Match the distinctive /usr/lib markers anywhere in the path so a
jailbroken iOS reroot resolves: dyld appears as /cores/usr/lib/dyld
and was misclassified as an app module. Keep generic roots anchored
so app libraries under /data/app and /home stay app, and add Android
system roots (/system, /apex, /vendor, /product, /system_ext).
Drop the modules/threads tabs; show both as collapsible sidebar
groups mirroring the hooks UX: a handful of top picks plus a
browse popover for the rest. Default threads to collapsed.
Revert the eager re-analysis of persisted modules on attach; keep
disassembly analysis lazy and add a per-module Analyze action and
status indicator instead.
Share one sidebar-row and one browser-popover component across
hooks, modules, and threads in both the SwiftUI and GTK frontends.
Classify modules by their path (system locations on macOS, Linux
and Windows) so the program's own modules sort first and render
with emphasis, alphabetically within each group.
Drop the dual ITraceCaptureRecord/CapturedITrace types in favour of
a single ITrace covering both function-call and thread origins.
Promote itrace-capture from an instrument into a core service so
both origins share the same start/stop/drain machinery.
ProcessNode now keys pending traces by an opaque session id, hands
finalized data to a TraceStore, throttles running emits, drains
in-process when no system-drain is available, and skips the
Interceptor-trampoline trim for thread origin. ModuleDelta carries
incremental module updates.
LumaDocument grows sqliteURL and tracesDirectory accessors so the
project file can be a directory holding both the index and
per-trace blobs.
Sessions in a lab are now collaborative artifacts. Any owner can
host (own the local Frida attachment) and any owner can drive
(issue REPL evals and instrument commands); a driver's actions
are relayed to the current host. Members watch read-only and see
an "Only lab owners can host sessions" CTA when they try the new
session button.
Re-host (Run on My Device…) lets an owner take over a running
session by attaching to their own equivalent process; the prior
host's Frida attachment detaches and the new host auto-loads the
session's instruments. Driver auto-reverts to host when the
current driver fully disconnects from the lab.
ProcessNode is now in LumaCore, exposing AsyncStream for
events, REPL results, ITrace captures, module snapshots,
and session detach notifications. No delegates, no
@Published — consumers subscribe with for-await.
Luma retains ProcessNodeViewModel as a thin ObservableObject
wrapper that subscribes to the streams and handles SwiftData
persistence (inserting REPLCells, ITraceCaptures) and R2
integration.
RuntimeEvent is now a self-contained LumaCore value type
with source and payload enums instead of object references.
The Luma-side DisplayEvent bridges to views by carrying a
ProcessNodeViewModel reference alongside the core event.
WIP: views not yet updated for the rename — the Xcode build
needs mechanical updates across ~14 files to use
ProcessNodeViewModel and DisplayEvent.
Move pure data types out of Luma/ into Sources/LumaCore/
so they can be shared with the GTK frontend:
- AddressAnchor, CFGGraph, ITraceDecoder (+ all related
types: TraceEntry, ITraceMetadata, RegisterState, etc.)
- JSInspectValue, SpawnConfig, ProcessModule
- HookPackConfig, HookPackManifest, InstrumentConfigCodec
- InstrumentIcon, InstrumentKind, ConsoleLevel
CFGGraph uses its own Point2D instead of CoreGraphics
types, keeping the core free of Apple frameworks.
Remove premature stubs (Engine, ProcessNode,
InstrumentRuntime, EventStream) that will be properly
built in a later phase once the real implementations
are ready to move.
Ole André Vadla Ravnås