: -+ item["spans"] = rich -+ name = ida_name.get_ea_name(ea) -+ if name: item["name"] = name -+ return item -+ -+ def unknown_row(ea, size): -+ if size <= 1: return row(ea) -+ item = {"ea": hex(ea), "kind": "unknown", "size": int(size), "text": f"db {size} dup(?)"} -+ name = ida_name.get_ea_name(ea) -+ if name: item["name"] = name -+ return item -+ -+ def members(ea): -+ tif = db.types.get_at(ea) -+ if tif is None or not tif.is_udt(): return [] -+ answer = [] -+ for member in db.types.get_udt_members(tif): -+ type_text = member.type.dstr() or "" -+ text = f"+{member.offset:X} {member.name}" + (f" {type_text}" if type_text else "") -+ answer.append({"ea": hex(ea + member.offset), "kind": "member", -+ "size": int(member.size), "text": text}) -+ return answer -+ -+ def is_unknown(ea): -+ flags = ida_bytes.get_flags(ea) -+ return not (ida_bytes.is_code(flags) or ida_bytes.is_data(flags)) -+ def run_end(ea): -+ nxt = ida_bytes.next_head(ea, hi) -+ return nxt if nxt != ida_idaapi.BADADDR and ea < nxt <= hi else hi -+ def advance(ea): -+ if is_unknown(ea): return run_end(ea) -+ nxt = ida_bytes.get_item_end(ea) -+ return nxt if nxt > ea else ea + 1 -+ def rows_for(ea): -+ if is_unknown(ea): return [unknown_row(ea, run_end(ea) - ea)] -+ fn = db.functions.get_at(ea) if annotate else None -+ at_start = fn is not None and int(fn.start_ea) == ea -+ answer = [] -+ if at_start: -+ name = db.functions.get_name(fn) or f"sub_{ea:X}" -+ answer += [ -+ {"ea": hex(ea), "kind": "sep", "size": 0, "text": ""}, -+ {"ea": hex(ea), "kind": "sep", "size": 0, -+ "text": "; " + "=" * 15 + " S U B R O U T I N E " + "=" * 15}, -+ {"ea": hex(ea), "kind": "funchdr", "size": 0, -+ "text": name + " proc", "name": name}, -+ ] -+ item = row(ea) -+ if at_start: -+ item["name"] = None -+ elif annotate and item["kind"] == "code" and item.get("name"): -+ name = item["name"] -+ answer.append({"ea": hex(ea), "kind": "label", "size": 0, -+ "text": name + ":", "name": name}) -+ item["name"] = None -+ answer.append(item) -+ if item["kind"] == "data": answer += members(ea) -+ if fn is not None and ida_bytes.get_item_end(ea) >= int(fn.end_ea): -+ name = db.functions.get_name(fn) or f"sub_{int(fn.start_ea):X}" -+ answer += [ -+ {"ea": hex(ea), "kind": "funchdr", "size": 0, -+ "text": name + " endp", "name": name}, -+ {"ea": hex(ea), "kind": "sep", "size": 0, "text": "; " + "-" * 60}, -+ ] -+ return answer -+ -+ ea = ida_bytes.get_item_head(start) -+ if ea == ida_idaapi.BADADDR: ea = start -+ for _ in range(offset): -+ if ea >= hi: break -+ ea = advance(ea) -+ rows = [] -+ more = False -+ while ea != ida_idaapi.BADADDR and ea < hi: -+ if len(rows) >= count: -+ more = True; break -+ rows += rows_for(ea) -+ ea = advance(ea) -+ result = {"addr": a["addr"], "heads": rows, -+ "cursor": {"next": hex(ea)} if more else {"done": True}} -+result -+''' -+ -+ -+_DECOMP_MAP_HELPER = r''' -+def line_map(cfunc): -+ import ida_hexrays -+ answer = [] -+ for sl in cfunc.get_pseudocode(): -+ tagged, eas, seen = sl.line, [], set() -+ for x in range(len(tagged) + 1): -+ head = ida_hexrays.ctree_item_t(); item = ida_hexrays.ctree_item_t(); tail = ida_hexrays.ctree_item_t() -+ if not cfunc.get_line_item(tagged, x, False, head, item, tail): continue -+ text = item.dstr() or "" -+ try: ea = int(text.split(": ", 1)[0], 16) -+ except (ValueError, IndexError): continue -+ if ea not in seen: seen.add(ea); eas.append(ea) -+ answer.append(eas) -+ return answer -+''' -+ -+ -+_OPERATIONS: dict[str, str] = { -+ "list_funcs": r''' -+import fnmatch -+queries = a.get("queries") or [{}] -+q = queries[0] -+offset, count = max(0, int(q.get("offset", 0))), max(1, int(q.get("count", 500))) -+pattern = str(q.get("filter") or "").lower() -+if pattern and not any(ch in pattern for ch in "*?["): pattern = "*" + pattern + "*" -+rows = [] -+for fn in db.functions.get_all(): -+ name = db.functions.get_name(fn) or f"sub_{int(fn.start_ea):X}" -+ if pattern and not fnmatch.fnmatchcase(name.lower(), pattern): continue -+ rows.append({"addr": hex(int(fn.start_ea)), "name": name, -+ "size": int(fn.end_ea) - int(fn.start_ea)}) -+page = rows[offset:offset + count] -+result = {"result": [{"data": page, "next_offset": offset + len(page), "total": len(rows)}]} -+result -+''', -+ "disasm": r''' -+ea = int(str(a["addr"]), 16) -+fn = db.functions.get_at(ea) -+if fn is None: -+ result = {"instructions": [], "total_instructions": 0, "instruction_count": 0} -+else: -+ instructions = list(db.functions.get_instructions(fn)) -+ limit = max(1, int(a.get("max_instructions", len(instructions) or 1))) -+ rows = [{"addr": hex(int(insn.ea)), "instruction": db.instructions.get_disassembly(insn)} -+ for insn in instructions[:limit]] -+ result = {"instructions": rows, "total_instructions": len(instructions), -+ "instruction_count": len(instructions)} -+result -+''', -+ "file_regions": r''' -+import idaapi -+rows = [] -+for seg in db.segments.get_all(): -+ try: file_off = int(idaapi.get_fileregion_offset(seg.start_ea)) -+ except Exception: file_off = -1 -+ if file_off < 0 or file_off >= (1 << 48): file_off = -1 -+ rows.append({"start": hex(int(seg.start_ea)), "end": hex(int(seg.end_ea)), -+ "file_off": file_off, "name": db.segments.get_name(seg) or ""}) -+result = {"regions": rows} -+result -+''', -+ "read_raw": r''' -+import ida_bytes -+ea, size = int(str(a["addr"]), 16), max(0, int(a["size"])) -+raw = ida_bytes.get_bytes(ea, size) or b"" -+raw = raw[:size] + b"\xff" * max(0, size - len(raw)) -+data = bytearray(raw) -+for index, value in enumerate(data): -+ if value == 0xFF and not ida_bytes.is_loaded(ea + index): data[index] = 0 -+result = {"addr": a["addr"], "hex": bytes(data).hex(), "n": len(data)} -+result -+''', -+ "get_bytes": r''' -+rows = [] -+for region in a.get("regions", []): -+ ea, size = int(str(region["addr"]), 16), int(region["size"]) -+ raw = db.bytes.get_bytes_at(ea, size) or b"" -+ rows.append({"addr": region["addr"], "data": " ".join(f"{b:02x}" for b in raw)}) -+result = {"result": rows} -+result -+''', -+ "search_structs": r''' -+needle = str(a.get("filter") or "").lower() -+rows = [] -+for tif in db.types.get_all(): -+ name = tif.get_type_name() or "" -+ if not name or needle not in name.lower() or not tif.is_udt(): continue -+ members = list(db.types.get_udt_members(tif)) -+ rows.append({"name": name, "size": int(tif.get_size()), "is_union": bool(tif.is_union()), -+ "cardinality": len(members), "ordinal": int(tif.get_ordinal())}) -+result = {"result": rows} -+result -+''', -+ "type_inspect": r''' -+rows = [] -+for query in a.get("queries", []): -+ name = str(query.get("name") or "") -+ tif = db.types.get_by_name(name) -+ if tif is None: -+ rows.append({"name": name, "error": "type not found"}); continue -+ members = [{"name": m.name, "type": m.type.dstr() or str(m.type), -+ "offset": int(m.offset), "size": int(m.size)} -+ for m in db.types.get_udt_members(tif)] if tif.is_udt() else [] -+ rows.append({"name": name, "size": int(tif.get_size()), "is_union": bool(tif.is_union()), -+ "members": members}) -+result = {"result": rows} -+result -+''', -+ "declare_type": r''' -+import ida_typeinf -+decls = a.get("decls", "") -+if isinstance(decls, str): decls = [decls] -+rows = [] -+for declaration in decls: -+ try: -+ errors = int(db.types.parse_declarations(ida_typeinf.get_idati(), declaration)) -+ rows.append({"ok": errors == 0, **({} if errors == 0 else {"error": f"{errors} parse error(s)"})}) -+ except Exception as exc: -+ rows.append({"ok": False, "error": str(exc)}) -+result = {"result": rows} -+result -+''', -+ "del_type": r''' -+import ida_typeinf -+name = str(a["name"]) -+ok = bool(ida_typeinf.del_named_type(ida_typeinf.get_idati(), name, ida_typeinf.NTF_TYPE)) -+result = {"name": name, "deleted": ok, **({} if ok else {"error": f"Type {name!r} not found or could not be deleted"})} -+result -+''', -+ "func_types": r''' -+import ida_typeinf -+ea = int(str(a["addr"]), 16) -+fn = db.functions.get_at(ea) -+if fn is None: -+ result = {"addr": a["addr"], "error": "no function at address"} -+else: -+ pseudo = db.pseudocode.decompile(fn) -+ name = db.functions.get_name(fn) or "" -+ tif = pseudo.get_func_type() -+ try: prototype = ida_typeinf.print_tinfo("", 0, 0, ida_typeinf.PRTYPE_1LINE, tif, name, "") if tif else "" -+ except Exception: prototype = tif.dstr() if tif else "" -+ lvars = [{"name": var.name, "type": var.type_info.dstr() if var.type_info else "", -+ "is_arg": bool(var.is_arg)} for var in pseudo.local_variables] -+ result = {"addr": hex(int(fn.start_ea)), "name": name, -+ "prototype": (prototype or "").strip(), "lvars": lvars} -+result -+''', -+ "set_lvar_type": r''' -+import ida_typeinf -+ea, variable, declaration = int(str(a["addr"]), 16), str(a["variable"]), str(a["type"]) -+fn = db.functions.get_at(ea) -+if fn is None: -+ result = {"error": "no function at address"} -+else: -+ pseudo = db.pseudocode.decompile(fn) -+ var = pseudo.find_local_variable(variable) -+ if var is None: -+ result = {"error": f"local variable {variable!r} not found"} -+ else: -+ try: -+ tif = db.types.parse_one_declaration(ida_typeinf.get_idati(), declaration) -+ accepted = bool(var.set_type(tif)) -+ saved = bool(pseudo.save_local_variable_info(var, save_type=True)) if accepted else False -+ result = {"addr": hex(int(fn.start_ea)), "variable": variable, -+ "type": declaration, "ok": accepted and saved} -+ except Exception as exc: -+ result = {"error": f"bad type {declaration!r}: {exc}"} -+result -+''', -+ "set_type": r''' -+from ida_domain.types import TypeApplyFlags -+rows = [] -+for edit in a.get("edits", []): -+ ea = int(str(edit["addr"]), 16) -+ declaration = str(edit.get("signature") or edit.get("type") or "") -+ try: -+ ok = bool(db.types.apply_declaration_at(ea, declaration, TypeApplyFlags.DEFINITE)) -+ rows.append({"addr": hex(ea), "ok": ok, **({} if ok else {"error": "IDA rejected the type"})}) -+ except Exception as exc: -+ rows.append({"addr": hex(ea), "ok": False, "error": str(exc)}) -+result = {"result": rows} -+result -+''', -+ "data_type": r''' -+ea = int(str(a["addr"]), 16) -+try: -+ tif = db.types.get_at(ea) -+ fn = db.functions.get_at(ea) -+ result = {"addr": hex(ea), "name": db.names.get_at(ea) or "", -+ "type": tif.dstr() if tif else "", "size": int(db.heads.size(ea)) if db.heads.is_head(ea) else 0, -+ "is_func": bool(fn)} -+except Exception as exc: -+ result = {"addr": hex(ea), "error": str(exc)} -+result -+''', -+ "force_recompile": r''' -+import ida_hexrays -+rows = [] -+for item in a.get("items", []): -+ ea = int(str(item["addr"]), 16) -+ ida_hexrays.mark_cfunc_dirty(ea, False) -+ rows.append({"addr": hex(ea), "ok": True}) -+result = {"result": rows} -+result -+''', -+ "undefine": r''' -+import ida_bytes -+rows = [] -+for item in a.get("items", []): -+ ea = int(str(item["addr"]), 16) -+ size = max(1, int(item.get("size") or ida_bytes.get_item_size(ea) or 1)) -+ ok = bool(ida_bytes.del_items(ea, ida_bytes.DELIT_SIMPLE, size)) -+ rows.append({"addr": hex(ea), "ok": ok, **({} if ok else {"error": "delete items failed"})}) -+result = {"result": rows} -+result -+''', -+ "define_code": r''' -+import ida_ua -+rows = [] -+for item in a.get("items", []): -+ ea = int(str(item["addr"]), 16); size = int(ida_ua.create_insn(ea)) -+ rows.append({"addr": hex(ea), "ok": size > 0, "size": size, -+ **({} if size > 0 else {"error": "instruction did not decode"})}) -+result = {"result": rows} -+result -+''', -+ "define_func": r''' -+rows = [] -+for item in a.get("items", []): -+ ea = int(str(item["addr"]), 16); ok = bool(db.functions.create(ea)) -+ rows.append({"addr": hex(ea), "ok": ok, **({} if ok else {"error": "IDA refused the function"})}) -+result = {"result": rows} -+result -+''', -+ "make_data": r''' -+import ida_bytes, ida_idaapi, ida_typeinf -+from ida_domain.types import TypeApplyFlags -+rows = [] -+for item in a.get("items", []): -+ ea, declaration = int(str(item["addr"]), 16), str(item["type"]) -+ try: -+ tif = db.types.parse_one_declaration(ida_typeinf.get_idati(), declaration) -+ size = max(1, int(tif.get_size())) -+ saved_names = [(addr, name) for addr, name in db.names.get_all() -+ if ea <= int(addr) < ea + size] -+ ida_bytes.del_items(ea, ida_bytes.DELIT_EXPAND | ida_bytes.DELIT_DELNAMES, -+ max(size, int(ida_bytes.get_item_size(ea) or 1))) -+ created = bool(ida_bytes.create_data(ea, ida_bytes.FF_BYTE, size, ida_idaapi.BADADDR)) -+ ok = created and bool(db.types.apply_at(tif, ea, TypeApplyFlags.DEFINITE)) -+ for address, name in saved_names: -+ db.names.set_name(int(address), name) -+ if ok and item.get("name"): ok = bool(db.names.set_name(ea, str(item["name"]))) -+ rows.append({"addr": hex(ea), "ok": ok, "size": size, -+ **({} if ok else {"error": "IDA rejected the data type"})}) -+ except Exception as exc: -+ rows.append({"addr": hex(ea), "ok": False, "error": str(exc)}) -+result = {"result": rows} -+result -+''', -+ "make_string": r''' -+from ida_domain.strings import StringType -+ea, length = int(str(a["addr"]), 16), max(0, int(a.get("length", 0))) -+kind = {"c": StringType.C, "c16": StringType.C_16, "c32": StringType.C_32, -+ "pascal": StringType.PASCAL}.get(str(a.get("kind", "c")).lower(), StringType.C) -+import ida_bytes -+try: -+ ida_bytes.del_items(ea, ida_bytes.DELIT_SIMPLE, length if length > 0 else 1) -+except Exception: -+ pass -+try: -+ ok = bool(db.bytes.create_string_at(ea, length or None, kind)) -+ text = db.bytes.get_string_at(ea) or "" if ok else "" -+ result = {"addr": hex(ea), "ok": ok, "size": int(db.heads.size(ea)) if ok else 0, "text": text} -+except Exception as exc: -+ result = {"addr": hex(ea), "ok": False, "error": str(exc)} -+result -+''', -+ "list_strings": r''' -+from ida_domain.strings import StringListConfig -+offset, count, min_len = max(0, int(a.get("offset", 0))), max(1, int(a.get("count", 2000))), max(1, int(a.get("min_len", 4))) -+if offset == 0 or a.get("refresh"): -+ from ida_domain.strings import StringType -+ db.strings.rebuild(StringListConfig(string_types=list(StringType), min_len=min_len, -+ only_ascii_7bit=False)) -+items = list(db.strings.get_all()) -+page = items[offset:offset + count] -+rows = [] -+for item in page: -+ try: text = str(item) -+ except Exception: text = item.contents.decode("utf-8", "replace") if item.contents else "" -+ rows.append({"addr": hex(int(item.address)), "text": text, "len": int(item.length), "type": item.type.name}) -+result = {"strings": rows, "total": len(items), "next_offset": offset + len(rows)} -+result -+''', -+ "list_linkage": r''' -+imports = [{"addr": hex(int(item.address)), "name": item.name, "module": item.module_name} -+ for item in db.imports.get_all_imports() if item.name] -+exports = [{"addr": hex(int(item.address)), "name": item.name, "ordinal": int(item.ordinal)} -+ for item in db.entries.get_all() if item.name] -+result = {"imports": imports, "exports": exports, -+ "n_imports": len(imports), "n_exports": len(exports)} -+result -+''', -+ "lookup_funcs": r''' -+rows = [] -+for query in a.get("queries", []): -+ raw = str(query) -+ try: ea = int(raw, 16) -+ except ValueError: -+ fn = db.functions.get_by_name(raw); ea = int(fn.start_ea) if fn else None -+ else: fn = db.functions.get_at(ea) -+ if fn is None: -+ rows.append({"query": raw, "fn": None}) -+ else: -+ rows.append({"query": raw, "fn": {"addr": hex(int(fn.start_ea)), -+ "name": db.functions.get_name(fn) or f"sub_{int(fn.start_ea):X}", -+ "size": int(fn.end_ea) - int(fn.start_ea)}}) -+result = {"result": rows} -+result -+''', -+ "resolve_names": r''' -+import ida_idaapi, ida_name -+rows = [] -+for query in a.get("queries", []): -+ name = str(query).strip(); ea = ida_name.get_name_ea(ida_idaapi.BADADDR, name) -+ rows.append({"query": name, "ea": hex(int(ea)) if ea != ida_idaapi.BADADDR else None}) -+result = {"result": rows} -+result -+''', -+ "xref_types": r''' -+queries = a.get("queries") or [] -+all_results = [] -+for query in queries: -+ ea, direction = int(str(query["addr"]), 16), str(query.get("direction", "both")) -+ refs = [] -+ if direction in ("to", "both"): refs += list(db.xrefs.to_ea(ea)) -+ if direction in ("from", "both"): refs += list(db.xrefs.from_ea(ea)) -+ rows, seen = [], set() -+ for ref in refs: -+ key = (int(ref.from_ea), int(ref.to_ea), int(ref.type)) -+ if query.get("dedup") and key in seen: continue -+ seen.add(key) -+ fn = db.functions.get_at(int(ref.from_ea)) -+ kind = ("call" if ref.is_call else "jump" if ref.is_jump else "flow" if ref.is_flow -+ else "read" if ref.is_read else "write" if ref.is_write else ref.type.name.lower()) -+ row = {"from": hex(int(ref.from_ea)), "to": hex(int(ref.to_ea)), -+ "type": "code" if ref.is_code else "data", "kind": kind} -+ if query.get("include_fn") and fn is not None: -+ row["fn"] = {"addr": hex(int(fn.start_ea)), "name": db.functions.get_name(fn) or ""} -+ rows.append(row) -+ if len(rows) >= int(query.get("count", 2000)): break -+ all_results.append({"data": rows}) -+result = {"result": all_results} -+result -+''', -+ "xref_query": r''' -+queries = a.get("queries") or [] -+all_results = [] -+for query in queries: -+ ea, direction = int(str(query["addr"]), 16), str(query.get("direction", "both")) -+ refs = [] -+ if direction in ("to", "both"): refs += list(db.xrefs.to_ea(ea)) -+ if direction in ("from", "both"): refs += list(db.xrefs.from_ea(ea)) -+ rows = [] -+ for ref in refs[:int(query.get("count", 2000))]: -+ fn = db.functions.get_at(int(ref.from_ea)) -+ row = {"from": hex(int(ref.from_ea)), "to": hex(int(ref.to_ea)), -+ "type": "code" if ref.is_code else "data"} -+ if query.get("include_fn") and fn is not None: -+ row["fn"] = {"addr": hex(int(fn.start_ea)), "name": db.functions.get_name(fn) or ""} -+ rows.append(row) -+ all_results.append({"data": rows}) -+result = {"result": all_results} -+result -+''', -+ "set_comments": r''' -+rows = [] -+for item in a.get("items", []): -+ ea, text = int(str(item["addr"]), 16), str(item.get("comment") or "") -+ try: -+ if text: ok = bool(db.comments.set_at(ea, text)) -+ else: db.comments.delete_at(ea); ok = True -+ rows.append({"addr": hex(ea), "ok": ok}) -+ except Exception as exc: -+ rows.append({"addr": hex(ea), "ok": False, "error": str(exc)}) -+result = {"result": rows} -+result -+''', -+ "rename": r''' -+import ida_idaapi, ida_name, ida_typeinf -+batch = a.get("batch") or {} -+out = {}; ok_count = failed = 0 -+for category, edit in batch.items(): -+ try: -+ if category == "func": -+ ea, new = int(str(edit["addr"]), 16), str(edit["name"]) -+ fn = db.functions.get_at(ea); ok = bool(fn and db.functions.set_name(fn, new)) -+ elif category == "data": -+ new = str(edit.get("new") or "") -+ if edit.get("addr") is not None: ea = int(str(edit["addr"]), 16) -+ else: ea = int(ida_name.get_name_ea(ida_idaapi.BADADDR, str(edit.get("old") or ""))) -+ ok = bool(db.names.set_name(ea, new)) -+ elif category in ("local", "stack"): -+ ea, old, new = int(str(edit["func_addr"]), 16), str(edit["old"]), str(edit["new"]) -+ pseudo = db.pseudocode.decompile(ea); var = pseudo.find_local_variable(old) -+ if var is None: ok = False -+ else: -+ var.set_user_name(new) -+ ok = bool(pseudo.save_local_variable_info(var, save_name=True)) -+ else: -+ raise ValueError(f"unsupported rename category: {category}") -+ row = {"ok": ok, **({} if ok else {"error": "IDA rejected the name"})} -+ except Exception as exc: -+ row = {"ok": False, "error": str(exc)} -+ out[category] = [row] -+ if row["ok"]: ok_count += 1 -+ else: failed += 1 -+out["summary"] = {"ok": ok_count, "failed": failed} -+result = out -+result -+''', -+} -+ -+ -+_OPERATIONS["decompile"] = _DECOMP_MAP_HELPER + r''' -+ea = int(str(a["addr"]), 16) -+fn = db.functions.get_at(ea) -+if fn is None: -+ result = {"error": f"no function at {ea:#x}"} -+else: -+ pseudo = db.pseudocode.decompile(fn) -+ mapping = line_map(pseudo.raw_cfunc) -+ plain = pseudo.to_text() -+ marked = [line + (f" /*0x{eas[0]:X}*/" if eas else "") -+ for line, eas in zip(plain, mapping)] -+ import ida_name -+ refs, seen = [], set() -+ for expr in pseudo.find_objects(): -+ target = int(expr.obj_ea) -+ if target in seen or not (db.is_valid_ea(target) or db.is_private_ea(target)): continue -+ seen.add(target) -+ name = expr.obj_name or ida_name.get_name(target) or "" -+ try: string = db.bytes.get_string_at(target) if db.is_valid_ea(target) else None -+ except Exception: string = None -+ refs.append({"addr": hex(target), "name": name, "string": string}) -+ result = {"addr": hex(int(fn.start_ea)), "code": "\n".join(marked), "refs": refs} -+result -+''' -+ -+_OPERATIONS["decomp_map"] = _DECOMP_MAP_HELPER + r''' -+ea = int(str(a["addr"]), 16) -+fn = db.functions.get_at(ea) -+if fn is None: -+ result = {"error": f"no function at {ea:#x}"} -+else: -+ pseudo = db.pseudocode.decompile(fn) -+ mapping = line_map(pseudo.raw_cfunc) -+ result = {"addr": hex(int(fn.start_ea)), -+ "lines": [{"ea": hex(eas[0]) if eas else None, -+ "eas": [hex(item) for item in eas]} for eas in mapping]} -+result -+''' -+ -+_OPERATIONS["define_code_run"] = r''' -+import ida_bytes, ida_idp, ida_segment, ida_ua, idaapi -+ea, limit = int(str(a["addr"]), 16), max(1, min(int(a.get("limit", 20000)), 200000)) -+seg = ida_segment.getseg(ea) -+if seg is None: -+ result = {"addr": a["addr"], "error": "no segment", "count": 0} -+else: -+ start, count, stopped, hi = ea, 0, "limit", int(seg.end_ea) -+ while count < limit: -+ if ea >= hi: stopped = "segment"; break -+ flags = ida_bytes.get_flags(ea) -+ if ida_bytes.is_code(flags) or ida_bytes.is_data(flags): stopped = "defined"; break -+ size = int(ida_ua.create_insn(ea)) -+ if size <= 0: stopped = "undecodable"; break -+ count += 1 -+ insn = ida_ua.insn_t() -+ if ida_ua.decode_insn(insn, ea) > 0: -+ try: is_ret = bool(ida_idp.is_ret_insn(insn)) -+ except Exception: is_ret = False -+ if is_ret or (insn.get_canon_feature() & idaapi.CF_STOP): -+ ea += size; stopped = "flow"; break -+ ea += size -+ result = {"start": hex(start), "end": hex(ea), "count": count, "stopped": stopped} -+result -+''' -+ -+_OPERATIONS["define_func_run"] = r''' -+import ida_bytes, ida_funcs, ida_segment -+ea = int(str(a["addr"]), 16) -+fn = db.functions.get_at(ea) -+if fn is not None and int(fn.start_ea) == ea: -+ result = {"addr": hex(ea), "ok": True, "start": hex(ea), "end": hex(int(fn.end_ea)), "how": "existed"} -+else: -+ automatic = bool(db.functions.create(ea)) -+ if not automatic: -+ seg = db.segments.get_at(ea); end = ea; hi = int(seg.end_ea) if seg else ea -+ while end < hi and ida_bytes.is_code(ida_bytes.get_flags(end)): -+ nxt = int(ida_bytes.get_item_end(end)) -+ if nxt <= end: break -+ end = nxt -+ ok = bool(end > ea and ida_funcs.add_func(ea, end)) -+ else: ok = True -+ fn = db.functions.get_at(ea) -+ result = ({"addr": hex(ea), "ok": True, "start": hex(int(fn.start_ea)), -+ "end": hex(int(fn.end_ea)), "how": "auto" if automatic else "explicit-end"} -+ if ok and fn is not None else -+ {"addr": hex(ea), "ok": False, "error": f"IDA refused a function at {ea:#x}"}) -+result -+''' -+ -+_OPERATIONS["set_thumb"] = r''' -+import ida_bytes, ida_ida, ida_idp, ida_segment, ida_segregs -+ea = int(str(a["addr"]), 16); treg = ida_idp.str2reg("T") -+seg = ida_segment.getseg(ea) -+if treg is None or treg < 0: -+ result = {"addr": hex(ea), "error": "no T register (not an ARM database)"} -+elif seg is None: -+ result = {"addr": hex(ea), "error": "no segment"} -+else: -+ current = ida_segregs.get_sreg(ea, treg) -+ current = 0 if current in (None, 0xFFFFFFFF, -1) else int(current) -+ want = {"on": 1, "off": 0}.get(str(a.get("mode", "toggle")).lower(), 0 if current else 1) -+ changed = False -+ if want and seg.bitness != 1: -+ ida_segment.set_segm_addressing(seg, 1); changed = True -+ size = max(int(ida_bytes.get_item_size(ea)), 2) -+ ida_bytes.del_items(ea, 0, size) -+ ok = bool(ida_segregs.split_sreg_range(ea, treg, want, ida_segregs.SR_user)) -+ now = ida_segregs.get_sreg(ea, treg) -+ result = {"addr": hex(ea), "thumb": bool(now), "was": bool(current), "ok": ok, -+ "bitness": ida_segment.getseg(ea).bitness, "forced_32bit": changed, -+ "db_64bit": bool(ida_ida.inf_get_app_bitness() == 64 and want)} -+result -+''' -+ -+_OPERATIONS["thumb_scan"] = r''' -+import ida_bytes, ida_funcs, ida_idp, ida_segment, ida_segregs, ida_ua -+lo, hi = int(str(a["start"]), 16), int(str(a["end"]), 16) -+apply, limit = bool(a.get("apply", True)), int(a.get("limit", 512)) -+treg = ida_idp.str2reg("T"); found = []; applied = 0; cursor = lo -+while cursor + 4 <= hi and len(found) < limit: -+ at = cursor; value = int(ida_bytes.get_dword(cursor)); cursor += 4 -+ if not value & 1: continue -+ target = value & ~1; seg = ida_segment.getseg(target) -+ if seg is None or not (seg.perm & ida_segment.SEGPERM_EXEC or seg.perm == 0): continue -+ flags = ida_bytes.get_flags(target) -+ if ida_bytes.is_data(flags): continue -+ item = {"at": hex(at), "value": hex(value), "target": hex(target), -+ "was_code": bool(ida_bytes.is_code(flags))}; found.append(item) -+ if not apply: continue -+ if treg is not None and treg >= 0: ida_segregs.split_sreg_range(target, treg, 1, ida_segregs.SR_user) -+ if not ida_bytes.is_code(ida_bytes.get_flags(target)): -+ ida_bytes.del_items(target, 0, 2) -+ if ida_ua.create_insn(target) <= 0: item["decoded"] = False; continue -+ item["decoded"] = True; item["function"] = bool(db.functions.get_at(target) or db.functions.create(target)); applied += 1 -+result = {"start": hex(lo), "end": hex(hi), "found": found, "applied": applied, "n": len(found)} -+result -+''' -+ -+_OPERATIONS["decomp_error"] = r''' -+import ida_hexrays, ida_ida -+ea = int(str(a["addr"]), 16); fn = db.functions.get_at(ea) -+result = {"addr": hex(ea), "bitness": ida_ida.inf_get_app_bitness()} -+if fn is None: -+ result["reason"] = "no function here" -+else: -+ try: -+ failure = ida_hexrays.hexrays_failure_t(); cfunc = ida_hexrays.decompile_func(fn, failure) -+ if cfunc is not None: result["reason"] = "" -+ else: -+ result.update({"reason": failure.desc() or f"error {failure.code}", -+ "code": int(failure.code), "errea": hex(int(failure.errea))}) -+ except Exception as exc: result["reason"] = f"{type(exc).__name__}: {exc}" -+result -+''' -+ -+ -+class CodeModeClient: -+ """A leased GUI/idalib database accessed through ``ida_codemode``.""" -+ -+ def __init__( -+ self, -+ binary_path: str, -+ *, -+ ttl: int = 0, -+ load_args: str = "", -+ processor: str | None = None, -+ loading_address: int | None = None, -+ file_type: str | None = None, -+ output_database: str | None = None, -+ spawn: bool = True, -+ new_database: bool = False, -+ ) -> None: -+ del ttl # managed-worker lifetime is lease-based, not idle-TTL based -+ self._path = os.path.abspath(os.path.expanduser(binary_path)) -+ parsed_processor, parsed_address, parsed_file_type = _parse_load_args(load_args) -+ self._processor = processor or parsed_processor -+ self._loading_address = loading_address if loading_address is not None else parsed_address -+ self._file_type = file_type or parsed_file_type -+ self._output_database = output_database -+ self._spawn = spawn -+ self._new_database = new_database -+ self._handle: DatabaseHandle | None = None -+ self._last_entry: RegistryEntry | None = None -+ self._connect_lock = threading.Lock() -+ -+ def connect(self, timeout: float = 1800.0, progress=None) -> "CodeModeClient": -+ with self._connect_lock: -+ if self._handle is not None and self._handle.connected: -+ return self -+ if progress: -+ progress(f"discovering Code Mode database for {os.path.basename(self._path)}…") -+ try: -+ # A Ctrl+L reload releases its current managed-worker lease, but -+ # that worker remains registered during Code Mode's final-lease -+ # grace period. Retry only that known handoff window. A GUI or -+ # another long-lived client remains busy and yields a clear -+ # failure rather than being modified underneath its owner. -+ deadline = time.monotonic() + min(timeout, 60.0) -+ while True: -+ try: -+ handle = DatabaseHandle.open( -+ self._path, -+ spawn=self._spawn, -+ timeout=max(0.1, timeout), -+ output_database=self._output_database, -+ processor=self._processor, -+ loading_address=self._loading_address, -+ file_type=self._file_type, -+ new_database=self._new_database, -+ ) -+ break -+ except IdbBusy: -+ if not self._new_database or time.monotonic() >= deadline: -+ raise -+ if progress: -+ progress("waiting for the previous Code Mode lease to close…") -+ # Remember the record before managed shutdown withdraws -+ # its JSON. The lifetime lock remains held until IDA has -+ # actually closed the IDB; waiting on it avoids racing a -+ # replacement worker into the old process's file lock. -+ expected = canonical_path( -+ self._output_database or expected_idb_path(self._path) -+ ) -+ owners = [item.entry for item in scan_instances(timeout=0.5) -+ if item.entry.idb_key == idb_key(expected)] -+ if owners: -+ self._wait_for_entry_release( -+ owners[0], max(0.0, deadline - time.monotonic()) -+ ) -+ else: -+ time.sleep(0.2) -+ if progress: -+ backend = handle.entry.backend -+ progress(f"attached to {backend} database; waiting for auto-analysis…") -+ handle.wait_autoanalysis(timeout=timeout) -+ except Exception as exc: # normalize the dependency's transport errors -+ raise self._connection_error(exc) from exc -+ self._handle = handle -+ self._last_entry = handle.entry -+ return self -+ -+ @staticmethod -+ def _connection_error(exc: BaseException) -> IDAConnectionError: -+ return IDAConnectionError(str(exc) or type(exc).__name__) -+ -+ @property -+ def connected(self) -> bool: -+ return self._handle is not None and self._handle.connected -+ -+ @property -+ def pid(self) -> int | None: -+ return self._handle.entry.pid if self._handle is not None else None -+ -+ @property -+ def backend(self) -> str | None: -+ return self._handle.entry.backend if self._handle is not None else None -+ -+ def execute_python(self, code: str, *, timeout: float | None = None) -> Any: -+ if not self.connected: -+ self.connect() -+ handle = self._handle -+ if handle is None: -+ raise IDAConnectionError("Code Mode database is not connected") -+ try: -+ response = handle.execute_python(code, timeout=timeout) -+ except RemoteError as exc: -+ details = exc.details or {} -+ message = str(exc) -+ if details.get("traceback"): -+ message += f"\n{details['traceback']}" -+ if exc.code == "operation_timeout": -+ raise IDATimeoutError(message) from exc -+ raise IDAToolError("execute_python", message) from exc -+ except (InstanceDisconnectedError, ClientError) as exc: -+ raise self._connection_error(exc) from exc -+ if not isinstance(response, dict) or "result" not in response: -+ raise IDAToolError("execute_python", "Code Mode returned an invalid execution result") -+ return response["result"] -+ -+ def invoke(self, operation: str, *, timeout: float | None = None, **args) -> Any: -+ """Execute one TUI domain operation through Code Mode.""" -+ if operation in ("idb_save", "save"): -+ return self.save_database() -+ if operation in ("server_health", "ping", "health", "state"): -+ return self.health() -+ body = _HEADS if operation == "heads" else _OPERATIONS.get(operation) -+ if body is None: -+ raise IDAToolError(operation, f"unknown ida-tui Code Mode operation: {operation}") -+ try: -+ return self.execute_python(_script(args, body), timeout=timeout) -+ except IDAToolError as exc: -+ if exc.tool == "execute_python": -+ raise IDAToolError(operation, exc.message) from exc -+ raise -+ -+ # Temporary source compatibility for external drivers/tests that used the -+ # old WorkerClient. Application code uses the accurately named invoke(). -+ call = invoke -+ -+ def save_database(self) -> dict[str, Any]: -+ if not self.connected: -+ self.connect() -+ handle = self._handle -+ if handle is None: -+ raise IDAConnectionError("Code Mode database is not connected") -+ try: -+ return handle.save_database() -+ except RemoteError as exc: -+ raise IDAToolError("save_database", str(exc)) from exc -+ except (InstanceDisconnectedError, ClientError) as exc: -+ raise self._connection_error(exc) from exc -+ -+ def health(self) -> dict[str, Any]: -+ if not self.connected: -+ self.connect() -+ assert self._handle is not None -+ entry = self._handle.entry -+ module = os.path.basename(entry.exe_path or entry.idb_path or self._path) -+ return { -+ "ok": self._handle.connected, -+ "module": module, -+ "backend": entry.backend, -+ "record_id": entry.record_id, -+ "input_path": entry.exe_path, -+ "idb_path": entry.idb_path, -+ } -+ -+ def keepalive(self, interval: float = 120.0) -> _NoopKeepAlive: -+ del interval -+ return _NoopKeepAlive() -+ -+ def resolve_db(self) -> str: -+ if not self.connected: -+ self.connect() -+ assert self._handle is not None -+ return self._handle.entry.record_id -+ -+ def set_db(self, db: str | None) -> None: -+ del db # one handle is permanently bound to one registered database -+ -+ def list_sessions(self) -> list[Session]: -+ if not self.connected: -+ self.connect() -+ assert self._handle is not None -+ entry = self._handle.entry -+ path = entry.exe_path or entry.idb_path or self._path -+ return [Session(session_id=entry.record_id, filename=os.path.basename(path), -+ input_path=path, is_active=True)] -+ -+ def close(self, grace: float = 0.0) -> None: -+ del grace -+ with self._connect_lock: -+ handle, self._handle = self._handle, None -+ if handle is not None: -+ self._last_entry = handle.entry -+ handle.close() # release our lease; never close a GUI/other client's DB -+ -+ @staticmethod -+ def _wait_for_entry_release(entry: RegistryEntry, timeout: float) -> bool: -+ path = REGISTRY_DIR / f"{entry.record_id}.lock" -+ deadline = time.monotonic() + max(0.0, timeout) -+ while True: -+ lock = FileLock(path) -+ try: -+ if lock.try_acquire(): -+ return True -+ except OSError: -+ pass -+ finally: -+ lock.close() -+ if time.monotonic() >= deadline: -+ return False -+ time.sleep(min(0.1, deadline - time.monotonic())) -+ -+ def wait_released(self, timeout: float = 45.0) -> bool: -+ """Wait until a managed instance releases its lifetime lock. -+ -+ Normal application shutdown must not wait: another client may retain the -+ worker. This is an explicit test/maintenance helper for deleting a -+ temporary IDB safely after this client closes. GUI instances return -+ ``False`` immediately because clients never own their lifetime. -+ """ -+ entry = self._last_entry -+ if entry is None or entry.backend != "idalib": -+ return False -+ return self._wait_for_entry_release(entry, timeout) -+ -+ def __enter__(self) -> "CodeModeClient": -+ return self.connect() -+ -+ def __exit__(self, *exc) -> None: -+ self.close() -diff --git a/idatui/domain.py b/idatui/domain.py -index 97b042d..2d6500e 100644 ---- a/idatui/domain.py -+++ b/idatui/domain.py -@@ -1,19 +1,15 @@ --"""Domain / paging layer: address-centric models over the raw MCP client. -+"""Domain / paging layer: address-centric models over IDA Code Mode. - - This is where the "millions of lines" problem is solved, so the TUI widgets only - ever see a viewport-sized slice. Every hard-won constraint from - ``docs/PAGING_FINDINGS.md`` is encoded here: - --* Per-call caps are silent (over the cap the server returns 10, not a clamp), so -- we clamp page sizes ourselves: ``LIST_PAGE`` / ``DISASM_BLOCK`` <= the caps. --* ``next_offset`` is unreliable; we paginate by advancing ``len(data)``. --* ``disasm offset=N`` is O(N) with no resumable cursor, so windowed disassembly -- is **block-cached** (revisits are free) and **prefetches** the next block on a -- background thread (the client is concurrency-safe). --* ``include_total`` scans the whole function (~200ms on monsters); totals are -- fetched once and cached. --* ``decompile`` can hard-fail on huge functions as a *soft* error (``code`` is -- null); that is surfaced as data, not an exception. -+* Page sizes remain bounded so remote execution returns viewport-scale JSON. -+* Pagination advances by the number of rows actually returned. -+* Deep head walks are block-cached (revisits are free) and neighboring blocks -+ prefetch through the thread-safe Code Mode client. -+* Expensive function totals are fetched once and cached. -+* Decompilation failures are surfaced as data, not application crashes. - - Everything here is synchronous and thread-safe. The TUI runs these calls from - Textual worker threads; the internal prefetch pool is separate and small. -@@ -22,10 +18,8 @@ Textual worker threads; the internal prefetch pool is separate and small. - from __future__ import annotations - - import bisect --import json - import re - import threading --import urllib.request - from concurrent.futures import ThreadPoolExecutor - from dataclasses import dataclass, field, replace - from typing import Callable, TYPE_CHECKING -@@ -33,7 +27,7 @@ from typing import Callable, TYPE_CHECKING - from .errors import IDAToolError - - if TYPE_CHECKING: # type hint only -- from .worker_client import WorkerClient # noqa: F401 -+ from .codemode_client import CodeModeClient - - # Clamps derived from measured caps (list ~700, disasm ~500). Margin included. - LIST_PAGE = 500 -@@ -63,7 +57,7 @@ class Func: - def from_raw(cls, d: dict) -> "Func": - addr = _as_int(d["addr"]) - name = d.get("name") -- # An unnamed function (server returns null/empty) must still have a -+ # An unnamed function must still have a - # usable string name — synthesize IDA's sub_ADDR so every consumer - # (palette, sort, rename prefill) can treat name as a str. - if not name: -@@ -91,7 +85,7 @@ class Line: - - @dataclass(frozen=True) - class Head: -- """One flat-listing item (from the ``heads`` server tool): a code -+ """One flat-listing item from the Code Mode ``heads`` operation: a code - instruction, a data item, or an undefined byte run.""" - - ea: int -@@ -101,7 +95,7 @@ class Head: - name: str | None = None - raw: bytes | None = None # opcode/item bytes (filled in for code by the model) - #: [(kind, text)] from IDA's own colour tags — mnem/reg/num/name/str/punct/… -- #: None when the worker didn't provide them (older worker, or the spans -+ #: None when Code Mode didn't provide them (or the spans - #: disagreed with the plain text, in which case the text wins). - spans: tuple[tuple[str, str], ...] | None = None - -@@ -240,7 +234,7 @@ class FunctionIndex: - """A lazily-paginated, cached view of the function list. - - Loads pages of ``LIST_PAGE`` on demand, advancing by ``len(data)`` (never by -- ``next_offset``). A single index instance corresponds to one server-side -+ ``next_offset``). A single index instance corresponds to one remote - ``filter`` glob (``None`` = all functions). - """ - -@@ -260,7 +254,7 @@ class FunctionIndex: - query: dict = {"offset": offset, "count": LIST_PAGE} - if self.filter: - query["filter"] = self.filter -- data = _query_data(self._prog.client.call("list_funcs", queries=[query])) -+ data = _query_data(self._prog.client.invoke("list_funcs", queries=[query])) - added = 0 - with self._lock: - for d in data: -@@ -370,7 +364,7 @@ class DisasmModel: - code function this equals the heads row count that backs the lines.""" - if self._total is not None: - return self._total -- payload = self._prog.client.call( -+ payload = self._prog.client.invoke( - "disasm", addr=hex(self.ea), max_instructions=1, include_total=True - ) - total = payload.get("total_instructions") -@@ -431,7 +425,7 @@ class DisasmModel: - # The function disasm view is a listing filtered to the function: fetch a - # block of heads (one per instruction for code). Over-fetch one row so - # the block knows where its last instruction ends (opcode-byte sizing). -- payload = self._prog.client.call( -+ payload = self._prog.client.invoke( - "heads", addr=hex(self.ea), offset=b * self.BLOCK, - count=self.BLOCK + 1, **self._end_kw(), - ) -@@ -572,15 +566,15 @@ class ListingModel: - """A flat, IDA-style disassembly *listing* over one segment: code, data and - undefined heads interleaved, unlike ``DisasmModel`` (one function, code only). - -- Backed by the injected ``heads`` server tool, which walks item heads and -- renders each via ``generate_disasm_line``. The segment is walked lazily in -+ Backed by the Code Mode adapter's ``heads`` operation, which walks item heads -+ and renders each via ``generate_disasm_line``. The segment is walked lazily in - forward pages (``FunctionIndex`` style); line index == position in the walked - head list. Random access to an address is O(distance-from-seg-start) the - first time (then cached) — the same tradeoff as ``disasm offset=N``. Grows - on demand as the viewport scrolls. Synchronous + thread-safe. - """ - -- PAGE = 500 # heads per server call (well under the tool's 2000 cap) -+ PAGE = 500 # viewport-scale heads per Code Mode execution - - def __init__(self, program: "Program", seg_start: int, seg_end: int, - name: str | None = None): -@@ -654,7 +648,7 @@ class ListingModel: - if self._done or self._next is None: - return 0 - frm = self._next -- payload = self._prog.client.call( -+ payload = self._prog.client.invoke( - "heads", addr=hex(frm), count=self.PAGE, annotate=True) - rows = payload.get("heads", []) if isinstance(payload, dict) else [] - cur = payload.get("cursor", {}) if isinstance(payload, dict) else {} -@@ -956,7 +950,7 @@ class HexModel: - class Program: - """The bound analysis session: models, caches, and a small prefetch pool.""" - -- def __init__(self, client: "WorkerClient", prefetch_workers: int = 2): -+ def __init__(self, client: "CodeModeClient", prefetch_workers: int = 2): - self.client = client - self._pool = ThreadPoolExecutor( - max_workers=prefetch_workers, thread_name_prefix="idatui-prefetch" -@@ -973,7 +967,7 @@ class Program: - self._sections: list[tuple[int, int, str]] | None = None - self._fileregions: list[tuple[int, int, int]] | None = None - self._hexmodel: "HexModel | None" = None -- self._no_read_raw = False # set if the server lacks the read_raw tool -+ self._no_read_raw = False # compatibility fallback for alternate clients - self._lock = threading.Lock() - - # -- prefetch plumbing ------------------------------------------------- # -@@ -1000,17 +994,14 @@ class Program: - """Sorted raw segment map [(start, end, file_off, name)] — the single - source for sections()/file_regions()/image_range. Cached. - -- Uses the injected ``file_regions`` tool (a plain segment walk, ~ms). -- This deliberately AVOIDS ``survey_binary``, which also computes function -- counts / strings / stats and takes *seconds* on a large IDB (it was the -- cause of the multi-second hex-pane open). Falls back to survey_binary -- only if the injected tool is missing. -+ Uses the Code Mode adapter's ``file_regions`` operation (a plain segment -+ walk, ~ms), avoiding broad binary surveys on the hex-pane open path. - """ - if self._segments_cache is not None: - return self._segments_cache - segs: list[tuple[int, int, int, str]] = [] - try: -- r = self.client.call("file_regions") -+ r = self.client.invoke("file_regions") - for d in (r.get("regions", []) if isinstance(r, dict) else []): - if isinstance(d, dict) and "start" in d: - segs.append((_as_int(d["start"]), _as_int(d["end"]), -@@ -1019,7 +1010,7 @@ class Program: - segs = [] - if not segs: # older server without file_regions -> survey_binary (slow) - try: -- sb = self.client.call("survey_binary") -+ sb = self.client.invoke("survey_binary") - for s in (sb.get("segments", []) if isinstance(sb, dict) else []): - try: - segs.append((_as_int(s["start"]), _as_int(s["end"]), -1, -@@ -1061,8 +1052,7 @@ class Program: - - def file_regions(self) -> list[tuple[int, int, int]]: - """Sorted [(start, end, file_off)] mapping loaded segments to raw file -- offsets (file_off == -1 for non-file-backed, e.g. .bss). Cached; needs -- the injected ``file_regions`` server tool.""" -+ offsets (file_off == -1 for non-file-backed, e.g. .bss). Cached.""" - if self._fileregions is not None: - return self._fileregions - regions = [(s, e, fo) for s, e, fo, _nm in self._segments()] -@@ -1080,15 +1070,14 @@ class Program: - def read_bytes(self, ea: int, n: int) -> bytes: - """Raw bytes [ea, ea+n) from IDA (gaps read as zero). - -- Fast path: the injected ``read_raw`` tool returns one contiguous hex -- string (C-speed both ends). Falls back to the stock ``get_bytes`` (a -- per-byte '0x..'-with-spaces string) on an older server without it. -+ The Code Mode adapter returns one contiguous hex string (C-speed in IDA). -+ A legacy ``get_bytes`` decoding fallback remains for alternate clients. - """ - if n <= 0: - return b"" - if not self._no_read_raw: - try: -- r = self.client.call("read_raw", addr=hex(ea), size=int(n)) -+ r = self.client.invoke("read_raw", addr=hex(ea), size=int(n)) - h = r.get("hex") if isinstance(r, dict) else None - if isinstance(h, str): - out = bytes.fromhex(h) -@@ -1102,7 +1091,7 @@ class Program: - except (ValueError, KeyError): - pass # malformed hex -> fall through to the legacy decoder - try: -- r = self.client.call("get_bytes", regions=[{"addr": hex(ea), "size": int(n)}]) -+ r = self.client.invoke("get_bytes", regions=[{"addr": hex(ea), "size": int(n)}]) - except IDAToolError: - return b"\x00" * n - res = r.get("result", []) if isinstance(r, dict) else [] -@@ -1151,7 +1140,7 @@ class Program: - def list_structs(self, filter: str = "") -> list[Struct]: - """All local structs/unions (optionally name-substring filtered), sorted - by name.""" -- payload = self.client.call("search_structs", filter=filter) -+ payload = self.client.invoke("search_structs", filter=filter) - res = payload.get("result", []) if isinstance(payload, dict) else [] - out = [Struct.from_raw(d) for d in res - if isinstance(d, dict) and d.get("name") -@@ -1161,9 +1150,9 @@ class Program: - - def struct_source(self, name: str) -> str: - """A C definition for ``name`` reconstructed from its member layout -- (the server exposes members, not printable source). Faithful to IDA's -+ (the remote operation exposes members, not printable source). Faithful to IDA's - field names/types; array dims are moved after the field name.""" -- payload = self.client.call( -+ payload = self.client.invoke( - "type_inspect", queries=[{"name": name, "include_members": True}]) - res = payload.get("result", []) if isinstance(payload, dict) else [] - info = res[0] if res and isinstance(res[0], dict) else {} -@@ -1186,7 +1175,7 @@ class Program: - def declare_type(self, decl: str) -> str | None: - """Create or update a C type. Returns None on success, else the parse - error. (Re-declaring a name updates it in place.)""" -- payload = self.client.call("declare_type", decls=decl) -+ payload = self.client.invoke("declare_type", decls=decl) - res = payload.get("result", []) if isinstance(payload, dict) else [] - if res and isinstance(res[0], dict): - return res[0].get("error") -@@ -1195,10 +1184,9 @@ class Program: - # -- function / variable types ---------------------------------------- # - def func_types(self, ea: int) -> FuncTypes | None: - """Structured decompiler types for the function at ``ea`` (prototype + -- local variables). None if ``ea`` isn't a decompilable function. Requires -- the injected ``func_types`` server tool.""" -+ local variables). None if ``ea`` isn't a decompilable function.""" - try: -- r = self.client.call("func_types", addr=hex(ea)) -+ r = self.client.invoke("func_types", addr=hex(ea)) - except IDAToolError: - return None - if not isinstance(r, dict) or r.get("error"): -@@ -1211,7 +1199,7 @@ class Program: - - def set_function_type(self, ea: int, signature: str) -> str | None: - """Set a function's prototype. None on success, else an error string.""" -- r = self.client.call("set_type", edits=[{"addr": hex(ea), "signature": signature}]) -+ r = self.client.invoke("set_type", edits=[{"addr": hex(ea), "signature": signature}]) - res = r.get("result", []) if isinstance(r, dict) else [] - row = res[0] if res and isinstance(res[0], dict) else {} - if row.get("ok"): -@@ -1220,9 +1208,9 @@ class Program: - - def data_type(self, ea: int) -> dict | None: - """Current type info for a data item/global: {addr,name,type,size,is_func}. -- None if the tool is unavailable or the address isn't mapped.""" -+ None if the operation fails or the address isn't mapped.""" - try: -- r = self.client.call("data_type", addr=hex(ea)) -+ r = self.client.invoke("data_type", addr=hex(ea)) - except IDAToolError: - return None - if not isinstance(r, dict) or r.get("error"): -@@ -1231,7 +1219,7 @@ class Program: - - def set_data_type(self, ea: int, decl: str) -> str | None: - """Set a global/data item's type. None on success, else an error string.""" -- r = self.client.call( -+ r = self.client.invoke( - "set_type", edits=[{"kind": "global", "addr": hex(ea), "type": decl}]) - res = r.get("result", []) if isinstance(r, dict) else [] - row = res[0] if res and isinstance(res[0], dict) else {} -@@ -1240,9 +1228,9 @@ class Program: - return row.get("error") or "failed to set the type" - - def set_lvar_type(self, fn_ea: int, var: str, ty: str) -> str | None: -- """Set a decompiler local variable's type (via the injected server tool). -+ """Set a decompiler local variable's type through ida-domain pseudocode. - None on success, else an error string.""" -- r = self.client.call("set_lvar_type", addr=hex(fn_ea), variable=var, type=ty) -+ r = self.client.invoke("set_lvar_type", addr=hex(fn_ea), variable=var, type=ty) - if isinstance(r, dict) and r.get("error"): - return r["error"] - if isinstance(r, dict) and not r.get("ok"): -@@ -1251,15 +1239,14 @@ class Program: - - def delete_type(self, name: str) -> str | None: - """Delete a named type. Returns None on success, else an error string. -- Requires a server-side ``del_type`` tool; if absent, a clear message is -- returned instead of raising.""" -+ Returns a clear error instead of raising when the runtime cannot do it.""" - try: -- self.client.call("del_type", name=name) -+ self.client.invoke("del_type", name=name) - return None - except IDAToolError as e: - msg = e.message - if "not found" in msg.lower() and "del_type" in msg: -- return "delete needs a 'del_type' tool on the ida-pro-mcp server" -+ return "the connected Code Mode runtime cannot delete local types" - return msg - - # -- disassembly ------------------------------------------------------- # -@@ -1273,13 +1260,7 @@ class Program: - - # -- decompilation ----------------------------------------------------- # - def decompile(self, ea: int, refresh: bool = False) -> Decompilation: -- """Full pseudocode for a function. -- -- The server truncates responses over 50KB (strings clipped to 1000 -- chars) but caches the full output and exposes it at -- ``_meta.ida_mcp.download_url``. We transparently fetch that so the view -- always gets the complete body, not a 1KB stub. -- """ -+ """Full pseudocode for a function, returned directly by Code Mode.""" - if not refresh: - with self._lock: - hit = self._decomp.get(ea) -@@ -1288,10 +1269,10 @@ class Program: - dec, hit_gen = hit - if hit_gen == gen: - return dec -- # Cached before a rename: names may be stale. Drop the server's -- # Hex-Rays cache so the refetch reflects the new names. -+ # Cached before a rename: names may be stale. Drop Hex-Rays' -+ # cache so the refetch reflects the new names. - try: -- self.client.call("force_recompile", items=[{"addr": hex(ea)}]) -+ self.client.invoke("force_recompile", items=[{"addr": hex(ea)}]) - except Exception: # noqa: BLE001 - pass - # Bound the decompile: a function Hex-Rays can't handle tends to stall -@@ -1301,7 +1282,10 @@ class Program: - # rpcclient socket timeout, and cache the failure below so a re-request - # returns instantly instead of re-grinding. - try: -- envelope = self.client.call_envelope( -+ # Code Mode returns the complete JSON result directly; unlike the -+ # old MCP tool transport there is no structured-content envelope or -+ # out-of-band download URL to unwrap. -+ payload = self.client.invoke( - "decompile", addr=hex(ea), timeout=DECOMPILE_TIMEOUT - ) - except Exception as e: # noqa: BLE001 -- surface as a failed decompile -@@ -1309,15 +1293,6 @@ class Program: - with self._lock: - self._decomp[ea] = (dec, self._name_gen) - return dec -- result = envelope.get("result", {}) -- payload = result.get("structuredContent") -- if payload is None: # fall back to text content -- payload = self.client._extract_payload("decompile", result) -- meta = (result.get("_meta") or {}).get("ida_mcp") -- if isinstance(meta, dict) and meta.get("download_url"): -- full = self._fetch_output(meta["download_url"]) -- if isinstance(full, dict) and full.get("code"): -- payload = full - dec = _parse_decompilation(ea, payload) - with self._lock: - self._decomp[ea] = (dec, self._name_gen) -@@ -1365,18 +1340,18 @@ class Program: - Undefine first so it works even when the bytes are currently part of a - data/align item — ``create_insn`` refuses to carve into a live item.""" - try: -- self.client.call("undefine", items=[{"addr": hex(ea)}]) -+ self.client.invoke("undefine", items=[{"addr": hex(ea)}]) - except IDAToolError: - pass # nothing defined here yet -> just try to create the insn - res = self._first_result( -- self.client.call("define_code", items=[{"addr": hex(ea)}])) -+ self.client.invoke("define_code", items=[{"addr": hex(ea)}])) - if res.get("error"): - raise IDAToolError("define_code", f"@ {ea:#x}: {res['error']}") - - def decomp_error(self, ea: int) -> str: - """Hex-Rays' own reason for refusing ``ea``, or "" if it won't say.""" - try: -- r = self.client.call("decomp_error", addr=hex(ea)) -+ r = self.client.invoke("decomp_error", addr=hex(ea)) - except IDAToolError: - return "" - if not isinstance(r, dict): -@@ -1395,7 +1370,7 @@ class Program: - - def thumb_scan(self, start: int, end: int, apply: bool = True) -> dict: - """Find Thumb entry points from odd pointers in ``[start, end)``.""" -- r = self.client.call("thumb_scan", start=hex(start), end=hex(end), -+ r = self.client.invoke("thumb_scan", start=hex(start), end=hex(end), - apply=bool(apply)) - if not isinstance(r, dict) or r.get("error"): - raise IDAToolError("thumb_scan", -@@ -1404,7 +1379,7 @@ class Program: - - def set_thumb(self, ea: int, mode: str = "toggle") -> dict: - """Switch ARM/Thumb decoding at ``ea``. Returns the resulting state.""" -- r = self.client.call("set_thumb", addr=hex(ea), mode=mode) -+ r = self.client.invoke("set_thumb", addr=hex(ea), mode=mode) - if not isinstance(r, dict) or r.get("error"): - raise IDAToolError("set_thumb", - f"@ {ea:#x}: {(r or {}).get('error', 'failed')}") -@@ -1413,11 +1388,11 @@ class Program: - def define_code_run(self, ea: int, limit: int = 20000) -> dict: - """Disassemble consecutively from ``ea`` until something stops it. - -- Falls back to a single instruction when the worker predates the tool, so -- an old worker degrades to the previous behaviour instead of failing. -+ Falls back to a single instruction for alternate clients that do not -+ provide the run operation. - """ - try: -- r = self.client.call("define_code_run", addr=hex(ea), limit=int(limit)) -+ r = self.client.invoke("define_code_run", addr=hex(ea), limit=int(limit)) - except IDAToolError: - self.define_code(ea) - return {"count": 1, "stopped": "single", "end": hex(ea)} -@@ -1429,14 +1404,14 @@ class Program: - def define_func(self, ea: int) -> dict: - """Create a function starting at ``ea`` (IDA's 'p'). - -- Prefers the injected tool, which works out the end when IDA can't; -- falls back to the plain one for an older worker. -+ Prefers the Code Mode operation, which works out the end when IDA can't; -+ falls back to a plain create for alternate clients. - """ - try: -- r = self.client.call("define_func_run", addr=hex(ea)) -+ r = self.client.invoke("define_func_run", addr=hex(ea)) - except IDAToolError: - res = self._first_result( -- self.client.call("define_func", items=[{"addr": hex(ea)}])) -+ self.client.invoke("define_func", items=[{"addr": hex(ea)}])) - if res.get("error"): - raise IDAToolError("define_func", f"@ {ea:#x}: {res['error']}") - return {"ok": True, "how": "legacy"} -@@ -1450,7 +1425,7 @@ class Program: - item: dict = {"addr": hex(ea)} - if size: - item["size"] = int(size) -- res = self._first_result(self.client.call("undefine", items=[item])) -+ res = self._first_result(self.client.invoke("undefine", items=[item])) - if res.get("error"): - raise IDAToolError("undefine", f"@ {ea:#x}: {res['error']}") - -@@ -1460,7 +1435,7 @@ class Program: - item: dict = {"addr": hex(ea), "type": type_decl} - if name: - item["name"] = name -- res = self._first_result(self.client.call("make_data", items=[item])) -+ res = self._first_result(self.client.invoke("make_data", items=[item])) - if res.get("ok") is False or res.get("error"): - raise IDAToolError( - "make_data", f"@ {ea:#x}: {res.get('error') or 'rejected'}") -@@ -1468,7 +1443,7 @@ class Program: - def make_string(self, ea: int, length: int = 0, kind: str = "c") -> str: - """Create a string literal at ``ea`` (IDA's 'A'); auto-length when 0. - Returns the decoded contents.""" -- r = self.client.call("make_string", addr=hex(ea), length=int(length), kind=kind) -+ r = self.client.invoke("make_string", addr=hex(ea), length=int(length), kind=kind) - res = r if isinstance(r, dict) else {} - if not res.get("ok"): - raise IDAToolError( -@@ -1483,15 +1458,6 @@ class Program: - sec = None - return f"{sec} @ {ea:#x}" if sec else f"<no function> @ {ea:#x}" - -- @staticmethod -- def _fetch_output(url: str, timeout: float = 15.0): -- """GET the server's cached full-output blob (plain HTTP, not MCP).""" -- try: -- with urllib.request.urlopen(url, timeout=timeout) as r: -- return json.loads(r.read().decode("utf-8", "replace")) -- except Exception: # noqa: BLE001 -- fall back to the truncated preview -- return None -- - def strings(self, min_len: int = 4, refresh: bool = False) -> list[StrLit]: - """Every string literal in the binary (IDA's Shift+F12 list), paged in - full and cached. ``[]`` if the tool is unavailable.""" -@@ -1504,7 +1470,7 @@ class Program: - offset, page = 0, 2000 - while True: - try: -- payload = self.client.call( -+ payload = self.client.invoke( - "list_strings", offset=offset, count=page, min_len=min_len, - refresh=(refresh and offset == 0)) - except IDAToolError: -@@ -1529,13 +1495,13 @@ class Program: - - def linkage(self) -> tuple[list[Linkage], list[Linkage]]: - """``(imports, exports)`` for this binary, cached. ``([], [])`` if the -- tool is unavailable — an old worker must not break the caller.""" -+ operation is unavailable — an alternate client must not break the caller.""" - with self._lock: - hit = self._linkage - if hit is not None: - return hit - try: -- payload = self.client.call("list_linkage", kind="both") -+ payload = self.client.invoke("list_linkage", kind="both") - except IDAToolError: - return ([], []) - if not isinstance(payload, dict): -@@ -1566,7 +1532,7 @@ class Program: - if hit is not None and hit[1] == gen: - return hit[0] - try: -- payload = self.client.call("decomp_map", addr=hex(ea)) -+ payload = self.client.invoke("decomp_map", addr=hex(ea)) - except IDAToolError: - return [] - lines = payload.get("lines", []) if isinstance(payload, dict) else [] -@@ -1579,13 +1545,13 @@ class Program: - # -- cross-references & containing function --------------------------- # - def function_of(self, ea: int) -> Func | None: - """Return the function containing ``ea`` (resolves mid-function addrs).""" -- payload = self.client.call("lookup_funcs", queries=[hex(ea)]) -+ payload = self.client.invoke("lookup_funcs", queries=[hex(ea)]) - res = payload.get("result", []) if isinstance(payload, dict) else [] - fn = res[0].get("fn") if res and isinstance(res[0], dict) else None - return Func.from_raw(fn) if fn else None - - def xrefs_from(self, ea: int) -> list[Xref]: -- payload = self.client.call( -+ payload = self.client.invoke( - "xref_query", - queries=[{"addr": hex(ea), "direction": "from", "include_fn": True}], - ) -@@ -1597,9 +1563,9 @@ class Program: - try: - # xref_types adds a fine-grained `kind` (call/read/write/...) for the - # xref dialog; fall back to xref_query (code/data only) if absent. -- payload = self.client.call("xref_types", queries=q) -+ payload = self.client.invoke("xref_types", queries=q) - except IDAToolError: -- payload = self.client.call("xref_query", queries=q) -+ payload = self.client.invoke("xref_query", queries=q) - return _parse_xrefs(payload) - - # -- address resolution ------------------------------------------------ # -@@ -1617,17 +1583,17 @@ class Program: - # (loc_/locret_): lookup_funcs would map a label to its *containing* - # function's entry, so double-clicking a label jumped to the wrong place. - try: -- payload = self.client.call("resolve_names", queries=[s]) -+ payload = self.client.invoke("resolve_names", queries=[s]) - res = payload.get("result", []) if isinstance(payload, dict) else [] - ea = res[0].get("ea") if res and isinstance(res[0], dict) else None - if ea: - return _as_int(ea) - except IDAToolError: -- pass # older server without resolve_names -> fall back below -+ pass # alternate client without resolve_names -> fall back below - # Fall back to function-name resolution (also drives the 'did you mean' - # suggestion when the name is unknown). - try: -- payload = self.client.call("lookup_funcs", queries=[s]) -+ payload = self.client.invoke("lookup_funcs", queries=[s]) - except IDAToolError as e: - raise KeyError(f"cannot resolve {target!r}: {e}") from e - res = payload.get("result", []) if isinstance(payload, dict) else [] -@@ -1665,7 +1631,7 @@ class Program: - """Set (empty text clears) the comment at ``ea``; affects both the disasm - and decompiler views. Returns the raw payload so the caller can surface a - soft per-item error. The caller must invalidate/recompile to see it.""" -- return self.client.call("set_comments", items=[{"addr": hex(ea), "comment": text}]) -+ return self.client.invoke("set_comments", items=[{"addr": hex(ea), "comment": text}]) - - # -- invalidation (after edits) --------------------------------------- # - def invalidate(self, ea: int) -> None: -diff --git a/idatui/drive.py b/idatui/drive.py -index b6fa641..0d865b5 100644 ---- a/idatui/drive.py -+++ b/idatui/drive.py -@@ -121,7 +121,8 @@ def cmd_pc(c, args): - lines = d["code"].splitlines() - if needle: - nlow = needle.lower() -- lines = [f"{i:4} {l}" for i, l in enumerate(lines) if nlow in l.lower()] -+ lines = [f"{i:4} {line}" for i, line in enumerate(lines) -+ if nlow in line.lower()] - return "\n".join(lines) or f"(no line matches {needle!r})" - return d["code"] - -diff --git a/idatui/errors.py b/idatui/errors.py -index 29b09ae..aaf2dc5 100644 ---- a/idatui/errors.py -+++ b/idatui/errors.py -@@ -1,10 +1,8 @@ --"""Transport-agnostic error hierarchy and the Session model. -+"""TUI-facing error hierarchy and lightweight database session model. - --These were originally defined in client.py (the ida-pro-mcp HTTP client), but the --idalib worker path (worker_client / domain / app) needs the same exception types --and Session dataclass without dragging in the HTTP transport. They live here so --both backends share one definition; client.py re-exports them for backwards --compatibility with the (deprecated) mcp tooling and the stress tests. -+The Code Mode adapter normalizes ``ida_codemode.client`` transport and execution -+errors into these types so the domain and Textual layers do not depend on HTTP or -+registry implementation details. - """ - from __future__ import annotations - -diff --git a/idatui/launch.py b/idatui/launch.py -index 64e1546..f78213c 100644 ---- a/idatui/launch.py -+++ b/idatui/launch.py -@@ -1,15 +1,13 @@ --"""One-shot launcher: ``ida-tui foo.elf`` and you're in the TUI. -+"""One-shot launcher for the IDA Code Mode-backed TUI. - --Spawns a private idalib worker (``idatui.worker``) that opens + auto-analyzes --THIS binary in its own process, talking to the TUI over a unix socket. No shared --supervisor, no HTTP: everything slow (open + analysis) happens behind the TUI's --loading overlay. -+A path first resolves to a registered GUI database; when none matches, Code Mode -+reuses or starts a managed idalib worker. With no path, a single registered -+database is selected automatically. - --Usage: -+Usage:: - -- ida-tui /path/to/binary # open a binary and drive it -- --Extras: --ttl, --no-keepalive, --rpc (all forwarded to the TUI). -+ ida-tui /path/to/binary -+ ida-tui # attach when exactly one database is registered - """ - from __future__ import annotations - -@@ -17,12 +15,6 @@ import argparse - import os - import sys - --# The unpacked working-copy files IDA writes next to a `.i64` while a database is --# open. A hard-killed worker leaves them behind and the `.i64` then refuses to --# reopen ("Failed to open database"). Safe to delete when nothing holds the DB. --_LOCK_SUFFIXES = (".id0", ".id1", ".id2", ".nam", ".til") -- -- - def _load_args(load: dict) -> str: - """``load`` as IDA switches, for the single-binary path (no project ref).""" - from .formats import load_args -@@ -34,24 +26,19 @@ def _log(msg: str) -> None: - print(f"ida-tui: {msg}", file=sys.stderr) - - --def _sweep_locks(binary: str) -> int: -- """Remove stale unpacked DB files next to ``binary``. Returns how many.""" -- stem = os.path.splitext(binary)[0] -- n = 0 -- for base in (binary, stem): # IDA may key on the full name or the stem -- for suf in _LOCK_SUFFIXES: -- try: -- os.remove(base + suf) -- n += 1 -- except OSError: -- pass -- return n -+def _registered_databases() -> tuple[list[dict], list[dict]]: -+ """Ready and blocked Code Mode registrations, with normalized errors.""" -+ try: -+ from ida_codemode.registry import discover_instances -+ return discover_instances() -+ except Exception as exc: # discovery diagnostics belong at the CLI boundary -+ return [], [{"error": str(exc)}] - - - def main(argv: list[str] | None = None) -> int: - p = argparse.ArgumentParser( - prog="ida-tui", -- description="Open a binary in the IDA TUI (private idalib worker).") -+ description="Open a registered GUI or managed idalib database in the IDA TUI.") - p.add_argument("binary", nargs="*", - help="binary to open and analyze (several with --project " - "creates/extends that project)") -@@ -59,9 +46,9 @@ def main(argv: list[str] | None = None) -> int: - help="open a multi-binary project (created from the given " - "binaries if FILE doesn't exist)") - p.add_argument("--ttl", type=int, default=1800, -- help="worker idle-TTL seconds (default 1800)") -+ help="deprecated compatibility option (Code Mode uses leases)") - p.add_argument("--no-keepalive", action="store_true", -- help="do not run the keepalive heartbeat") -+ help="deprecated compatibility option (the lease is the heartbeat)") - p.add_argument("--rpc", metavar="PATH", - help="listen for RPC on this unix socket (puppeteer the TUI)") - p.add_argument("--trace", metavar="FILE", -@@ -76,7 +63,7 @@ def main(argv: list[str] | None = None) -> int: - g.add_argument("--base", metavar="ADDR", - help="load address, e.g. 0x8000000 (any base; NOT paragraphs)") - g.add_argument("--ida-args", metavar="STR", dest="ida_args", -- help="extra IDA command-line switches, passed through as-is") -+ help="legacy switches; only Code Mode-representable -p/-b/-T are accepted") - args = p.parse_args(argv) - - load: dict = {} -@@ -134,27 +121,42 @@ def main(argv: list[str] | None = None) -> int: - _log(str(e)) - return 2 - else: -- if len(args.binary) != 1: -- _log("give exactly one binary, or use --project for several") -+ ready, blocked = _registered_databases() -+ if len(args.binary) > 1: -+ _log("give at most one binary, or use --project for several") - return 2 -- binary = os.path.abspath(os.path.expanduser(args.binary[0])) -- if not os.path.isfile(binary): -- _log(f"no such file: {binary}") -+ if args.binary: -+ binary = os.path.abspath(os.path.expanduser(args.binary[0])) -+ key = os.path.normcase(os.path.realpath(binary)) -+ registered = any( -+ key == os.path.normcase(os.path.realpath(str(item.get(field) or ""))) -+ for item in ready for field in ("exe_path", "idb_path") -+ if item.get(field) -+ ) -+ if not os.path.isfile(binary) and not registered: -+ _log(f"no such file or registered database: {binary}") -+ return 2 -+ elif len(ready) == 1: -+ item = ready[0] -+ binary = str(item.get("exe_path") or item.get("idb_path") or "") -+ _log(f"attaching to registered {item.get('backend')} database: {binary}") -+ elif not ready: -+ detail = f" ({blocked[0].get('error')})" if blocked else "" -+ _log(f"no registered Code Mode database; pass a binary path{detail}") - return 2 -- if not os.access(os.path.dirname(binary), os.W_OK): -- _log(f"directory not writable (IDA writes a .i64 there): " -- f"{os.path.dirname(binary)}") -+ else: -+ _log("several Code Mode databases are registered; pass one of these paths:") -+ for item in ready: -+ _log(f" {item.get('exe_path') or item.get('idb_path')} " -+ f"[{item.get('backend')}, {item.get('record_id')}]") - return 2 -- swept = _sweep_locks(binary) # a crashed worker can leave the DB wedged -- if swept: -- _log(f"cleared {swept} stale lock file(s) from a crashed worker") - -- # Hand off to the TUI (imported late so --help works without textual). It -- # spawns the worker behind its loading overlay while auto-analysis runs. -+ # Hand off to the TUI (imported late so --help works without Textual). Code -+ # Mode discovery/opening happens behind its loading overlay. - try: - from .app import IdaTui - except ImportError as e: -- _log(f"the TUI needs textual; run with ~/ida-venv/bin/python ({e})") -+ _log(f"TUI dependencies are missing; run `uv sync` ({e})") - return 1 - rpc_path = os.path.abspath(os.path.expanduser(args.rpc)) if args.rpc else None - IdaTui(open_path=binary, keepalive=not args.no_keepalive, -diff --git a/idatui/pane.py b/idatui/pane.py -index 37a5f0c..0f8fa57 100644 ---- a/idatui/pane.py -+++ b/idatui/pane.py -@@ -15,9 +15,9 @@ then close it — all without a human touching the keyboard. - python -m idatui.pane list - python -m idatui.pane stop --sock <sock> # graceful quit + kill pane - --Requires: running inside tmux. Each pane spawns its own private idalib worker --(no shared supervisor). Uses ~/ida-venv/bin/python for the TUI (needs textual) --unless --python / IDATUI_PYTHON says otherwise. -+Requires: running inside tmux. Each pane leases a registered GUI or shared -+managed idalib database through Code Mode. Uses ~/ida-venv/bin/python for the -+TUI unless --python / IDATUI_PYTHON says otherwise. - """ - from __future__ import annotations - -@@ -25,7 +25,6 @@ import argparse - import json - import os - import secrets --import signal - import subprocess - import sys - import time -@@ -72,56 +71,14 @@ def _tmux(*args: str) -> str: - check=True).stdout.strip() - - --# --------------------------------------------------------------------------- # --# idalib worker reaping --# --# ``pane stop`` kills the TUI pane, but a hard-killed pane can leave its private --# idalib worker (idatui/worker.py) running. A worker is only *safe* to reap when --# no idatui pane is live (then every worker is orphaned), which avoids killing an --# in-use analyser. --# --------------------------------------------------------------------------- # --_WORKER_PATTERN = r"idatui/worker\.py" -- -- --def _worker_pids() -> list[int]: -- """PIDs of our private per-pane idalib worker processes (idatui/worker.py), -- never our own PID.""" -- try: -- out = subprocess.run(["pgrep", "-f", _WORKER_PATTERN], -- capture_output=True, text=True) -- except OSError: -- return [] -- me = os.getpid() -- pids: list[int] = [] -- for tok in out.stdout.split(): -- try: -- pid = int(tok) -- except ValueError: -- continue -- if pid != me: -- pids.append(pid) -- return pids -- -- - def _count_live_panes() -> int: - return sum(1 for r in _load_registry() if _pane_alive(r.get("pane", ""))) - - - def _reap_orphan_workers(force: bool = False) -> int: -- """Kill leaked idalib workers when it is safe (no live pane) or ``force``. -- -- Returns the number of workers signalled. Best-effort; never raises. -- """ -- if not force and _count_live_panes() > 0: -- return 0 -- reaped = 0 -- for pid in _worker_pids(): -- try: -- os.kill(pid, signal.SIGKILL) -- reaped += 1 -- except OSError: -- pass -- return reaped -+ """Compatibility no-op: Code Mode workers are shared and lease-managed.""" -+ del force -+ return 0 - - - # --------------------------------------------------------------------------- # -@@ -146,16 +103,8 @@ def spawn(args) -> int: - print(f"error: no such project: {project}", file=sys.stderr) - return 2 - -- # Reap workers leaked by previously-stopped/crashed panes so we don't spawn -- # into a full IDA_MCP_MAX_WORKERS (which makes the new TUI hang forever, -- # never reaching ready). No-op while any pane is live. -- reaped = _reap_orphan_workers() -- if reaped: -- print(f"reaped {reaped} orphaned idalib worker(s) before spawn", -- file=sys.stderr) -- -- # the command the pane runs: the launcher spawns a private idalib worker for -- # this binary and becomes the TUI, so kill-pane tears the whole thing down. -+ # The pane owns only the TUI. Code Mode's lease cleanup handles crashes; -+ # kill-pane must never reap a shared GUI/idalib database. - if project is not None: - # launch takes: --project FILE [binaries...]; extra binaries are added to - # the project (and a missing project file is created from them). -@@ -202,9 +151,8 @@ def _wait_ready(sock: str, timeout: float, pane: str, - stuck_after: float = 45.0) -> dict[str, Any]: - """Poll the socket + ping until the TUI reports ready (or timeout). - -- Emits a one-time hint to stderr if it's still not ready after ``stuck_after`` -- seconds, so a wedged idalib worker / full worker pool surfaces a diagnostic -- instead of an unexplained silent hang. -+ Emits a one-time hint if Code Mode discovery/opening is still not ready after -+ ``stuck_after`` seconds. - """ - start = time.time() - deadline = start + timeout -@@ -225,9 +173,8 @@ def _wait_ready(sock: str, timeout: float, pane: str, - warned = True - why = ("RPC socket not created yet" if not os.path.exists(sock) - else "TUI up but analysis not ready") -- print(f"still waiting ({int(time.time() - start)}s): {why}. If this " -- f"hangs, the idalib worker may be stuck — try " -- f"`python -m idatui.pane reap`.", file=sys.stderr) -+ print(f"still waiting ({int(time.time() - start)}s): {why}. " -+ f"Check Code Mode registrations and worker logs.", file=sys.stderr) - time.sleep(0.4) - last = dict(last) - last["ready"] = False -@@ -317,13 +264,9 @@ def list_panes(args) -> int: - - - def reap(args) -> int: -- """Kill leaked idalib workers (safe when no pane is live; --force overrides).""" -- live = _count_live_panes() -- n = _reap_orphan_workers(force=args.force) -- print(json.dumps({"reaped_workers": n, "live_panes": live, "forced": args.force})) -- if n == 0 and not args.force and live > 0: -- print(f"note: {live} live pane(s) — not reaping in-use workers; pass " -- f"--force to reap anyway", file=sys.stderr) -+ """Deprecated no-op; shared Code Mode workers are managed by leases.""" -+ print(json.dumps({"reaped_workers": 0, "live_panes": _count_live_panes(), -+ "forced": args.force, "deprecated": True})) - return 0 - - -@@ -361,9 +304,8 @@ def main(argv: list[str]) -> int: - ls.add_argument("--prune", action="store_true", help="drop dead panes (and their sockets)") - ls.set_defaults(fn=list_panes) - -- rp = sub.add_parser("reap", help="kill leaked idalib workers (frees worker slots)") -- rp.add_argument("--force", action="store_true", -- help="reap even while panes are live (may kill an in-use analyser)") -+ rp = sub.add_parser("reap", help="deprecated no-op (Code Mode uses shared leases)") -+ rp.add_argument("--force", action="store_true", help=argparse.SUPPRESS) - rp.set_defaults(fn=reap) - - args = p.parse_args(argv) -diff --git a/idatui/pool.py b/idatui/pool.py -index ae37c25..465dff2 100644 ---- a/idatui/pool.py -+++ b/idatui/pool.py -@@ -1,23 +1,16 @@ --"""WorkerPool — keeps a live idalib worker per project binary, within a budget. -+"""DatabasePool — LRU leases on Code Mode databases for a project. - --One worker process holds exactly one database (idalib is single-DB and --main-thread-only), so a project with N binaries means up to N processes. They are --not cheap and they do not share: a worker on ``bash`` measures ~126 MB RSS / --117 MB PSS, and the database working set dominates for anything larger --(``libcrypto.so.3``'s ``.i64`` alone is 72 MB). -+Code Mode may bind a lease to an existing IDA GUI or to a shared managed idalib -+worker. The pool therefore owns *client interest*, never an IDA process. Releasing -+an LRU entry persists managed IDBs but does not implicitly save a GUI, then closes -+only this TUI's lease; other clients and GUI sessions remain alive. Managed workers exit themselves after their final lease. - --Residency is therefore bounded by a **memory budget**, not a worker count — a --count is the wrong knob when one project holds both a 50 KB helper and a 6 MB --crypto library. Workers are spawned lazily on first use, kept resident while they --fit, and least-recently-used ones evicted when they don't. Eviction **saves the --database first**, so coming back is a load rather than a re-analysis. -- --The pool never evicts the active binary, nor anything pinned. -+The historical memory budget remains useful for managed idalib instances, while -+GUI process memory is only advisory. The active and pinned databases are never -+released to satisfy it. - """ - from __future__ import annotations - --import os -- - from .project import BinaryRef, Project - - #: Fallback budget if /proc/meminfo can't be read (MB). -@@ -36,11 +29,11 @@ def _total_ram_mb() -> int: - - - def _pss_mb(pid: int | None) -> int: -- """Proportional set size of a worker, in MB. -+ """Proportional set size of the leased instance process, in MB. - -- PSS (not RSS) is the honest per-worker cost: it splits shared pages between -- the processes mapping them. In practice workers share very little, so the two -- are close, but PSS is what makes summing across workers meaningful. -+ PSS is useful for managed idalib workers. For GUI/shared processes it is only -+ advisory because the TUI neither owns all that memory nor controls process -+ exit. - """ - if not pid: - return 0 -@@ -54,13 +47,19 @@ def _pss_mb(pid: int | None) -> int: - return 0 - - --def _default_spawn(ref: BinaryRef, ttl: int): # pragma: no cover - needs idalib -- from .worker_client import WorkerClient -- return WorkerClient(ref.staged, ttl=ttl, load_args=ref.load_args) -+def _default_spawn(ref: BinaryRef, ttl: int, *, new_database: bool = False): # pragma: no cover - needs IDA -+ from .codemode_client import CodeModeClient -+ return CodeModeClient( -+ ref.staged, -+ ttl=ttl, -+ load_args=ref.load_args, -+ output_database=ref.db, -+ new_database=new_database, -+ ) - - --class WorkerPool: -- """Live workers for a project's binaries, keyed by label.""" -+class DatabasePool: -+ """Live Code Mode database leases, keyed by project label.""" - - def __init__(self, project: Project, *, budget_mb: int | None = None, - ttl: int = 1800, spawn=None, mem_fn=None) -> None: -@@ -71,6 +70,7 @@ class WorkerPool: - self._clients: dict[str, object] = {} - self._lru: list[str] = [] # least-recently-used first - self._pinned: set[str] = set() -+ self._recreate: set[str] = set() # Ctrl+L: next attachment creates a fresh IDB - self.active: str | None = None # never evicted - if budget_mb is None: - ram = _total_ram_mb() -@@ -98,11 +98,11 @@ class WorkerPool: - - # -- acquire ----------------------------------------------------------- # - def get(self, label: str, progress=None): -- """A live client for ``label``, spawning it (and making room) if needed. -+ """A live client for ``label``, attaching or spawning as needed. - -- Staging and the scratch sweep happen here: a worker killed hard last time -- leaves unpacked ``.id0/.id1/...`` behind, and the database then refuses to -- reopen. Nothing else holds this DB (one worker per label), so it is safe. -+ Do not sweep IDA scratch files here: a registered GUI or another Code -+ Mode client may own the database. Code Mode's registry locks and health -+ probes are the authority for safe discovery and stale-record cleanup. - """ - client = self._clients.get(label) - if client is not None: -@@ -118,28 +118,29 @@ class WorkerPool: - - note(f"staging {ref.label}\u2026") - self.project.stage(ref) -- self.project.sweep_scratch(ref) - note(f"opening {ref.label}\u2026") -- client = self._spawn(ref, self._ttl) -+ fresh = label in self._recreate -+ client = (_default_spawn(ref, self._ttl, new_database=fresh) -+ if self._spawn is _default_spawn else self._spawn(ref, self._ttl)) - connect = getattr(client, "connect", None) - if connect is not None: - connect(progress=progress) if progress is not None else connect() - self._clients[label] = client -+ self._recreate.discard(label) - self._lru.append(label) - self._enforce_budget(protect=label) - return client - - def prewarm(self, label: str, progress=None) -> bool: -- """Spawn a worker for ``label`` only if it fits the budget AS IT STANDS. -+ """Attach a database for ``label`` only if it fits the current budget. - - Pre-warming must never cost residency: evicting a binary the user - actually visited to speculatively load one they haven't is a straight - downgrade, and the eviction would also throw away that binary's caches. - So this refuses rather than making room, and returns False. - -- The cost of a worker that doesn't exist yet can only be estimated; the -- largest resident one is the best evidence available (they are all the -- same program with a different database). With nothing resident we have -+ The cost of a database not attached yet can only be estimated; the -+ largest resident instance is the best evidence available. With nothing resident we have - no evidence at all, so we allow one — that is the case where the budget - is certainly free. - """ -@@ -153,13 +154,19 @@ class WorkerPool: - return False - self.get(label, progress=progress) - # get() enforces the budget protecting the NEW label; if that had to -- # evict, our estimate was wrong and the speculative worker is the one -+ # evict, our estimate was wrong and the speculative lease is the one - # that should go — never a binary the user chose. - if self.memory_mb() > self.budget_mb and label != self.active: - self.evict(label) - return False - return True - -+ def recreate_on_next_open(self, label: str) -> None: -+ """Request a fresh IDB after the current lease has been released.""" -+ if self.project.by_label(label) is None: -+ raise KeyError(f"no such binary in the project: {label}") -+ self._recreate.add(label) -+ - def _touch(self, label: str) -> None: - if label in self._lru: - self._lru.remove(label) -@@ -171,16 +178,21 @@ class WorkerPool: - self._touch(label) - - # -- release ----------------------------------------------------------- # -- def evict(self, label: str, save: bool = True) -> bool: -- """Drop a resident worker, persisting its database first.""" -+ def evict(self, label: str, save: bool = True, -+ save_gui: bool = False) -> bool: -+ """Release a resident lease, persisting a managed database first. -+ -+ A budget-driven eviction must not save somebody's GUI implicitly. GUI -+ saves are reserved for an explicit/defensive ``close_all(save=True)``. -+ """ - client = self._clients.pop(label, None) - if client is None: - return False - if label in self._lru: - self._lru.remove(label) -- if save: -+ if save and (save_gui or getattr(client, "backend", None) != "gui"): - try: # persist analysis + edits so the next open is a load -- client.call("idb_save") -+ client.save_database() - except Exception: # noqa: BLE001 -- evict regardless - pass - try: -@@ -198,7 +210,7 @@ class WorkerPool: - return None - - def _enforce_budget(self, protect: str | None = None) -> int: -- """Evict LRU workers until the pool fits its budget. Returns how many.""" -+ """Release LRU leases until the pool fits its budget. Returns how many.""" - n = 0 - while self.memory_mb() > self.budget_mb: - victim = self._evictable(protect) -@@ -210,7 +222,7 @@ class WorkerPool: - - def close_all(self, save: bool = True) -> None: - for label in list(self._clients): -- self.evict(label, save=save) -+ self.evict(label, save=save, save_gui=save) - self.active = None - - # -- introspection ------------------------------------------------------ # -@@ -231,5 +243,9 @@ class WorkerPool: - return out - - def __repr__(self) -> str: # pragma: no cover - debug aid -- return (f"<WorkerPool {len(self._clients)}/{len(self.project.refs)} resident " -+ return (f"<DatabasePool {len(self._clients)}/{len(self.project.refs)} resident " - f"{self.memory_mb()}/{self.budget_mb}MB active={self.active}>") -+ -+ -+# Source compatibility for callers that imported the pre-Code-Mode name. -+WorkerPool = DatabasePool -diff --git a/idatui/project.py b/idatui/project.py -index e2fc542..6afd8a1 100644 ---- a/idatui/project.py -+++ b/idatui/project.py -@@ -23,7 +23,8 @@ firmware image, a cleaned build tree). - A source whose size/mtime no longer matches the staged copy is re-staged, and its - now-stale database is dropped (the DB describes the old bytes). - --stdlib-only, like the domain/worker layers — the TUI is the only Textual consumer. -+The model has no IDA imports. Staging consults ida_codemode's registry before -+replacing files so it never mutates a database owned by a GUI/shared worker. - """ - from __future__ import annotations - -@@ -56,7 +57,7 @@ class BinaryRef: - #: it is, a raw firmware image doesn't, and IDA defaults to metapc at 0. - processor: str = "" # IDA processor name: arm, armb, mipsb, metapc, … - base: int = 0 # load address (natural, e.g. 0x8000000) -- ida_args: str = "" # escape hatch: extra IDA command-line switches -+ ida_args: str = "" # legacy -p/-b/-T switches accepted by Code Mode adapter - - @property - def db(self) -> str: -@@ -310,13 +311,32 @@ class Project: - """Ensure ``ref`` is staged in the sidecar; returns the staged path. - - Re-staging a changed source drops its database: the DB describes the old -- bytes, so keeping it would silently mismatch the disassembly (any renames -- in it are lost, which is why callers should say so out loud). -+ bytes. Refuse while Code Mode reports a GUI/idalib owner; replacing a -+ staged executable or IDB underneath a shared live instance is corruption. - """ - if not os.path.isfile(ref.source): - raise ProjectError(f"no such binary: {ref.source}") - if not self.is_stale(ref): - return ref.staged -+ try: -+ from ida_codemode.registry import canonical_path, idb_key, scan_instances -+ expected_key = idb_key(ref.db) -+ staged_path = canonical_path(ref.staged) -+ owner = next( -+ (item.entry for item in scan_instances(timeout=0.5) -+ if item.entry.idb_key == expected_key -+ or (item.entry.exe_path and canonical_path(item.entry.exe_path) == staged_path)), -+ None, -+ ) -+ except Exception as exc: -+ raise ProjectError( -+ f"cannot verify Code Mode ownership before staging {ref.label}: {exc}" -+ ) from exc -+ if owner is not None: -+ raise ProjectError( -+ f"cannot restage {ref.label}: Code Mode instance {owner.record_id} " -+ f"still owns {owner.idb_path}; close/release it first" -+ ) - os.makedirs(self.bin_dir, exist_ok=True) - tmp = ref.staged + ".staging" - _unlink(tmp) -@@ -338,10 +358,11 @@ class Project: - return out - - def sweep_scratch(self, ref: BinaryRef) -> int: -- """Delete IDA's unpacked working files (never the ``.i64``) for ``ref``. -+ """Delete unpacked working files (never the ``.i64``) for maintenance. - -- A hard-killed worker leaves them behind and the database then refuses to -- reopen. Only safe when no worker holds it. -+ Runtime paths no longer call this: Code Mode instances are shared, so a -+ registry owner may still be using these files. Callers must independently -+ prove that no GUI/idalib instance owns the database. - """ - return sum(1 for suf in SCRATCH_SUFFIXES if _unlink(ref.staged + suf)) - -diff --git a/idatui/worker.py b/idatui/worker.py -deleted file mode 100644 -index a4e3509..0000000 ---- a/idatui/worker.py -+++ /dev/null -@@ -1,233 +0,0 @@ --"""idatui's own idalib worker — the replacement for the ida-pro-mcp supervisor. -- --Opens ONE database in-process (on the main thread, as idalib requires) and --serves ida-pro-mcp's *tool functions* over a unix socket with length-prefixed --pickle. Same tool implementations as the MCP path (we call --``MCP_SERVER.tools.methods[name](**args)`` directly), so return shapes are --byte-identical — but with ~50us/call instead of the HTTP path's ~5ms, and no --supervisor / HTTP / JSON / 50KB-truncation machinery. -- -- python -m idatui.worker <sock_path> <binary_path> -- --The socket only appears once the database is open + analyzed, so a client can --poll ``connect()`` to know when the worker is ready. Requests are served --serially on the main thread (idalib is single-threaded; every tool runs inline --through its own execute_sync, which is a no-op on the main thread). -- --Protocol (both directions length-prefixed: 4-byte big-endian len + pickle): -- request = (tool_name: str, kwargs: dict) -- response = (ok: bool, result_or_error) -- tool_name == "__shutdown__" ends the worker. --""" --from __future__ import annotations -- --import os --import pickle --import socket --import struct --import sys --import uuid -- -- --# --------------------------------------------------------------------------- # --# framing --# --------------------------------------------------------------------------- # --def _recvn(sock: socket.socket, n: int) -> bytes | None: -- buf = bytearray() -- while len(buf) < n: -- chunk = sock.recv(n - len(buf)) -- if not chunk: -- return None -- buf += chunk -- return bytes(buf) -- -- --def send(sock: socket.socket, obj) -> None: -- data = pickle.dumps(obj, protocol=pickle.HIGHEST_PROTOCOL) -- sock.sendall(struct.pack(">I", len(data)) + data) -- -- --def recv(sock: socket.socket): -- hdr = _recvn(sock, 4) -- if hdr is None: -- return None -- (n,) = struct.unpack(">I", hdr) -- body = _recvn(sock, n) -- return None if body is None else pickle.loads(body) -- -- --# --------------------------------------------------------------------------- # --# worker --# --------------------------------------------------------------------------- # --def _ensure_tools_injected() -> None: -- """Inject idatui's custom tools (heads/read_raw/resolve_names/func_types/...) -- into the installed ida_pro_mcp, idempotently, so the worker is self-sufficient -- (nothing else has to inject these tools first). Must run BEFORE -- ida_pro_mcp.ida_mcp is imported (the injected code lives in api_types.py).""" -- import importlib.util -- repo = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) -- patch = os.path.join(repo, "server", "patch_server.py") -- if not os.path.exists(patch): -- return -- try: -- spec = importlib.util.spec_from_file_location("_idatui_patch", patch) -- mod = importlib.util.module_from_spec(spec) -- spec.loader.exec_module(mod) # IDA-free; just defines + patches api_types -- mod.main() -- except Exception as e: # noqa: BLE001 -- tools may already be present -- sys.stderr.write(f"idatui: tool injection skipped: {e}\n") -- -- --def _has_database(binpath: str) -> bool: -- """Whether IDA already has a database for ``binpath``. -- -- IDA names it ``<file>.i64`` (keeping the extension), but a database made -- from ``foo.bin`` can also appear as ``foo.i64`` depending on how it was -- created — check both, because guessing wrong here means re-passing load -- switches to an existing database, which fails the open. -- """ -- return (os.path.exists(binpath + ".i64") -- or os.path.exists(os.path.splitext(binpath)[0] + ".i64")) -- -- --def _open_and_register(binpath: str, load_args: str = ""): -- """Open the DB (main thread) then import ida-pro-mcp so every @tool registers -- against this live database. Returns (tools_dict, module_name, save_fn). -- -- ``load_args`` is passed to IDA as command-line switches, which is the only -- way to tell it how to read a headerless blob: a raw firmware image has no -- format to detect, so without ``-p<processor>`` it loads as metapc at 0 and -- finds nothing. Ignored once a database exists — the .i64 already records how -- it was loaded, and re-passing conflicting switches is how you corrupt one. -- """ -- _ensure_tools_injected() # before any ida_pro_mcp import -- import idapro -- idapro.enable_console_messages(False) -- args = load_args or None -- if args and _has_database(binpath): -- # The .i64 already records how this image was loaded. Passing the -- # switches again on reopen makes IDA fail outright (rc != 0) — the load -- # options belong to the FIRST open only. -- args = None -- if idapro.open_database(binpath, run_auto_analysis=True, -- args=args): # nonzero == failure -- if args: -- # With load switches in play they are the likeliest culprit by far: -- # IDA refuses an unknown -p name with no diagnostic of its own, so -- # saying "the database is locked" here sends people hunting a -- # problem they don't have. -- raise RuntimeError( -- f"failed to open {binpath} with load options {args!r}: IDA " -- f"rejected them \u2014 an unknown processor name is the usual " -- f"cause (see tools/verify_procs.py for the valid ones)") -- raise RuntimeError( -- f"failed to open {binpath}: the .i64 is likely held by a running " -- f"ida-mcp worker (try: pkill -f idalib) or wedged from a crash " -- f"(delete its .id0/.id1/.id2/.nam/.til next to the binary)") -- import ida_auto -- ida_auto.auto_wait() # block until auto-analysis settles (match ida-mcp) -- -- # importing the package registers all api_*/patched tools against MCP_SERVER -- from ida_pro_mcp.ida_mcp import MCP_SERVER # noqa: WPS433 -- -- import ida_nalt -- module = os.path.basename(ida_nalt.get_root_filename() or binpath) -- -- def save(): -- import idc -- try: -- idc.save_database(idc.get_idb_path(), 0) -- except Exception: # noqa: BLE001 -- import ida_loader, ida_pro # noqa: WPS433 -- ida_loader.save_database(idc.get_idb_path(), 0) -- -- return MCP_SERVER.tools.methods, module, save -- -- --def serve(sockpath: str, binpath: str, load_args: str = "") -> None: -- tools, module, save = _open_and_register(binpath, load_args) -- sid = uuid.uuid4().hex[:8] -- -- def dispatch(name: str, args: dict): -- args = dict(args) -- args.pop("database", None) # single-DB worker: no session routing -- # session-management shims (were the supervisor's job): -- if name in ("idb_open",): -- return {"success": True, -- "session": {"session_id": sid, "module": module, -- "input_path": binpath}} -- if name in ("idb_save", "save"): -- save() -- return {"success": True} -- if name in ("server_health", "ping", "health", "state"): -- return {"module": module, "ok": True, "session_id": sid} -- if name in ("idb_list",): -- return {"sessions": [{"session_id": sid, "module": module, -- "input_path": binpath}]} -- fn = tools.get(name) -- if fn is None: -- raise KeyError(f"unknown tool: {name!r}") -- result = fn(**args) -- # Match the MCP server's structuredContent: a dict passes through, any -- # other return (list/scalar) is wrapped as {"result": ...}. domain.py -- # parses that exact shape (e.g. lookup_funcs -> payload["result"]). -- return result if isinstance(result, dict) else {"result": result} -- -- try: -- os.unlink(sockpath) -- except OSError: -- pass -- srv = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) -- srv.bind(sockpath) -- srv.listen(8) -- try: -- while True: -- conn, _ = srv.accept() -- try: -- while True: -- req = recv(conn) -- if req is None: -- break -- name, args = req -- if name == "__shutdown__": -- return -- try: -- send(conn, (True, dispatch(name, args))) -- except Exception as e: # noqa: BLE001 -- report, keep serving -- send(conn, (False, f"{type(e).__name__}: {e}")) -- except (ConnectionError, OSError): -- pass -- finally: -- conn.close() -- finally: -- try: -- import idapro -- idapro.close_database(save=False) -- except Exception: # noqa: BLE001 -- pass -- try: -- os.unlink(sockpath) -- except OSError: -- pass -- -- --def main(argv=None) -> None: -- argv = argv if argv is not None else sys.argv[1:] -- if len(argv) < 2: -- sys.stderr.write( -- "usage: python -m idatui.worker <sock> <binary> [ida-load-args]\n") -- raise SystemExit(2) -- try: -- serve(argv[0], argv[1], argv[2] if len(argv) > 2 else "") -- except SystemExit: -- raise -- except BaseException as e: # noqa: BLE001 -- surface a clean cause + code 1 -- import traceback -- sys.stderr.write(f"\nWORKER-FATAL: {type(e).__name__}: {e}\n") -- traceback.print_exc() -- sys.stderr.flush() -- raise SystemExit(1) -- -- --if __name__ == "__main__": -- main() -diff --git a/idatui/worker_client.py b/idatui/worker_client.py -deleted file mode 100644 -index 79a6db9..0000000 ---- a/idatui/worker_client.py -+++ /dev/null -@@ -1,234 +0,0 @@ --"""WorkerClient — a drop-in replacement for ``IDAClient`` backed by our own --idalib worker (``idatui.worker``) over a unix socket instead of ida-pro-mcp's --HTTP/JSON transport. -- --It exposes exactly the surface the app/domain use on the client --(``call``/``call_envelope``/``connect``/``set_db``/``resolve_db``/ --``list_sessions``/``health``/``keepalive``/``close``) and returns byte-identical --payloads (the worker calls the same tool functions), so ``domain.py`` and the --app are unchanged — you just construct a WorkerClient instead of an IDAClient. -- --Concurrency: the app fires calls from several worker threads over one client; --the worker is single-threaded, so calls are serialized under a lock (the worker --processes one tool at a time anyway — and at ~50us/call that's free). --""" --from __future__ import annotations -- --import os --import socket --import subprocess --import sys --import threading --import time --import uuid --from typing import Any -- --from .errors import IDAToolError, IDAConnectionError, Session --from .worker import recv as _recv --from .worker import send as _send -- --_WORKER_PY = os.path.join(os.path.dirname(os.path.abspath(__file__)), "worker.py") --_worker_python_cache: str | None = None -- -- --def _find_worker_python() -> str: -- """A python that can import ``ida_pro_mcp`` (and thus idalib) — NOT necessarily -- the TUI's python. On a typical box the TUI runs under a venv that has textual -- + idalib but not ida_pro_mcp, while the system python has idalib + -- ida_pro_mcp. Override with IDATUI_WORKER_PYTHON.""" -- global _worker_python_cache -- if _worker_python_cache: -- return _worker_python_cache -- override = os.environ.get("IDATUI_WORKER_PYTHON") -- candidates = [override] if override else [] -- candidates += ["/usr/bin/python", "/usr/bin/python3", sys.executable] -- for py in candidates: -- if not py or not os.path.exists(py): -- continue -- try: -- r = subprocess.run([py, "-c", "import ida_pro_mcp"], -- capture_output=True, timeout=30) -- if r.returncode == 0: -- _worker_python_cache = py -- return py -- except Exception: # noqa: BLE001 -- continue -- return sys.executable # last resort; the worker will report the real error -- -- --class _NoopKeepAlive: -- """The worker is ours and never idles out, so keepalive is a no-op.""" -- -- def __init__(self) -> None: -- self.beats = self.failures = 0 -- -- def start(self): -- return self -- -- def stop(self) -> None: -- pass -- -- --class WorkerClient: -- def __init__(self, binary_path: str, *, ttl: int = 0, -- python: str | None = None, load_args: str = "") -> None: -- self._bin = os.path.abspath(os.path.expanduser(binary_path)) -- self._load_args = load_args or "" # IDA switches for a headerless blob -- self._python = python or _find_worker_python() -- tag = f"{os.getpid()}-{uuid.uuid4().hex[:8]}" -- self._sock_path = f"/tmp/idatui-worker-{tag}.sock" -- self._log_path = f"/tmp/idatui-worker-{tag}.log" -- self._proc: subprocess.Popen | None = None -- self._sock: socket.socket | None = None -- self._sid = uuid.uuid4().hex[:8] -- self._lock = threading.Lock() # serialize socket use -- self._spawn_lock = threading.Lock() -- -- # -- lifecycle --------------------------------------------------------- # -- def connect(self, timeout: float = 1800.0, progress=None) -> "WorkerClient": -- """Spawn the worker (opens + analyzes the DB) and connect once ready.""" -- with self._spawn_lock: -- if self._sock is not None: -- return self -- if self._proc is None or self._proc.poll() is not None: -- # run worker.py as a SCRIPT (not -m idatui.worker) so we don't -- # import the textual-dependent idatui package __init__ under the -- # IDA python, which usually has no textual. -- argv = [self._python, _WORKER_PY, self._sock_path, self._bin] -- if self._load_args: -- argv.append(self._load_args) -- self._proc = subprocess.Popen( -- argv, -- stdout=open(self._log_path, "wb"), -- stderr=subprocess.STDOUT, stdin=subprocess.DEVNULL, -- ) -- deadline = time.time() + timeout -- t0 = time.time() -- while time.time() < deadline: -- try: -- s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) -- s.connect(self._sock_path) -- self._sock = s -- return self -- except OSError: -- if self._proc.poll() is not None: -- raise IDAConnectionError( -- f"worker exited (code {self._proc.returncode}): " -- f"{self._log_tail()} [full log: {self._log_path}]") -- if progress: -- progress(f"auto-analyzing {os.path.basename(self._bin)}… " -- f"({int(time.time() - t0)}s)") -- time.sleep(0.2) -- raise IDAConnectionError("worker did not become ready in time") -- -- @property -- def pid(self) -> int | None: -- """The worker process id (for memory accounting), or None if not spawned.""" -- return self._proc.pid if self._proc is not None else None -- -- def close(self, grace: float = 20.0) -> None: -- """Shut the worker down cleanly. -- -- After ``__shutdown__`` the worker still has to ``close_database()``, which -- re-packs the ``.i64`` and removes the unpacked ``.id0/.id1/...`` scratch. -- Signalling it before that finishes is what leaves databases wedged, so -- wait out the grace period first and only escalate if it really is stuck. -- """ -- with self._lock: -- s = self._sock -- self._sock = None -- if s is not None: -- try: -- _send(s, ("__shutdown__", {})) -- except Exception: # noqa: BLE001 -- pass -- try: -- s.close() -- except Exception: # noqa: BLE001 -- pass -- if self._proc is not None: -- try: -- self._proc.wait(timeout=grace) # let it close the DB properly -- except Exception: # noqa: BLE001 -- TimeoutExpired: it's stuck -- try: -- self._proc.terminate() -- self._proc.wait(timeout=5) -- except Exception: # noqa: BLE001 -- try: -- self._proc.kill() -- except Exception: # noqa: BLE001 -- pass -- -- # -- the call surface -------------------------------------------------- # -- def call(self, tool: str, *, timeout: float | None = None, **args) -> Any: -- if self._sock is None: -- self.connect() -- with self._lock: -- s = self._sock -- if s is None: -- raise IDAConnectionError("worker connection is closed") -- try: -- _send(s, (tool, args)) -- reply = _recv(s) -- except (OSError, ConnectionError) as e: -- self._sock = None -- raise IDAConnectionError(f"worker transport failed: {e}") from e -- if reply is None: -- self._sock = None -- raise IDAConnectionError("worker closed the connection") -- ok, payload = reply -- if not ok: -- raise IDAToolError(tool, str(payload)) -- return payload -- -- def call_envelope(self, tool: str, *, timeout: float | None = None, -- **args) -> dict: -- # domain.decompile() reads result.structuredContent — mirror that shape. -- return {"result": {"structuredContent": self.call(tool, timeout=timeout, -- **args)}} -- -- # -- session shims (single-DB worker) --------------------------------- # -- def set_db(self, db: str | None) -> None: -- if db: -- self._sid = db -- -- def resolve_db(self) -> str: -- return self._sid -- -- def list_sessions(self) -> list[Session]: -- return [Session(session_id=self._sid, -- filename=os.path.basename(self._bin), -- input_path=self._bin, is_active=True)] -- -- def health(self) -> dict: -- try: -- return self.call("server_health") -- except IDAToolError: -- return {"module": os.path.basename(self._bin), "ok": True} -- -- def keepalive(self, interval: float = 120.0) -> _NoopKeepAlive: -- return _NoopKeepAlive() -- -- def _log_tail(self, n: int = 400) -> str: -- """Last meaningful line(s) of the worker log (skip IDA's licence banner), -- so a startup crash surfaces the real cause instead of just 'code 1'.""" -- try: -- with open(self._log_path, encoding="utf-8", errors="replace") as f: -- lines = [ln.strip() for ln in f if ln.strip()] -- except OSError: -- return "(no worker log)" -- # the worker prints a clean 'WORKER-FATAL: ...' line on a startup crash -- for ln in reversed(lines): -- if ln.startswith("WORKER-FATAL:"): -- return ln[len("WORKER-FATAL:"):].strip()[-n:] -- skip = ("thank you", "licensed to", "[mcp]", "ida ", "hex-rays") -- meaningful = [ln for ln in lines -- if not any(s in ln.lower() for s in skip)] -- return " | ".join((meaningful or lines)[-3:])[-n:] -- -- # context manager parity with IDAClient -- def __enter__(self) -> "WorkerClient": -- return self.connect() -- -- def __exit__(self, *exc) -> None: -- self.close() -diff --git a/pyproject.toml b/pyproject.toml -index 30f8cc2..72f1ff3 100644 ---- a/pyproject.toml -+++ b/pyproject.toml -@@ -1,15 +1,17 @@ - [project] - name = "idatui" - version = "0.0.1" --description = "A minimal keyboard-first TUI frontend for IDA Pro over the ida-pro-mcp (idalib) server." -+description = "A keyboard-first TUI frontend for shared IDA Code Mode databases." - requires-python = ">=3.11" --# The client layer is intentionally stdlib-only (urllib/http.client), matching the --# ida-mcp skill philosophy: no install needed to talk to the server. --dependencies = [] -+# ida-codemode supplies GUI discovery, shared idalib workers, leases, and the -+# execute_python/ida-domain database surface. -+dependencies = [ -+ "ida-codemode-mcp", -+ "textual>=8", -+ "pygments>=2", # Used directly for pseudocode highlighting. -+] - - [project.optional-dependencies] --# The TUI layer pulls in Textual; the client/domain layers are stdlib-only. --tui = ["textual>=8", "pygments>=2"] # pygments ships with rich; explicit for the C lexer - dev = ["pytest>=8"] - - [project.scripts] -@@ -22,3 +24,6 @@ build-backend = "hatchling.build" - - [tool.hatch.build.targets.wheel] - packages = ["idatui"] -+ -+[tool.uv.sources] -+ida-codemode-mcp = { path = "../ida-codemode-mcp", editable = true } -diff --git a/server/patch_server.py b/server/patch_server.py -deleted file mode 100644 -index 160b15b..0000000 ---- a/server/patch_server.py -+++ /dev/null -@@ -1,1248 +0,0 @@ --#!/usr/bin/env python3 --"""Inject idatui's extra ida-pro-mcp tools into the installed server package. -- --DEPRECATED along with the ida-pro-mcp transport: the default backend is now the --idalib worker (idatui/worker.py), which registers these same tools in-process and --needs no patching. Kept only for `--backend mcp`; slated for removal. -- --ida-pro-mcp lacks a few tools idatui needs. Rather than vendor/fork the server, --we keep the tool source here and inject it (idempotently) into the installed --``api_types.py``. That module is imported by every worker --(``python -m ida_pro_mcp.idalib_server``), so the tools register themselves via --``@tool`` on the shared ``MCP_SERVER`` — no server code is forked, and re-running --this (spawn.sh does, on every start) re-applies it after a reinstall/upgrade. -- --Injected tools: -- * ``del_type`` — delete a named local type (struct editor CRUD). -- * ``func_types`` — structured decompiler types for a function (prototype + -- local variables), so clients don't parse pseudocode text. -- * ``set_lvar_type`` — set a decompiler local variable's type; works on auto/ -- register vars too (the stock set_type only updates lvars -- that already have user-saved info). -- --The block between the BEGIN/END markers is *replaced* on each run, so editing --BODY here and restarting the supervisor updates the tools. -- --Run with the *same* interpreter the server uses (the idalib-mcp entry point's --``/usr/bin/python``), so it patches the file the workers actually import. --Changing a tool needs a supervisor restart so workers respawn. --""" --from __future__ import annotations -- --import importlib.util --import pathlib --import sys -- --BEGIN = "# >>> idatui-ext: begin (auto-injected by server/patch_server.py) >>>" --END = "# <<< idatui-ext: end <<<" -- --# Appended to ida_pro_mcp/ida_mcp/api_types.py, which already imports --# ``Annotated``, ``tool``, ``idasync``, ``ida_typeinf``, ``parse_address`` and --# ``_parse_type_tinfo``. --BODY = ''' --def _idatui_lv_get(x): -- return x() if callable(x) else x -- -- --@tool --@idasync --def resolve_names( -- queries: Annotated[list, "Symbol name(s) to resolve to their OWN address"], --) -> list: -- """Resolve named locations (functions, labels like loc_/locret_, data) to the -- exact address the NAME denotes, via get_name_ea. Unlike lookup_funcs, a -- mid-function label resolves to the label's address, not the containing -- function's entry.""" -- import idaapi -- qs = queries if isinstance(queries, list) else [queries] -- out = [] -- for q in qs: -- q = str(q).strip() -- ea = idaapi.get_name_ea(idaapi.BADADDR, q) -- out.append({"query": q, "ea": (hex(ea) if ea != idaapi.BADADDR else None)}) -- return out -- -- --@tool --@idasync --def del_type( -- name: Annotated[str, "Local type name to delete (struct/union/enum/typedef)"], --) -> dict: -- """Delete a named local type from the local type library.""" -- til = ida_typeinf.get_idati() -- ok = ida_typeinf.del_named_type(til, name, ida_typeinf.NTF_TYPE) -- if not ok: -- return {"name": name, "error": f"Type '{name}' not found or could not be deleted"} -- return {"name": name, "deleted": True} -- -- --@tool --@idasync --def func_types( -- addr: Annotated[str, "Function address or name"], --) -> dict: -- """Structured decompiler types for a function: its prototype plus each local -- variable (name/type/is_arg). Lets clients read/edit types without parsing -- pseudocode text.""" -- import ida_hexrays -- import idaapi -- -- def _tstr(tif): -- try: -- s = tif.dstr() -- if s: -- return s -- except Exception: -- pass -- return str(tif) -- -- ea = parse_address(addr) -- f = idaapi.get_func(ea) -- if not f: -- return {"addr": str(addr), "error": "no function at address"} -- try: -- cf = ida_hexrays.decompile(f.start_ea) -- except Exception as e: -- return {"addr": hex(f.start_ea), "error": f"decompile failed: {e}"} -- if cf is None: -- return {"addr": hex(f.start_ea), "error": "decompilation failed"} -- name = idaapi.get_func_name(f.start_ea) or "" -- try: -- proto = ida_typeinf.print_tinfo( -- "", 0, 0, ida_typeinf.PRTYPE_1LINE, cf.type, name, "") -- except Exception: -- proto = "" -- lvars = [] -- for lv in cf.get_lvars(): -- try: -- ty = _tstr(_idatui_lv_get(lv.type)) -- except Exception: -- ty = "" -- lvars.append({ -- "name": _idatui_lv_get(lv.name), -- "type": ty, -- "is_arg": bool(_idatui_lv_get(lv.is_arg_var)), -- }) -- return { -- "addr": hex(f.start_ea), -- "name": name, -- "prototype": (proto or "").strip(), -- "lvars": lvars, -- } -- -- --@tool --@idasync --def set_lvar_type( -- addr: Annotated[str, "Function address or name"], -- variable: Annotated[str, "Local variable name"], -- type: Annotated[str, "New C type for the variable"], --) -> dict: -- """Set a decompiler local variable's type. Handles auto/register vars (unlike -- set_type, which only updates lvars that already have user-saved info).""" -- import ida_hexrays -- import idaapi -- -- ea = parse_address(addr) -- f = idaapi.get_func(ea) -- if not f: -- return {"error": "no function at address"} -- try: -- cf = ida_hexrays.decompile(f.start_ea) -- except Exception as e: -- return {"error": f"decompile failed: {e}"} -- if cf is None: -- return {"error": "decompilation failed"} -- target = None -- for lv in cf.get_lvars(): -- if _idatui_lv_get(lv.name) == variable: -- target = lv -- break -- if target is None: -- return {"error": f"local variable {variable!r} not found"} -- try: -- tif = _parse_type_tinfo(type) -- except Exception as e: -- return {"error": f"bad type {type!r}: {e}"} -- lsi = ida_hexrays.lvar_saved_info_t() -- try: -- lsi.ll = target -- except Exception: -- try: -- lsi.ll.location = _idatui_lv_get(target.location) -- lsi.ll.defea = target.defea -- except Exception as e: -- return {"error": f"could not locate variable: {e}"} -- lsi.type = tif -- ok = bool(ida_hexrays.modify_user_lvar_info( -- f.start_ea, ida_hexrays.MLI_TYPE, lsi)) -- return {"addr": hex(f.start_ea), "variable": variable, "type": type, "ok": ok} -- -- --@tool --@idasync --def file_regions() -> dict: -- """Loaded segments mapped to their raw file offsets (get_fileregion_offset), -- so clients can convert a virtual address to an on-disk file offset without a -- format-specific header parser. file_off is -1 for non-file-backed segments -- (e.g. .bss).""" -- import ida_segment -- import idaapi -- -- out = [] -- seg = ida_segment.get_first_seg() -- while seg is not None: -- try: -- fo = int(idaapi.get_fileregion_offset(seg.start_ea)) -- except Exception: -- fo = -1 -- if fo < 0 or fo >= (1 << 48): -- fo = -1 -- try: -- nm = ida_segment.get_segm_name(seg) or "" -- except Exception: -- nm = "" -- out.append({"start": hex(seg.start_ea), "end": hex(seg.end_ea), -- "file_off": fo, "name": nm}) -- seg = ida_segment.get_next_seg(seg.start_ea) -- return {"regions": out} -- -- --@tool --@idasync --def make_string( -- addr: Annotated[str, "Address of the string start"], -- length: Annotated[int, "Length in bytes (0 = auto-detect to the terminator)"] = 0, -- kind: Annotated[str, "String kind: c | c16 | c32 | pascal"] = "c", --) -> dict: -- """Create a string literal at ``addr`` (IDA's 'A'). ``length`` 0 auto-detects -- to the terminator. Undefines any items in the way first, like the UI does. -- Returns the created byte size and the decoded contents.""" -- import ida_bytes -- import ida_nalt -- -- ea = parse_address(addr) -- strtype = { -- "c": ida_nalt.STRTYPE_C, -- "c16": ida_nalt.STRTYPE_C_16, -- "c32": ida_nalt.STRTYPE_C_32, -- "pascal": ida_nalt.STRTYPE_PASCAL, -- }.get(str(kind).lower(), ida_nalt.STRTYPE_C) -- n = max(int(length), 0) -- # Free any existing item(s) so create_strlit can carve the literal. -- ida_bytes.del_items(ea, ida_bytes.DELIT_SIMPLE, n if n > 0 else 1) -- ok = bool(ida_bytes.create_strlit(ea, n, strtype)) -- if not ok: -- return {"addr": addr, "ok": False, "error": "create_strlit failed"} -- size = int(ida_bytes.get_item_size(ea)) -- try: -- raw = ida_bytes.get_strlit_contents(ea, -1, strtype) -- text = raw.decode("utf-8", "replace") if raw else "" -- except Exception: -- text = "" -- return {"addr": addr, "ok": True, "size": size, "text": text} -- -- --@tool --@idasync --def read_raw( -- addr: Annotated[str, "Start address (hex or name)"], -- size: Annotated[int, "Number of bytes to read"], --) -> dict: -- """Read ``size`` bytes at ``addr`` as ONE contiguous lowercase hex string -- (no per-byte '0x'/spaces). The hot path for the hex view and disasm opcode -- bytes. -- -- Fast: does a single bulk ``ida_bytes.get_bytes`` (C-speed) instead of the -- per-byte read_bytes_bss_safe loop (2 IDA calls/byte). Unloaded bytes come -- back from IDA as the 0xFF sentinel, so we only re-check is_loaded for the -- (usually sparse) 0xFF bytes and zero the genuinely-unloaded ones — matching -- get_bytes' bss semantics without paying per-byte for the whole range. -- -- Encoding is compact hex (~2.5x smaller than get_bytes' '0x..'-with-spaces) -- and, unlike get_bytes, does not truncate on large reads.""" -- import ida_bytes -- -- ea = parse_address(addr) -- n = max(int(size), 0) -- if n == 0: -- return {"addr": addr, "hex": "", "n": 0} -- raw = ida_bytes.get_bytes(ea, n) -- if raw is None or len(raw) < n: # nothing (or not all) mapped -- base = bytearray(raw or b"") -- base.extend(b"\\xff" * (n - len(base))) -- raw = bytes(base) -- ba = bytearray(raw) -- # Only unloaded bytes read as 0xFF; correct just those to 0 (bss => zero). -- i = ba.find(0xFF) -- while i != -1: -- if not ida_bytes.is_loaded(ea + i): -- ba[i] = 0 -- i = ba.find(0xFF, i + 1) -- return {"addr": addr, "hex": bytes(ba).hex(), "n": len(ba)} -- -- --def _idatui_head_row(ea): -- """One flat-listing row for the head at ``ea``: kind (code/data/unknown), -- byte size, rendered text, and any symbol name.""" -- import ida_bytes -- import ida_lines -- import ida_name -- -- f = ida_bytes.get_flags(ea) -- if ida_bytes.is_code(f): -- kind = "code" -- elif ida_bytes.is_data(f): -- kind = "data" -- else: -- kind = "unknown" -- line = ida_lines.generate_disasm_line(ea, 0) -- text = ida_lines.tag_remove(line) if line else "" -- text = " ".join(text.split()) # collapse IDA's column padding -- row = { -- "ea": hex(ea), -- "kind": kind, -- "size": int(ida_bytes.get_item_size(ea)), -- "text": text, -- } -- if line: -- # Keep IDA's own token classification for syntax highlighting. Built from -- # the SAME line as `text`, then whitespace-collapsed identically so the -- # two never disagree about what the row says. -- spans = _idatui_spans(line) -- joined = "".join(t for _k, t in spans) -- if " ".join(joined.split()) == text: -- row["spans"] = spans -- nm = ida_name.get_ea_name(ea) -- if nm: -- row["name"] = nm -- return row -- -- --#: IDA colour tag -> the semantic kind the TUI styles. IDA already classifies --#: every token in a disassembly line, for every processor it supports, so there --#: is nothing to lex: generate_disasm_line emits \x01<tag>text\x02<tag> and the --#: tag says what the text IS. A pygments assembly lexer would be a worse guess at --#: this and would need one dialect per architecture. --_IDATUI_SPAN_KINDS = { -- "insn": ("SCOLOR_INSN", "SCOLOR_KEYWORD", "SCOLOR_ASMDIR", "SCOLOR_MACRO"), -- "reg": ("SCOLOR_REG",), -- "num": ("SCOLOR_NUMBER", "SCOLOR_CHAR", "SCOLOR_BINPREF"), -- "str": ("SCOLOR_STRING",), -- # NB the real constant names: DATNAME/CODNAME, not "DNAME". Guessing here -- # fails silently — an unmapped tag renders as plain body text, so symbols -- # just quietly aren't blue and nothing tells you why. -- "name": ("SCOLOR_DATNAME", "SCOLOR_CODNAME", "SCOLOR_LOCNAME", -- "SCOLOR_IMPNAME", "SCOLOR_DEMNAME", "SCOLOR_LIBNAME", -- "SCOLOR_CNAME", "SCOLOR_DNAME", -- "SCOLOR_CREF", "SCOLOR_DREF", "SCOLOR_CREFTAIL", "SCOLOR_DREFTAIL"), -- "seg": ("SCOLOR_SEGNAME",), -- "cmt": ("SCOLOR_AUTOCMT", "SCOLOR_REGCMT", "SCOLOR_RPTCMT", "SCOLOR_VOIDOP"), -- "punct": ("SCOLOR_SYMBOL", "SCOLOR_ALTOP", "SCOLOR_HIDNAME"), -- "err": ("SCOLOR_ERROR",), --} -- -- --def _idatui_tag_map(): -- """{tag character: kind}, built once from whatever this IDA actually has.""" -- import ida_lines -- out = {} -- for kind, names in _IDATUI_SPAN_KINDS.items(): -- for n in names: -- v = getattr(ida_lines, n, None) -- if isinstance(v, str) and v: -- out[v[0]] = kind -- elif isinstance(v, int): -- out[chr(v)] = kind -- return out -- -- --_IDATUI_TAGS = None -- -- --def _idatui_spans(line): -- """A tagged disasm line as [[kind, text], ...], colour tags resolved. -- -- Unknown tags become 'text' rather than being dropped: a processor module can -- emit a colour we don't classify, and losing the characters would corrupt the -- line.""" -- global _IDATUI_TAGS -- import ida_lines -- if _IDATUI_TAGS is None: -- _IDATUI_TAGS = _idatui_tag_map() -- on, off, esc = "\x01", "\x02", "\x03" -- addr_tag = chr(getattr(ida_lines, "COLOR_ADDR", 0x28)) -- addr_len = int(getattr(ida_lines, "COLOR_ADDR_SIZE", 16)) -- spans, stack, buf = [], [], [] -- i, n = 0, len(line) -- -- def flush(): -- if buf: -- spans.append([stack[-1] if stack else "text", "".join(buf)]) -- del buf[:] -- -- while i < n: -- ch = line[i] -- if ch == on and i + 1 < n: -- tag = line[i + 1] -- if tag == addr_tag: -- # An embedded target address, not display text: 16 hex digits -- # that must not reach the screen. -- i += 2 + addr_len -- continue -- flush() -- stack.append(_IDATUI_TAGS.get(tag, "text")) -- i += 2 -- continue -- if ch == off and i + 1 < n: -- flush() -- if stack: -- stack.pop() -- i += 2 -- continue -- if ch == esc and i + 1 < n: # escaped literal -- buf.append(line[i + 1]) -- i += 2 -- continue -- buf.append(ch) -- i += 1 -- flush() -- # Collapse IDA's column padding EXACTLY as the plain text does. A run of -- # spaces can straddle two spans, so this walks characters rather than -- # collapsing each span on its own — otherwise the spans and `text` disagree -- # about the line and the row silently loses its highlighting. -- out, prev_space = [], False -- for kind, txt in spans: -- acc = [] -- for ch in txt: -- if ch.isspace(): -- if prev_space: -- continue -- acc.append(" ") -- prev_space = True -- else: -- acc.append(ch) -- prev_space = False -- if acc: -- out.append([kind, "".join(acc)]) -- while out and out[0][1] == " ": -- out.pop(0) -- while out and out[-1][1] == " ": -- out.pop() -- if out and out[0][1].startswith(" "): -- out[0][1] = out[0][1].lstrip() -- if out and out[-1][1].endswith(" "): -- out[-1][1] = out[-1][1].rstrip() -- return [[k, t] for k, t in out if t] -- -- --def _idatui_unknown_row(ea, size): -- """One collapsed row for a run of ``size`` undefined bytes starting at -- ``ea``. A single byte is rendered normally (shows its value); a longer run -- collapses to ``db N dup(?)`` so a big .bss/gap doesn't explode into millions -- of one-byte rows.""" -- import ida_name -- -- if size <= 1: -- return _idatui_head_row(ea) -- row = {"ea": hex(ea), "kind": "unknown", "size": int(size), -- "text": f"db {size} dup(?)"} -- nm = ida_name.get_ea_name(ea) -- if nm: -- row["name"] = nm -- return row -- -- --def _idatui_struct_member_rows(ea): -- """Indented member rows for a struct-typed data item at ``ea`` (expansion), -- or [] if it isn't a struct. Top-level fields only.""" -- import ida_nalt -- import ida_typeinf -- import idaapi -- -- tif = ida_typeinf.tinfo_t() -- if not (ida_nalt.get_tinfo(tif, ea) and tif.is_udt()): -- return [] -- udt = ida_typeinf.udt_type_data_t() -- if not tif.get_udt_details(udt): -- return [] -- rows = [] -- for m in udt: -- off = m.begin() // 8 -- try: -- mtype = m.type._print() or "" -- except Exception: -- mtype = "" -- try: -- sz = int(m.type.get_size()) -- if sz == idaapi.BADSIZE: -- sz = 0 -- except Exception: -- sz = 0 -- name = m.name or "" -- text = f"+{off:X} {name}" + (f" {mtype}" if mtype else "") -- rows.append({"ea": hex(ea + off), "kind": "member", "size": sz, -- "text": text}) -- return rows -- -- --def _idatui_func_header_rows(ea): -- """IDA-style subroutine banner rows shown just before a function's entry.""" -- import ida_funcs -- -- name = ida_funcs.get_func_name(ea) or "sub_%X" % ea -- bar = "=" * 15 + " S U B R O U T I N E " + "=" * 15 -- return [ -- {"ea": hex(ea), "kind": "sep", "size": 0, "text": ""}, -- {"ea": hex(ea), "kind": "sep", "size": 0, "text": "; " + bar}, -- {"ea": hex(ea), "kind": "funchdr", "size": 0, -- "text": name + " proc", "name": name}, -- ] -- -- --def _idatui_func_footer_rows(ea, func): -- """End-of-function marker shown just after a function's last item.""" -- import ida_funcs -- -- name = ida_funcs.get_func_name(func.start_ea) or "sub_%X" % func.start_ea -- return [ -- {"ea": hex(ea), "kind": "funchdr", "size": 0, -- "text": name + " endp", "name": name}, -- {"ea": hex(ea), "kind": "sep", "size": 0, "text": "; " + "-" * 60}, -- ] -- -- --@tool --@idasync --def heads( -- addr: Annotated[str, "Start address or name to walk from"], -- count: Annotated[int, "Max heads to return (default 200, max 2000)"] = 200, -- offset: Annotated[int, "Skip first N heads from addr (default 0)"] = 0, -- end: Annotated[str, "Optional exclusive end address; default = segment end"] = "", -- back: Annotated[bool, "Walk backwards: return the count heads ENDING just before addr, in forward order"] = False, -- annotate: Annotated[bool, "Emit IDA-style function boundary banner rows (kind sep/funchdr)"] = False, --) -> dict: -- """Walk item heads from ``addr`` as a flat listing: every head is rendered -- (code OR data OR undefined) via generate_disasm_line and stepped with -- next_head/prev_head. Unlike ``disasm`` (code-only, bails at the first data -- byte) this shows db/dw/dd/... lines for data and undefined regions — IDA's -- real disassembly view. Address-paged: page forward by re-calling with -- ``addr`` = the returned cursor.next; page up with ``back=true``.""" -- import ida_bytes -- import ida_segment -- import idaapi -- -- count = 2000 if count > 2000 else (1 if count < 1 else count) -- offset = max(int(offset), 0) -- try: -- start = parse_address(addr) -- except Exception as e: -- return {"addr": str(addr), "error": str(e), "heads": [], "cursor": {"done": True}} -- seg = ida_segment.getseg(start) -- if not seg: -- return {"addr": str(addr), "error": "no segment", "heads": [], "cursor": {"done": True}} -- lo, hi = seg.start_ea, seg.end_ea -- if end: -- try: -- hi = min(hi, parse_address(end)) -- except Exception: -- pass -- -- rows = [] -- if back: -- # Collect up to (count+offset) heads strictly before `start`, then take -- # the window closest to `start`, returned in forward order. -- walk = [] -- cur = ida_bytes.prev_head(start, lo) -- while cur != idaapi.BADADDR and cur >= lo and len(walk) < count + offset: -- walk.append(cur) -- cur = ida_bytes.prev_head(cur, lo) -- walk.reverse() -- chosen = walk[: len(walk) - offset] if offset else walk -- chosen = chosen[-count:] -- rows = [_idatui_head_row(e) for e in chosen] -- first = chosen[0] if chosen else start -- pea = ida_bytes.prev_head(first, lo) -- cursor = {"done": True} if pea == idaapi.BADADDR or pea < lo else {"prev": hex(pea)} -- return {"addr": str(addr), "heads": rows, "cursor": cursor} -- -- # Walk by item END (not next_head): next_head SKIPS undefined bytes, but a -- # flat listing must show them (IDA renders undefined as `db ?` lines, and -- # navigating to an unmarked address must land ON it). Defined items advance -- # by get_item_end; a run of undefined bytes is COLLAPSED into one row (its -- # end found in O(1) via next_head, which skips undefined) so a large .bss or -- # gap doesn't explode into millions of one-byte rows. -- def _is_unknown(e): -- f = ida_bytes.get_flags(e) -- return not (ida_bytes.is_code(f) or ida_bytes.is_data(f)) -- -- def _run_end(e): -- """End (exclusive) of the undefined run starting at ``e``.""" -- nh = ida_bytes.next_head(e, hi) -- return nh if (nh != idaapi.BADADDR and e < nh <= hi) else hi -- -- def _advance(e): -- if _is_unknown(e): -- return _run_end(e) -- nxt = ida_bytes.get_item_end(e) -- return nxt if nxt > e else e + 1 -- -- def _rows_for(e): -- if _is_unknown(e): -- return [_idatui_unknown_row(e, _run_end(e) - e)] -- func = idaapi.get_func(e) if annotate else None -- at_start = func is not None and func.start_ea == e -- out = [] -- if at_start: -- out.extend(_idatui_func_header_rows(e)) -- row = _idatui_head_row(e) -- if at_start: -- row = dict(row) -- row["name"] = None # the name is shown on the proc header line -- elif annotate and row.get("kind") == "code" and row.get("name"): -- # A code label (loc_XXX/jump target) gets its OWN line at depth 0, -- # like IDA; strip it from the instruction row below. -- nm = row["name"] -- out.append({"ea": hex(e), "kind": "label", "size": 0, -- "text": nm + ":", "name": nm}) -- row = dict(row) -- row["name"] = None -- out.append(row) -- if row.get("kind") == "data": -- out.extend(_idatui_struct_member_rows(e)) # expand struct fields -- if func is not None and ida_bytes.get_item_end(e) >= func.end_ea: -- out.extend(_idatui_func_footer_rows(e, func)) -- return out -- -- ea = ida_bytes.get_item_head(start) -- for _ in range(offset): -- if ea >= hi or ea == idaapi.BADADDR: -- break -- ea = _advance(ea) -- more = False -- while ea != idaapi.BADADDR and ea < hi: -- if len(rows) >= count: -- more = True -- break -- rows.extend(_rows_for(ea)) # a struct head expands into member rows -- ea = _advance(ea) -- cursor = {"next": hex(ea)} if more else {"done": True} -- return {"addr": str(addr), "heads": rows, "cursor": cursor} -- -- --@tool --@idasync --def xref_types( -- queries: Annotated[list, "[{addr, direction:'to'|'from'|'both', include_fn, dedup, count}]"], --) -> dict: -- """Like xref_query, but every row carries a fine-grained ``kind`` derived from -- the IDA xref type \u2014 call/jump/flow for code, read/write/offset/text/info for -- data \u2014 alongside the coarse ``type`` (code/data). Feeds the xref dialog's -- r/w/call badges. Same query/envelope shape as xref_query.""" -- import idaapi, idautils, ida_funcs, ida_bytes, ida_xref -- code_kind = {ida_xref.fl_CF: "call", ida_xref.fl_CN: "call", -- ida_xref.fl_JF: "jump", ida_xref.fl_JN: "jump", -- ida_xref.fl_F: "flow"} -- data_kind = {ida_xref.dr_O: "offset", ida_xref.dr_W: "write", -- ida_xref.dr_R: "read", ida_xref.dr_T: "text", ida_xref.dr_I: "info"} -- -- def _kind(xr): -- table = code_kind if xr.iscode else data_kind -- return table.get(xr.type, "code" if xr.iscode else "data") -- -- def _fn(ea): -- f = ida_funcs.get_func(ea) -- if not f: -- return None -- return {"addr": hex(f.start_ea), "name": ida_funcs.get_func_name(f.start_ea)} -- -- def _resolve(raw): -- raw = str(raw).strip() -- try: -- return int(raw, 16) # handles '0x2490' and '2490' -- except ValueError: -- return idaapi.get_name_ea(idaapi.BADADDR, raw) -- -- qs = queries if isinstance(queries, list) else [queries] -- result = [] -- for q in qs: -- q = q if isinstance(q, dict) else {"addr": q} -- raw = str(q.get("addr", "")).strip() -- direction = str(q.get("direction", "to") or "to").lower() -- include_fn = bool(q.get("include_fn", True)) -- dedup = bool(q.get("dedup", True)) -- try: -- count = int(q.get("count", 2000) or 2000) -- except (TypeError, ValueError): -- count = 2000 -- target = _resolve(raw) -- rows = [] -- if target is not None and target != idaapi.BADADDR and ida_bytes.is_mapped(target): -- if direction in ("to", "both"): -- for xr in idautils.XrefsTo(target, 0): -- row = {"direction": "to", "addr": hex(xr.frm), "from": hex(xr.frm), -- "to": hex(target), "type": "code" if xr.iscode else "data", -- "kind": _kind(xr)} -- if include_fn: -- row["fn"] = _fn(xr.frm) -- rows.append(row) -- if direction in ("from", "both"): -- for xr in idautils.XrefsFrom(target, 0): -- row = {"direction": "from", "addr": hex(xr.to), "from": hex(target), -- "to": hex(xr.to), "type": "code" if xr.iscode else "data", -- "kind": _kind(xr)} -- if include_fn: -- row["fn"] = _fn(xr.to) -- rows.append(row) -- if dedup: -- seen = set() -- deduped = [] -- for r in rows: -- k = (r["direction"], r["from"], r["to"], r["kind"]) -- if k in seen: -- continue -- seen.add(k) -- deduped.append(r) -- rows = deduped -- rows = rows[:count] -- result.append({"query": raw, "data": rows, "next_offset": None}) -- return {"result": result} -- -- --@tool --@idasync --def data_type( -- addr: Annotated[str, "Address or name of a data item / global"], --) -> dict: -- """The current C type of a data item, for prefilling a retype prompt: -- {addr, name, type, size, is_func}. ``type`` is empty when the item is -- untyped; ``is_func`` distinguishes a global from a function so the caller -- knows which flavour of set_type to use.""" -- import idaapi -- import ida_bytes -- import ida_name -- import idc -- raw = str(addr).strip() -- try: -- ea = int(raw, 16) -- except ValueError: -- ea = idaapi.get_name_ea(idaapi.BADADDR, raw) -- if ea == idaapi.BADADDR or not ida_bytes.is_mapped(ea): -- return {"addr": raw, "error": f"not a mapped address: {raw}"} -- return { -- "addr": hex(ea), -- "name": ida_name.get_name(ea) or "", -- "type": idc.get_type(ea) or "", -- "size": int(ida_bytes.get_item_size(ea) or 0), -- "is_func": bool(idaapi.get_func(ea)), -- } -- -- --@tool --@idasync --def decomp_map( -- addr: Annotated[str, "Function address or name"], --) -> dict: -- """Per-pseudocode-line instruction coverage for the split view's region -- highlight: for each line, the set of EAs the decompiler attributes to it, -- swept across the line's columns via get_line_item. Shape: -- {addr, lines:[{ea: primary|None, eas:[hex,...]}, ...]}.""" -- import ida_hexrays -- import idaapi -- try: -- ea = int(str(addr), 16) -- except ValueError: -- ea = idaapi.get_name_ea(idaapi.BADADDR, str(addr).strip()) -- func = idaapi.get_func(ea) -- if not func: -- return {"error": f"no function at {addr}"} -- try: -- cfunc = ida_hexrays.decompile(func.start_ea) -- except Exception as e: # noqa: BLE001 -- return {"error": f"decompile failed: {e}"} -- if cfunc is None: -- return {"error": "decompile failed"} -- lines = [] -- for sl in cfunc.get_pseudocode(): -- line = sl.line -- eas, seen = [], set() -- for x in range(len(line) + 1): -- head = ida_hexrays.ctree_item_t() -- item = ida_hexrays.ctree_item_t() -- tail = ida_hexrays.ctree_item_t() -- if not cfunc.get_line_item(line, x, False, head, item, tail): -- continue -- # Match the /*ea*/ marker's source (decompile_function_safe): the -- # item's dstr() is 'EA: description'; get_ea() reports a different ea. -- dstr = item.dstr() -- if not dstr: -- continue -- parts = dstr.split(": ", 1) -- if len(parts) != 2: -- continue -- try: -- e = int(parts[0], 16) -- except ValueError: -- continue -- if e not in seen: -- seen.add(e) -- eas.append(hex(e)) -- lines.append({"ea": eas[0] if eas else None, "eas": eas}) -- return {"addr": hex(func.start_ea), "lines": lines} -- -- --_idatui_strings_cache = {} -- -- --def _idatui_build_strings(min_len): -- """[(ea, text, length, typename)] for every string IDA found, cached by -- min_len (rebuilding the list is O(n) and the browser pages through it).""" -- import idautils -- import ida_nalt -- hit = _idatui_strings_cache.get(min_len) -- if hit is not None: -- return hit -- tnames = {} -- for nm, lbl in (("STRTYPE_C", "C"), ("STRTYPE_C_16", "utf16"), -- ("STRTYPE_C_32", "utf32"), ("STRTYPE_PASCAL", "pascal")): -- v = getattr(ida_nalt, nm, None) -- if v is not None: -- tnames[v & 0xFF] = lbl -- items = [] -- for s in idautils.Strings(): -- if s is None: -- continue -- try: -- text = str(s) -- except Exception: # noqa: BLE001 -- undecodable literal -- continue -- if len(text) < min_len: -- continue -- st = getattr(s, "strtype", 0) & 0xFF -- items.append((s.ea, text, getattr(s, "length", len(text)), -- tnames.get(st, "t%d" % st))) -- _idatui_strings_cache[min_len] = items -- return items -- -- --@tool --@idasync --def list_strings( -- offset: Annotated[int, "Start index into the strings list"] = 0, -- count: Annotated[int, "Max strings to return (page size)"] = 2000, -- min_len: Annotated[int, "Minimum string length to include"] = 4, -- refresh: Annotated[bool, "Rebuild the cached strings list"] = False, --) -> dict: -- """Every string literal IDA found in the binary (IDA's Shift+F12 window), -- paginated: {strings:[{addr,text,len,type}], total, next_offset}. Feeds the -- TUI's strings browser.""" -- try: -- min_len = max(int(min_len), 1) -- except (TypeError, ValueError): -- min_len = 4 -- try: -- offset = max(int(offset), 0) -- except (TypeError, ValueError): -- offset = 0 -- try: -- count = max(int(count), 1) -- except (TypeError, ValueError): -- count = 2000 -- if refresh: -- _idatui_strings_cache.pop(min_len, None) -- items = _idatui_build_strings(min_len) -- page = items[offset:offset + count] -- return { -- "strings": [{"addr": hex(ea), "text": text, "len": ln, "type": ty} -- for (ea, text, ln, ty) in page], -- "total": len(items), -- "next_offset": offset + len(page), -- } -- --@tool --@idasync --def list_linkage( -- kind: Annotated[str, "'import', 'export' or 'both'"] = "both", --) -> dict: -- """What this binary imports from, and exports to, other modules: -- {imports:[{addr,name,module}], exports:[{addr,name,ordinal}]}. Feeds the -- project-wide import/export join, which resolves a PLT stub in one binary to -- the real implementation in another.""" -- import idaapi -- import idautils -- import ida_nalt -- want = str(kind or "both").lower() -- imports = [] -- exports = [] -- if want in ("import", "both"): -- n = ida_nalt.get_import_module_qty() -- for i in range(n): -- mod = ida_nalt.get_import_module_name(i) or "" -- -- def _cb(ea, name, ordinal, _mod=mod): -- # An ordinal-only import has no name; skip rather than invent one. -- if name: -- imports.append({"addr": hex(ea), "name": name, "module": _mod}) -- return True -- -- ida_nalt.enum_import_names(i, _cb) -- if want in ("export", "both"): -- for index, ordinal, ea, name in idautils.Entries(): -- if name: -- exports.append({"addr": hex(ea), "name": name, -- "ordinal": int(ordinal)}) -- return {"imports": imports, "exports": exports, -- "n_imports": len(imports), "n_exports": len(exports)} -- --@tool --@idasync --def define_code_run( -- addr: Annotated[str, "Address to start disassembling from"], -- limit: Annotated[int, "Max instructions to create (safety stop)"] = 20000, --) -> dict: -- """Disassemble CONSECUTIVELY from ``addr`` until something stops it, the way -- IDA's 'c' does — one instruction is rarely what you want when carving a raw -- image. Returns {start,end,count,stopped} where ``stopped`` says why: -- 'undecodable' (bytes aren't an instruction), 'flow' (the last instruction -- doesn't fall through, e.g. RET/B), 'defined' (ran into existing code/data), -- 'segment' (hit the end) or 'limit'. -- -- Runs in-process: doing this from the client would be one round trip per -- instruction, which is minutes on a real firmware image.""" -- import ida_bytes -- import ida_idp -- import ida_segment -- import ida_ua -- import idaapi -- -- try: -- ea = parse_address(addr) -- except Exception as e: -- return {"addr": str(addr), "error": str(e), "count": 0} -- -- seg = ida_segment.getseg(ea) -- if not seg: -- return {"addr": str(addr), "error": "no segment", "count": 0} -- hi = seg.end_ea -- try: -- limit = max(1, min(int(limit), 200000)) -- except (TypeError, ValueError): -- limit = 20000 -- -- start, count, stopped = ea, 0, "limit" -- while count < limit: -- if ea >= hi: -- stopped = "segment" -- break -- flags = ida_bytes.get_flags(ea) -- if ida_bytes.is_code(flags) or ida_bytes.is_data(flags): -- # Already defined: stop rather than clobber. Undefining someone's -- # existing work to keep a speculative run going is not a trade the -- # user asked for. -- stopped = "defined" -- break -- n = ida_ua.create_insn(ea) -- if n <= 0: -- stopped = "undecodable" -- break -- count += 1 -- # Stop where control flow stops. Past a RET the next bytes are usually -- # padding or a new function's data, and running on turns a clean carve -- # into a mess that has to be undone by hand. -- # -- # Ask ida_idp.is_ret_insn, NOT the canonical feature bits: on AArch64 -- # get_canon_feature() returns 0 for RET, so a CF_STOP test silently never -- # fires and the run walks straight through the end of the routine. -- insn = ida_ua.insn_t() -- if ida_ua.decode_insn(insn, ea) > 0: -- try: -- is_ret = ida_idp.is_ret_insn(insn) -- except Exception: -- is_ret = False -- if is_ret or (insn.get_canon_feature() & idaapi.CF_STOP): -- ea += n -- stopped = "flow" -- break -- ea += n -- -- return {"start": hex(start), "end": hex(ea), "count": count, -- "stopped": stopped} -- --@tool --@idasync --def set_thumb( -- addr: Annotated[str, "Address to change the ARM decoding mode at"], -- mode: Annotated[str, "'toggle', 'on' (Thumb) or 'off' (ARM)"] = "toggle", -- end: Annotated[str, "Optional exclusive end address (default: this item)"] = "", --) -> dict: -- """Switch ARM/Thumb decoding at ``addr`` (IDA's T segment register). -- -- Thumb is not a property of the bytes, it's a mode the CPU is in, so a raw -- image gives IDA no way to know: at a Thumb entry point it decodes 16-bit -- instructions as 32-bit ARM and produces confident nonsense -- (``push {r3,lr}`` reads as ``SVCLT 0xBF00``). -- -- Also forces the segment to 32-bit when turning Thumb ON. Thumb does not -- exist in AArch64, and a headerless blob loaded with -parm defaults to -- 64-bit — so setting T alone changes nothing and looks broken. Asking for -- Thumb IS asking for ARM32.""" -- import ida_bytes -- import ida_idp -- import ida_segment -- import ida_segregs -- -- try: -- ea = parse_address(addr) -- except Exception as e: -- return {"addr": str(addr), "error": str(e)} -- treg = ida_idp.str2reg("T") -- if treg is None or treg < 0: -- return {"addr": hex(ea), "error": "no T register (not an ARM database)"} -- seg = ida_segment.getseg(ea) -- if not seg: -- return {"addr": hex(ea), "error": "no segment"} -- -- import ida_ida -- db64 = ida_ida.inf_get_app_bitness() == 64 -- cur = ida_segregs.get_sreg(ea, treg) -- cur = 0 if cur in (None, 0xFFFFFFFF, -1) else int(cur) -- want = {"on": 1, "off": 0}.get(str(mode).lower(), 0 if cur else 1) -- -- changed_bits = False -- if want and seg.bitness != 1: -- ida_segment.set_segm_addressing(seg, 1) -- changed_bits = True -- -- try: -- stop = parse_address(end) if end else 0 -- except Exception: -- stop = 0 -- size = max(int(stop) - ea, 0) or max(ida_bytes.get_item_size(ea), 2) -- # The bytes are currently decoded in the OLD mode; leaving that item defined -- # pins the wrong instruction length and the new mode has nothing to apply to. -- ida_bytes.del_items(ea, 0, size) -- ok = bool(ida_segregs.split_sreg_range(ea, treg, want, ida_segregs.SR_user)) -- now = ida_segregs.get_sreg(ea, treg) -- return {"addr": hex(ea), "thumb": bool(now), "was": bool(cur), "ok": ok, -- "bitness": ida_segment.getseg(ea).bitness, -- "forced_32bit": changed_bits, -- # The DATABASE's bitness is fixed at load and can't be corrected -- # here (setting it post-hoc makes the decompiler INTERR). In a -- # 64-bit database a 32-bit function disassembles but Hex-Rays -- # refuses it outright, so say so instead of leaving the user to -- # discover that F5 does nothing. -- "db_64bit": bool(db64 and want)} -- --def _idatui_add_func(ea): -- """add_func at ``ea``, falling back to an explicit end. -- -- ida_funcs.add_func(ea) asks IDA to find the end and on carved or -- freshly-marked code it often can't, failing with no reason given.""" -- import ida_bytes -- import ida_funcs -- import ida_segment -- import idaapi -- -- if idaapi.get_func(ea) is not None: -- return True -- if ida_funcs.add_func(ea): -- return True -- seg = ida_segment.getseg(ea) -- hi = seg.end_ea if seg else ea -- end = ea -- while end < hi and ida_bytes.is_code(ida_bytes.get_flags(end)): -- nxt = ida_bytes.get_item_end(end) -- if nxt <= end: -- break -- end = nxt -- return bool(end > ea and ida_funcs.add_func(ea, end)) -- -- --@tool --@idasync --def define_func_run( -- addr: Annotated[str, "Entry point of the function to create"], --) -> dict: -- """Create a function at ``addr``, working out its end if IDA can't. -- -- ida_funcs.add_func(ea) asks IDA to find the end itself, and on hand-carved -- code it often can't — a run that ends in a tail call, or whose last -- instruction isn't recognised as a return, simply fails with no reason given. -- You then have a disassembled routine that refuses to become a function, and -- F5 has nothing to work with. -- -- So: try IDA's way, and if that fails, use the end of the contiguous -- instruction run starting at ``addr``.""" -- import ida_bytes -- import ida_funcs -- import ida_segment -- import idaapi -- -- try: -- ea = parse_address(addr) -- except Exception as e: -- return {"addr": str(addr), "error": str(e), "ok": False} -- fn = idaapi.get_func(ea) -- if fn is not None and fn.start_ea == ea: -- return {"addr": hex(ea), "ok": True, "start": hex(fn.start_ea), -- "end": hex(fn.end_ea), "how": "existed"} -- auto = ida_funcs.add_func(ea) -- if not auto and not _idatui_add_func(ea): -- return {"addr": hex(ea), "ok": False, -- "error": f"IDA refused a function at {ea:#x}"} -- f = idaapi.get_func(ea) -- if f is None: -- return {"addr": hex(ea), "ok": False, "error": "function did not stick"} -- return {"addr": hex(ea), "ok": True, "start": hex(f.start_ea), -- "end": hex(f.end_ea), "how": "auto" if auto else "explicit-end"} -- --@tool --@idasync --def decomp_error( -- addr: Annotated[str, "Address of the function that failed to decompile"], --) -> dict: -- """Why Hex-Rays refused this function, in its own words. -- -- The plain decompile tool reports "Decompilation failed at 0x0" and drops the -- reason, which is the only useful part. Hex-Rays fills in a hexrays_failure_t -- saying things like "only 64-bit functions can be decompiled in the current -- database" — that one is unfixable in place (the database's bitness is set at -- load), so a user who can't see it has no way to know they must reload.""" -- import ida_funcs -- import ida_hexrays -- import ida_ida -- -- try: -- ea = parse_address(addr) -- except Exception as e: -- return {"addr": str(addr), "error": str(e)} -- out = {"addr": hex(ea), "bitness": ida_ida.inf_get_app_bitness()} -- fn = ida_funcs.get_func(ea) -- if fn is None: -- out["reason"] = "no function here" -- return out -- try: -- if not ida_hexrays.init_hexrays_plugin(): -- out["reason"] = "the decompiler is not available for this processor" -- return out -- hf = ida_hexrays.hexrays_failure_t() -- cf = ida_hexrays.decompile_func(fn, hf) -- if cf is not None: -- out["reason"] = "" # it decompiles now -- return out -- out["reason"] = hf.desc() or f"error {hf.code}" -- out["code"] = int(hf.code) -- out["errea"] = hex(hf.errea) -- except Exception as e: # noqa: BLE001 -- out["reason"] = f"{type(e).__name__}: {e}" -- return out -- --@tool --@idasync --def thumb_scan( -- start: Annotated[str, "Start of the range to scan for entry pointers"] = "", -- end: Annotated[str, "Exclusive end of the range (default: 1KB from start)"] = "", -- apply: Annotated[bool, "Mark the targets as Thumb and disassemble them"] = True, -- limit: Annotated[int, "Max entries to act on"] = 512, --) -> dict: -- """Find Thumb entry points from ODD pointers, e.g. a Cortex-M vector table. -- -- An ARM function pointer carries the mode in bit 0: odd means Thumb. A vector -- table is therefore a list of Thumb entry points that IDA won't follow on a -- headerless image, because nothing tells it those words are pointers at all. -- -- Being wrong here is expensive — marking a data word as code corrupts the -- listing — so a word only counts when it is odd, lands inside a loaded -- segment, and its target is EXECUTABLE and not already defined as data. The -- even words in a vector table (the initial stack pointer) fail the first test, -- which is the point.""" -- import ida_bytes -- import ida_funcs -- import ida_idp -- import ida_segment -- import ida_segregs -- import ida_ua -- -- seg0 = ida_segment.getseg(parse_address(start)) if start else None -- if seg0 is None: -- seg0 = ida_segment.getnseg(0) -- if seg0 is None: -- return {"error": "no segments", "found": [], "applied": 0} -- try: -- lo = parse_address(start) if start else seg0.start_ea -- hi = parse_address(end) if end else min(lo + 0x400, seg0.end_ea) -- except Exception as e: -- return {"error": str(e), "found": [], "applied": 0} -- -- treg = ida_idp.str2reg("T") -- found, applied = [], 0 -- ea = lo -- while ea + 4 <= hi and len(found) < limit: -- w = ida_bytes.get_dword(ea) -- ea += 4 -- if not (w & 1): -- continue # even: not a Thumb pointer -- tgt = w & ~1 -- seg = ida_segment.getseg(tgt) -- if seg is None or not (seg.perm & ida_segment.SEGPERM_EXEC or seg.perm == 0): -- continue # points outside the image, or at data -- f = ida_bytes.get_flags(tgt) -- if ida_bytes.is_data(f): -- continue # already something else; don't fight it -- rec = {"at": hex(ea - 4), "value": hex(w), "target": hex(tgt), -- "was_code": bool(ida_bytes.is_code(f))} -- found.append(rec) -- if not apply: -- continue -- if treg is not None and treg >= 0: -- ida_segregs.split_sreg_range(tgt, treg, 1, ida_segregs.SR_user) -- if not ida_bytes.is_code(ida_bytes.get_flags(tgt)): -- ida_bytes.del_items(tgt, 0, 2) -- if ida_ua.create_insn(tgt) <= 0: -- rec["decoded"] = False -- continue -- rec["decoded"] = True -- rec["function"] = _idatui_add_func(tgt) -- applied += 1 -- return {"start": hex(lo), "end": hex(hi), "found": found, -- "applied": applied, "n": len(found)} --''' -- --SNIPPET = f"{BEGIN}\n{BODY.strip()}\n{END}\n" -- -- --def api_types_path() -> pathlib.Path | None: -- """Locate ida_pro_mcp/ida_mcp/api_types.py without importing it (importing the -- submodule would pull in IDA, which isn't available outside a worker).""" -- spec = importlib.util.find_spec("ida_pro_mcp") # top-level pkg is IDA-free -- if spec is None or not spec.submodule_search_locations: -- return None -- p = pathlib.Path(spec.submodule_search_locations[0]) / "ida_mcp" / "api_types.py" -- return p if p.exists() else None -- -- --def main() -> int: -- path = api_types_path() -- if path is None: -- print("idatui: ida_pro_mcp not found; skipping tool injection", file=sys.stderr) -- return 0 -- text = path.read_text() -- if BEGIN in text and END in text: # replace the existing block in place -- pre = text[: text.index(BEGIN)].rstrip() -- post = text[text.index(END) + len(END):].lstrip("\n") -- new = pre + "\n\n" + SNIPPET + ("\n" + post if post else "") -- else: -- new = text.rstrip() + "\n\n" + SNIPPET -- if new == text: -- return 0 -- try: -- path.write_text(new) -- except OSError as e: -- print(f"idatui: could not patch {path}: {e}", file=sys.stderr) -- return 1 -- print(f"idatui: injected/updated idatui-ext tools in {path}", file=sys.stderr) -- return 0 -- -- --if __name__ == "__main__": -- raise SystemExit(main()) -diff --git a/tests/test_codemode_client.py b/tests/test_codemode_client.py -new file mode 100644 -index 0000000..6303eb9 ---- /dev/null -+++ b/tests/test_codemode_client.py -@@ -0,0 +1,137 @@ -+"""IDA-free contract tests for the Code Mode client adapter.""" -+from __future__ import annotations -+ -+import os -+import sys -+import tempfile -+from dataclasses import dataclass -+ -+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))) -+ -+import idatui.codemode_client as module # noqa: E402 -+from idatui.codemode_client import CodeModeClient, _parse_load_args # noqa: E402 -+from idatui.errors import IDAToolError # noqa: E402 -+ -+PASS = FAIL = 0 -+ -+ -+def check(name: str, condition: bool, detail="") -> None: -+ global PASS, FAIL -+ if condition: -+ PASS += 1 -+ print(f" ok {name}") -+ else: -+ FAIL += 1 -+ print(f" FAIL {name} {detail}") -+ -+ -+@dataclass(frozen=True) -+class FakeEntry: -+ pid: int = 123 -+ backend: str = "gui" -+ record_id: str = "123-abcdef" -+ exe_path: str = "" -+ idb_path: str = "" -+ -+ -+class FakeHandle: -+ def __init__(self, path: str) -> None: -+ self.connected = True -+ self.entry = FakeEntry(exe_path=path, idb_path=path + ".i64") -+ self.waited = None -+ self.saved = 0 -+ self.closed = False -+ self.code = "" -+ self.code_timeout = None -+ -+ def wait_autoanalysis(self, timeout=None): -+ self.waited = timeout -+ return {"complete": True, "status": "complete"} -+ -+ def execute_python(self, code, timeout=None): -+ self.code = code -+ self.code_timeout = timeout -+ return {"result": {"sentinel": 7}, "stdout": "", "stderr": ""} -+ -+ def save_database(self): -+ self.saved += 1 -+ return {"saved": True, "idb_path": self.entry.idb_path} -+ -+ def close(self): -+ self.connected = False -+ self.closed = True -+ -+ -+class FakeDatabaseHandle: -+ opened = None -+ kwargs = None -+ -+ @classmethod -+ def open(cls, path, **kwargs): -+ cls.opened = path -+ cls.kwargs = kwargs -+ return FakeHandle(path) -+ -+ -+def main() -> int: -+ proc, base, file_type = _parse_load_args("-parm:ARMv7-M -b800000 -TRaw") -+ check("legacy switches map to typed Code Mode options", -+ (proc, base, file_type) == ("arm:ARMv7-M", 0x8000000, "Raw"), -+ (proc, base, file_type)) -+ try: -+ _parse_load_args("-parm -zcustom") -+ except ValueError as exc: -+ check("arbitrary IDA switches fail loudly", "cannot represent" in str(exc), exc) -+ else: -+ check("arbitrary IDA switches fail loudly", False) -+ -+ original = module.DatabaseHandle -+ module.DatabaseHandle = FakeDatabaseHandle -+ try: -+ with tempfile.TemporaryDirectory() as tmp: -+ path = os.path.join(tmp, "sample.bin") -+ with open(path, "wb") as file: -+ file.write(b"sample") -+ client = CodeModeClient(path, load_args="-parm:ARMv7-A -b100") -+ notes = [] -+ client.connect(timeout=42, progress=notes.append) -+ handle = client._handle -+ check("connect delegates database discovery to DatabaseHandle.open", -+ FakeDatabaseHandle.opened == path and handle is not None) -+ check("typed loader options cross the dependency boundary", -+ FakeDatabaseHandle.kwargs["processor"] == "arm:ARMv7-A" -+ and FakeDatabaseHandle.kwargs["loading_address"] == 0x1000, -+ FakeDatabaseHandle.kwargs) -+ check("connect waits for Code Mode autoanalysis", -+ handle.waited == 42, getattr(handle, "waited", None)) -+ check("progress distinguishes discovery and backend attachment", -+ len(notes) == 2 and "gui" in notes[-1], notes) -+ result = client.invoke("list_funcs", queries=[{"offset": 0, "count": 2}]) -+ check("invoke returns execute_python's result", result == {"sentinel": 7}, result) -+ check("operation scripts use the preloaded ida-domain database", -+ "db.functions.get_all()" in handle.code, handle.code[:200]) -+ check("health exposes registry identity", -+ client.health()["record_id"] == "123-abcdef") -+ client.save_database() -+ check("save uses the public Code Mode save route", handle.saved == 1) -+ client.close() -+ check("close releases only the handle lease", handle.closed) -+ check("GUI lifetime is never claimed by the client", -+ client.wait_released(0) is False) -+ finally: -+ module.DatabaseHandle = original -+ -+ client = CodeModeClient(__file__) -+ try: -+ client.invoke("not-an-operation") -+ except IDAToolError as exc: -+ check("unknown adapter operations are explicit", exc.tool == "not-an-operation") -+ else: -+ check("unknown adapter operations are explicit", False) -+ -+ print(f"\n{PASS} passed, {FAIL} failed") -+ return 1 if FAIL else 0 -+ -+ -+if __name__ == "__main__": -+ raise SystemExit(main()) -diff --git a/tests/test_pool.py b/tests/test_pool.py -index 5c6e2c4..ff0c016 100644 ---- a/tests/test_pool.py -+++ b/tests/test_pool.py -@@ -1,8 +1,7 @@ - #!/usr/bin/env python3 --"""Unit tests for idatui.pool (worker residency: LRU + memory budget). -+"""Unit tests for idatui.pool (Code Mode lease residency and LRU budget). - --Pure stdlib with a fake client injected, so the eviction policy is testable --without spawning real idalib workers. -+A fake client keeps the policy testable without IDA or Textual. - - python tests/test_pool.py - """ -@@ -11,7 +10,7 @@ import sys - import tempfile - - sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))) --from idatui.pool import WorkerPool # noqa: E402 -+from idatui.pool import DatabasePool # noqa: E402 - from idatui.project import Project # noqa: E402 - - PASS = FAIL = 0 -@@ -28,11 +27,12 @@ def check(name, cond, detail=""): - - - class FakeClient: -- """Stands in for a WorkerClient: records saves/closes, reports fixed memory.""" -+ """Stands in for a CodeModeClient lease and records saves/closes.""" - -- def __init__(self, ref, mem=100): -+ def __init__(self, ref, mem=100, backend="idalib"): - self.ref = ref - self.mem = mem -+ self.backend = backend - self.saved = 0 - self.closed = False - self.connected = False -@@ -41,10 +41,9 @@ class FakeClient: - self.connected = True - return self - -- def call(self, tool, **kw): -- if tool == "idb_save": -- self.saved += 1 -- return {} -+ def save_database(self): -+ self.saved += 1 -+ return {"saved": True} - - def close(self, grace=None): - self.closed = True -@@ -72,15 +71,15 @@ def main() -> int: - made[ref.label] = c - return c - -- pool = WorkerPool(proj, budget_mb=350, spawn=spawn, -+ pool = DatabasePool(proj, budget_mb=350, spawn=spawn, - mem_fn=lambda c: c.mem) - - # -- lazy spawn + reuse -------------------------------------------- # - a = pool.get("bin0") -- check("get() spawns a worker on first use", a is made["bin0"] and a.connected) -+ check("get() spawns a database lease on first use", a is made["bin0"] and a.connected) - check("get() stages the binary first", - os.path.isfile(proj.by_label("bin0").staged)) -- check("get() reuses the resident worker", pool.get("bin0") is a) -+ check("get() reuses the resident lease", pool.get("bin0") is a) - check("resident() reports it", pool.resident() == ["bin0"], pool.resident()) - - # -- LRU ordering ---------------------------------------------------- # -@@ -96,9 +95,9 @@ def main() -> int: - check("exceeding the budget evicts the least-recently-used", - pool.evicted == ["bin1"] and not pool.is_resident("bin1"), - f"evicted={pool.evicted} resident={pool.resident()}") -- check("the just-spawned worker is never the victim", pool.is_resident("bin3")) -+ check("the just-attached lease is never the victim", pool.is_resident("bin3")) - check("eviction saves the database first", made["bin1"].saved == 1) -- check("eviction closes the worker", made["bin1"].closed) -+ check("eviction closes the lease", made["bin1"].closed) - check("pool is back within budget", pool.memory_mb() <= pool.budget_mb, - f"{pool.memory_mb()}/{pool.budget_mb}") - -@@ -112,7 +111,7 @@ def main() -> int: - - # -- pinning ---------------------------------------------------------- # - pool.close_all() -- pool2 = WorkerPool(proj, budget_mb=250, spawn=spawn, mem_fn=lambda c: c.mem) -+ pool2 = DatabasePool(proj, budget_mb=250, spawn=spawn, mem_fn=lambda c: c.mem) - pool2.get("bin0") - pool2.pin("bin0") - pool2.get("bin1") -@@ -139,7 +138,7 @@ def main() -> int: - - # -- teardown ----------------------------------------------------------- # - pool2.close_all() -- check("close_all() closes every worker", -+ check("close_all() closes every lease", - not pool2.resident() and all(c.closed for c in made.values())) - check("close_all() clears the active binary", pool2.active is None) - -@@ -151,8 +150,8 @@ def main() -> int: - check("an unknown label raises KeyError", True) - - # -- default budget comes from the project's memory_pct ------------------- # -- pool3 = WorkerPool(proj, spawn=spawn, mem_fn=lambda c: c.mem) -- check("default budget is derived, not a fixed worker count", -+ pool3 = DatabasePool(proj, spawn=spawn, mem_fn=lambda c: c.mem) -+ check("default budget is derived, not a fixed lease count", - pool3.budget_mb >= 256, pool3.budget_mb) - - # -- prewarm: speculative, and never at the cost of a real binary ------ # -@@ -165,7 +164,7 @@ def main() -> int: - made2[ref.label] = c - return c - -- pool = WorkerPool(proj, budget_mb=250, spawn=spawn2, -+ pool = DatabasePool(proj, budget_mb=250, spawn=spawn2, - mem_fn=lambda c: c.mem) - labels = [r.label for r in proj.refs] - a, b, c_ = labels[0], labels[1], labels[2] -@@ -184,6 +183,28 @@ def main() -> int: - check("prewarm ignores a label outside the project", - pool.prewarm("nope") is False) - -+ # Budget eviction releases GUI leases but must not save somebody's open IDA -+ # implicitly. An explicit save-and-close remains authoritative. -+ with tempfile.TemporaryDirectory() as tmp: -+ proj = _mkproject(tmp, n=1) -+ made_gui = [] -+ -+ def spawn_gui(ref, ttl): -+ client = FakeClient(ref, backend="gui") -+ made_gui.append(client) -+ return client -+ -+ pool = DatabasePool(proj, spawn=spawn_gui, mem_fn=lambda c: c.mem) -+ label = proj.refs[0].label -+ pool.get(label) -+ pool.evict(label) -+ check("LRU release does not implicitly save a GUI database", -+ made_gui[-1].saved == 0) -+ pool.get(label) -+ pool.close_all(save=True) -+ check("explicit close_all(save=True) does save a GUI database", -+ made_gui[-1].saved == 1) -+ - print(f"\n{PASS} passed, {FAIL} failed") - return 1 if FAIL else 0 - -diff --git a/tests/test_project.py b/tests/test_project.py -index 91fd250..7c0dcba 100644 ---- a/tests/test_project.py -+++ b/tests/test_project.py -@@ -1,7 +1,7 @@ - #!/usr/bin/env python3 - """Unit tests for idatui.project (the multi-binary project model + staging). - --Pure stdlib: no IDA, no textual, no worker — runs anywhere in under a second. -+IDA-free: exercises staging plus Code Mode ownership checks without opening a database. - - python tests/test_project.py - """ -diff --git a/tests/test_scenarios.py b/tests/test_scenarios.py -index 9d77680..ab510f4 100644 ---- a/tests/test_scenarios.py -+++ b/tests/test_scenarios.py -@@ -2316,7 +2316,13 @@ async def _build_pristine(binary, cache): - await pilot.pause(0.05) - if app._func_index is not None and app._func_index.complete: - break -- app.program.client.call("idb_save", timeout=600.0) -+ app.program.client.save_database() -+ # Textual's headless run_test context does not reliably emit App.Unmount on -+ # every platform/version; release the Code Mode lease explicitly. -+ if app.program is not None: -+ app.program.close() -+ if app.client is not None: -+ app.client.close() - db = binary + ".i64" - if os.path.exists(db): - shutil.copy2(db, cache) -@@ -2346,7 +2352,7 @@ async def run(binary, only=None): - - - async def _run_on(binary, only=None): -- # Own idalib worker: opens the binary in-process over a unix socket. -+ # Code Mode attaches a registered GUI or starts/reuses a managed worker. - app = IdaTui(open_path=binary, keepalive=False) - async with app.run_test(size=(140, 44)) as pilot: - c = Ctx(app, pilot) -@@ -2366,6 +2372,14 @@ async def _run_on(binary, only=None): - print(f"── {name} ({asyncio.get_event_loop().time() - _t0:.1f}s) CRASHED") - c.check("scenario did not crash", False, f"{type(e).__name__}: {e}") - traceback.print_exc() -+ # Headless run_test does not reliably emit App.Unmount; explicitly release -+ # the lease. Then wait through the managed worker's final-lease grace and -+ # IDB close so Windows can remove this suite's TemporaryDirectory safely. -+ if app.program is not None: -+ app.program.close() -+ if app.client is not None: -+ app.client.close() -+ await asyncio.to_thread(app.client.wait_released, 45.0) - - - def main(argv): -diff --git a/uv.lock b/uv.lock -index 91414b5..392ebf0 100644 ---- a/uv.lock -+++ b/uv.lock -@@ -11,27 +11,69 @@ wheels = [ - { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" }, - ] - -+[[package]] -+name = "ida-codemode-mcp" -+version = "0.2.0" -+source = { editable = "../ida-codemode-mcp" } -+dependencies = [ -+ { name = "ida-domain" }, -+ { name = "zeromcp" }, -+] -+ -+[package.metadata] -+requires-dist = [ -+ { name = "ida-domain", git = "https://github.com/HexRaysSA/ida-domain?branch=main" }, -+ { name = "zeromcp", specifier = ">=1.5.0" }, -+] -+ -+[package.metadata.requires-dev] -+dev = [ -+ { name = "pytest", specifier = ">=9.0.3" }, -+ { name = "ruff", specifier = ">=0.12.0" }, -+] -+ -+[[package]] -+name = "ida-domain" -+version = "0.5.1.dev1" -+source = { git = "https://github.com/HexRaysSA/ida-domain?branch=main#8f36bbce94f0dd55e4ad5f7c8b5f0ef59b9c557a" } -+dependencies = [ -+ { name = "idapro" }, -+ { name = "packaging" }, -+ { name = "typing-extensions" }, -+] -+ -+[[package]] -+name = "idapro" -+version = "0.0.10" -+source = { registry = "https://pypi.org/simple" } -+sdist = { url = "https://files.pythonhosted.org/packages/f8/75/249c605cc144a6b3778c48381d31ff9242f3e0b7ae23a9ca9c27224e641a/idapro-0.0.10.tar.gz", hash = "sha256:417c03c4605d18417e470f6a748e397b39d6d5829ebd3bbdedd92ff5b9092d11", size = 1060989, upload-time = "2026-07-15T12:55:22.313Z" } -+wheels = [ -+ { url = "https://files.pythonhosted.org/packages/e8/83/7b02832cc8b057f686cccdb771fe80282f801a9b798961f8070bb468c73c/idapro-0.0.10-py3-none-any.whl", hash = "sha256:43f227953a0e348ced21c050d277b7ce34103e2ce05fc739b7d8c186ef0e1542", size = 2194897, upload-time = "2026-07-15T12:55:20.88Z" }, -+] -+ - [[package]] - name = "idatui" - version = "0.0.1" - source = { editable = "." } -+dependencies = [ -+ { name = "ida-codemode-mcp" }, -+ { name = "pygments" }, -+ { name = "textual" }, -+] - - [package.optional-dependencies] - dev = [ - { name = "pytest" }, - ] --tui = [ -- { name = "pygments" }, -- { name = "textual" }, --] - - [package.metadata] - requires-dist = [ -- { name = "pygments", marker = "extra == 'tui'", specifier = ">=2" }, -+ { name = "ida-codemode-mcp", editable = "../ida-codemode-mcp" }, -+ { name = "pygments", specifier = ">=2" }, - { name = "pytest", marker = "extra == 'dev'", specifier = ">=8" }, -- { name = "textual", marker = "extra == 'tui'", specifier = ">=8" }, -+ { name = "textual", specifier = ">=8" }, - ] --provides-extras = ["tui", "dev"] -+provides-extras = ["dev"] - - [[package]] - name = "iniconfig" -@@ -191,3 +233,12 @@ sdist = { url = "https://files.pythonhosted.org/packages/78/67/9a363818028526e2d - wheels = [ - { url = "https://files.pythonhosted.org/packages/61/73/d21edf5b204d1467e06500080a50f79d49ef2b997c79123a536d4a17d97c/uc_micro_py-2.0.0-py3-none-any.whl", hash = "sha256:3603a3859af53e5a39bc7677713c78ea6589ff188d70f4fee165db88e22b242c", size = 6383, upload-time = "2026-03-01T06:31:26.257Z" }, - ] -+ -+[[package]] -+name = "zeromcp" -+version = "1.5.0" -+source = { registry = "https://pypi.org/simple" } -+sdist = { url = "https://files.pythonhosted.org/packages/95/10/0c5018221766413c808b62f229a3b6b2cd0e4b10bc9ac25fee6152c22938/zeromcp-1.5.0.tar.gz", hash = "sha256:ef4e590ddb20a30a2ceaee86dbf893c9edb5d3e583c22a0ea7025e94763e59d2", size = 95257, upload-time = "2026-07-22T13:39:29.535Z" } -+wheels = [ -+ { url = "https://files.pythonhosted.org/packages/8c/46/aa0e0941b511969a3eb70ea19add43b22c7336a4bf65a4fe4ea2176faf25/zeromcp-1.5.0-py3-none-any.whl", hash = "sha256:ca3b67687850ed463a255c180a286901ea69343612dc84ef279ec75b460f77ee", size = 21875, upload-time = "2026-07-22T13:39:28.44Z" }, -+] --- -2.53.0.windows.2 - |