Another chapter in the never-ending AppDomain security saga.
If a computer goes to sleep while SourceGen is running with a project
open, life gets confusing when the system wakes up. The keep-alive
timer fires and a ping is sent to the remote AppDomain, successfully.
At the same time, the lease expires on the remote side, and the objects
are discarded (apparently without bothering to query the ILease object).
This failure mode is 100% repeatable.
Since we can't prevent sandbox objects from disappearing, we have to
detect and recover from the problem. Fortunately we don't keep any
necessary state on the plugin side, so we can just tear the whole
thing down and recreate it.
The various methods in ScriptManager now do a "health check" before
making calls into the plugin AppDomain. If the ping attempt fails,
the AppDomain is "rebooted" by destroying it and creating a new one,
reloading all plugins that were in there before. The plugin binaries
*should* still be in the PluginDllCache directory since the ping failure
was due to objects being discarded, not AppDomain shutdown, and Windows
doesn't let you mess with files that hold executable code.
A new "reboot security sandbox" option has been added to the DEBUG
menu to facilitate testing.
The PluginManager's Ping() method gets called more often, but not to
the extent that performance will be affected.
This change also adds a finalizer to DisasmProject, since we're relying
on it to shut down the ScriptManager, and it's relying on callers to
invoke its cleanup function. The finalizer throws an assertion if the
cleanup function doesn't get called.
(Issue #82)
Changed "Use Keep-Alive Hack" to "Disable Keep-Alive Hack" to emphasize
that it defaults to enabled. Added a menu item for "Disable Security
Sandbox". Added a warning to both that tells the user that they must
reopen the current project for the change to take effect.
Note neither of these is persisted in app settings.
The new name is more indicative of the purpose of the directory.
Updated the docs to point out that you can delete the contents any
time you want, so long as SourceGen isn't running at the time.
Also, change the default column widths for the exporter.
When we have relocation data available, the code currently skips the
process of matching an address with a label for a PEA instruction when
the instruction in question doesn't have reloc data. This does a
great job of separating code that pushes parts of addresses from code
that pushes constants.
This change expands the behavior to exclude instructions with 16-bit
address operands that use the Data Bank Register, e.g. "LDA abs"
and "LDA abs,X". This is particularly useful for code that accesses
structured data using the operand as the structure offset, e.g.
"LDX addr" / "LDA $0000,X"
The 20212-reloc-data test has been updated to check the behavior.
On the 65816, 16-bit data access instructions (e.g. LDA abs) are
expanded to 24 bits by merging in the Data Bank Register (B). The
value of the register is difficult to determine via static analysis,
so we need a way to annotate the disassembly with the correct value.
Without this, the mapping of address to file offset will sometimes
be incorrect.
This change adds the basic data structures and "fixup" function, a
functional but incomplete editor, and source for a new test case.
This adds a new class and a rough GUI for the editor. Animated
visualizations take a collection of bitmaps and display them in
sequence. (This will eventually become an animated GIF.)
Fixed the issue where changes to tags in the set currently being
edited weren't visible to the tag uniqueness check when editing other
items in the same set.
Project symbol address values are now limited to positive 24-bit
integers, just as they are for platform symbols. Constants may
still be 32-bit values.
While disassembling some code I found that I wanted the ROM entry
points, but the zero page usage was significantly different and the
ROM labels were distracting. Splitting the symbol file in two was
a possibility, but I'm afraid this will lead to a very large
collection of very small files, and we'll lose any sense of relation
between the ROM entry points and the ZP addresses used to pass
arguments.
Platform symbols have the lowest priority when resolving by address,
but using that to hide the unwanted labels requires creating project
symbols or local variables for things that you might not know what
they do yet. It's possible to hide a platform symbol by adding
another symbol with the same label and an invalid value.
This change formalizes and extends the "hiding" of platform symbols
to full erasure, so that they don't clutter up the symbol table.
This also tightens up the platform symbol parser to only accept
values in the range 0 <= value <= 0x00ffffff (24-bit positive
integers).
An "F8-ROM-nozp" symbol file is now part of the standard set. A
project can include that to erase the zero-page definitions.
(I'm not entirely convinced this is the right approach, so I'm not
doing this treatment on other symbol files... consider this an
experiment. Another approach would be some sort of conditional
inclusion, or perhaps erase-by-tag, but that requires some UI work
in the app to define what you want included or excluded.)
We were failing to update properly when a label changed if the label
was one that a plugin cared about. The problem is that a label
add/remove operation skips the code analysis, and a label edit skips
everything but the display update. Plugins only run during the code
analysis pass, so changes weren't being reflected in the display
list until something caused it to refresh.
The solution is to ask the plugin if the label being changed is one
that it cares about. This allows the plugin to use the same
wildcard-match logic that it uses elsewhere.
For efficiency, and to reduce clutter in plugins that don't care
about symbols, a new interface class has been created to handle the
"here are the symbols" call and the "do you care about this label"
call.
The program in Examples/Scripts has been updated to show a very
simple single-call plugin and a slightly more complex multi-call
plugin.
Extension scripts (a/k/a "plugins") can now apply any data format
supported by FormatDescriptor to inline data. In particular, it can
now handle variable-length inline strings. The code analyzer
verifies the string structure (e.g. null-terminated strings have
exactly one null byte, at the very end).
Added PluginException to carry an exception back to the plugin code,
for occasions when they're doing something so wrong that we just
want to smack them.
Added test 2022-extension-scripts to exercise the feature.
The analyzer sometimes runs into things that don't seem right, like
hidden labels or references to non-existent symbols, but has no way
to report them. This adds a problem viewer.
I'm not quite ready to turn this into a real feature, so for now it's
a free-floating window accessed from the debug menu.
Also, updated some documentation.
The plugin objects are MarshalByRefObject stubs, which means they
don't actually implement the interfaces we're checking for. There's
some additional overhead to do the interface check. We can avoid
it by doing the interface queries during initialization, and just
checking some bit flags later on.
Also, in the extension script info window, show a list of
implemented interfaces.
Once upon a time, symbol files and extension scripts could only be
defined in the RuntimeData directory, so having the documentation
there made sense. Since both of these things can now be defined in
project directories, the documentation belongs in the manual.
(issue #27)
