Explorer file copies were invisible to the Helper because the service
launched its child with a duplicate of the LocalSystem token and changed
only TokenSessionId. The child therefore remained a System-integrity
process. Windows filtered Explorer's file clipboard formats across that
integrity boundary. Basic text and bitmap formats continued to work.
Keep only the SCM service privileged. Obtain the active session user's
primary token with WTSQueryUserToken. For elevated accounts, prefer the
linked limited token. Validate its session and security properties.
Build the user environment and launch the interactive Helper on
WinSta0\Default. Gate Helper activation until the service has rechecked
the active session and registered the clipboard authority.
Use random lifetime, stop, and activation objects owned by the service.
Give the target logon SID synchronization access only. Recheck the
active console session and service state before activation. Make the
lifetime mutex terminate the Helper if the service exits unexpectedly.
Restart it when the active session, IDD host, or authority changes.
Replace the old process-handle mapping transfer with a device-bound
authority protocol on the LGIdd device interface. The service verifies
the exact driver host instance, duplicates only section map rights into
that process, and registers the session, mapping identifier, and handle.
Bind authority lifetime to its WDF file object, revoke it synchronously
on cleanup, and poll the driver host identity while the child is active.
Restrict the device stack to SYSTEM and isolate LGIdd in a unique UMDF
device group. Restrict the shared section to SYSTEM and the target logon
SID. Apply a medium mandatory label that prevents low-integrity readers
and writers. Map it with read/write rights instead of all access.
Give each clipboard mapping a second random authority identifier. Store
it only inside the logon-SID-protected mapping and send it in the
mandatory HELLO. LGIdd matches it against the service-injected mapping.
This authenticates the user Helper without the unsupported UMDF call to
GetNamedPipeClientSessionId. Have the Helper verify that its pipe server
is in session zero.
Extend the pipe endpoint with bounded authentication reads, cancellable
overlapped I/O, periodic authorization checks, and explicit disconnects.
Serialize authority changes with clipboard attach and detach. Prevent
stale cleanup from tearing down a replacement mapping. Disconnect the
user pipe immediately when its owning authority is revoked.
Run clipboard, OLE, display, configuration, and file access in the
user's interactive process. Retain its process token for worker-thread
file operations instead of querying and impersonating the desktop user
from a System process. Store Helper logs in LocalAppData and grant only
the registry rights needed by interactive configuration and UMDF.
Keep immediate, stage-specific Win32 and HRESULT diagnostics throughout
clipboard capture. Probe CF_HDROP while holding the Win32 clipboard and
enumerate the OLE object's advertised file formats. Validate returned
storage and fall back to Shell item paths when direct retrieval fails.
Validate clipboard sequence changes and defer retries during contention
without publishing incomplete clipboard state.
Complete the 1 MiB transfer work with full-sized Windows copy buffers.
Use full-sized FUSE reads and retain the named 64 KiB X11 chunk limit.
Validate the user-writable mapping with CClipboardRing before attaching.
The pipe, mapping, and authority protocols change together. LGIdd.dll,
the INF, and LGIddHelper.exe must be rebuilt and installed as one
matching set.
Add a protocol-independent recovery channel outside LGMP so clients can
request a usable guest display even when transport versions differ.
Synchronize recovery state with the helper across driver restarts and
restore the configured topology without persisting temporary changes.
Add an optional input transport and a dedicated LGMP receiver that
validates source ownership, generations, ordered sequences, and leases.
Poll input outside the 10 ms control timer. Forward mouse and keyboard
state through the LGInput pipe, and neutralize the endpoint before
ownership changes or transport failures can leave input held.
Move the reusable named-pipe endpoint and shared support code into
the LGCommon static library.
Run a dedicated server in LGIdd and a reconnecting client in
LGInput, with device-lifecycle handling and report framing.
Refactor the helper pipe to use the same endpoint implementation.
Build LGInput as an independent UMDF driver with its own entry point,
service, tracing, and binary.
Expose absolute pointer, relative mouse, and keyboard collections with a
guarded report queue.
Keep LGIdd as the startup and deployment project. Give it a non-linking
build/package dependency on LGInput so F5 stages both driver stacks and
installs them together through LGIddInstall, while the two UMDF binaries
remain independent for future IPC.
Stage both DLLs for the NSIS installer, retain the WDK UMDF remote-debug
startup attachment, and move CSRWLock into LGCommon for the input
driver's report queue.
Move cadence and pipeline declarations under capture, and move local
named-pipe handling under ipc.
Flatten display contexts and rename files after their contained classes.
Keep transport headers limited to transport contracts and capabilities.
Consolidate CSwapChainProcessor definitions so each source file matches
the class it implements.
Introduce transport, frame, and control interfaces with an LGMP factory
backend.
Move LGMP and IVSHMEM implementation details under transport/lgmp and
expose direct frame-buffer memory through a neutral capability.
Group the IDD sources and Visual Studio filters by subsystem.
Split the device and swap-chain implementations into focused units,
rename the context classes, and reduce header coupling.
Move cadence-aware hardware capture and immediate software capture
behind a common frame processor interface.
Keep shared damage tracking and frame-buffer ownership in the base
processor, and move stateless format, resource, and rectangle helpers
into CFrameProcessorUtil.
Decouple frame-buffer resources from CSwapChainProcessor by passing the
device dependencies they use directly.
Honor the IddCx 3x4 XYZ matrix and post-transfer LUT in the IDD
conversion pipeline. Carry transform changes to the client so EGL applies
the same calibration to hardware cursors, and invalidate the full frame
whenever calibration changes.
Custom modes can now be configured via the registry under
HKEY_LOCAL_MACHINE\SOFTWARE\LookingGlass\IDD
Create the value "Modes" as a REG_MULTI_SZ with the value as
a list of modes, for example:
1024x768@60
1920x1080@60
1920x1080@120*
The '*' denotes the preferred mode to default to if one has not
been selected by the user.
As the IDD itself runs in a WUMDF sandbox, it doesn't have enough
access to perform interactive operations such as moving the cursor.
This helper service communicates with the IDD over a named pipe,
so that we can perform these things, as well as in the future provide
a configuration GUI.
