9remote 2.1.21 → 2.2.4

package/dist/assets/tray.ps1

@@ -70,6 +70,14 @@ $script:menu = New-Object System.Windows.Forms.ContextMenuStrip
 $script:notifyIcon.ContextMenuStrip = $script:menu
 $script:items = @()
 
+# Left-click also opens the menu (right-click is the Windows default)
+$script:notifyIcon.Add_MouseClick({
+  param($sender, $e)
+  if ($e.Button -eq [System.Windows.Forms.MouseButtons]::Left) {
+    $script:menu.Show([System.Windows.Forms.Cursor]::Position, [System.Windows.Forms.ToolStripDropDownDirection]::BelowRight)
+  }
+})
+
 function Write-Event($obj) {
   $json = $obj | ConvertTo-Json -Compress
   [Console]::Out.WriteLine($json)

package/dist/bin/desktop-bridge.cs

@@ -0,0 +1,212 @@
+// Desktop bridge daemon (runs as Local System). Named pipe server "9remote-desktop".
+// Protocol (line-based ASCII):
+//   STATE          -> "DESKTOP <name>"  (name == "Winlogon" when on the login screen)
+//   TYPE <text>    -> clears the field, types text via SendInput + VkKeyScanW, Enter; replies "OK"
+//   csc -nologo -target:winexe -out:desktop-bridge.exe desktop-bridge.cs
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.IO.Pipes;
+using System.Runtime.InteropServices;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.Threading;
+
+class DesktopBridge {
+  [DllImport("user32.dll", SetLastError = true)] static extern uint SendInput(uint n, INPUT[] p, int cb);
+  [DllImport("user32.dll", SetLastError = true)] static extern IntPtr OpenInputDesktop(uint f, bool inh, uint da);
+  [DllImport("user32.dll", SetLastError = true)] static extern bool SetThreadDesktop(IntPtr h);
+  [DllImport("user32.dll", SetLastError = true)] static extern bool CloseDesktop(IntPtr h);
+  [DllImport("user32.dll", SetLastError = true)] static extern bool GetUserObjectInformationW(IntPtr o, int i, IntPtr p, uint len, out uint need);
+  [DllImport("user32.dll", CharSet = CharSet.Unicode)] static extern short VkKeyScanW(char c);
+
+  // GENERIC_ALL required — GENERIC_READ silently drops keystrokes into Winlogon desktop.
+  const uint GENERIC_ALL = 0x10000000;
+  const uint INPUT_KEYBOARD = 1;
+  const uint KEYEVENTF_KEYUP = 0x0002;
+  const int UOI_NAME = 2;
+  const ushort VK_BACK = 0x08;
+  const ushort VK_RETURN = 0x0D;
+  const ushort VK_SHIFT = 0x10;
+  const string PIPE = "9remote-desktop";
+  // Bump on every change to this file. The agent reads the same constant out of
+  // the shipped .cs and compares it against what the running worker reports, so
+  // a stale worker is detected without relying on file mtimes. Same contract as
+  // DAEMON_VERSION for the pty daemon.
+  const string VERSION = "2";
+  // Global\ (not Local\): the boot task runs in session 0 while a user-triggered
+  // launcher runs in the console session — a per-session mutex would not see across them.
+  const string MUTEX_NAME = "Global\\9remote-desktop-bridge";
+  // How long a starting worker waits for a shutting-down one to release the lock.
+  const int HANDOFF_WAIT_MS = 10000;
+
+  // Static so the GC never collects it while Main loops forever.
+  static Mutex _instanceLock;
+
+  [StructLayout(LayoutKind.Sequential)]
+  struct MOUSEINPUT { public int dx, dy; public uint mouseData, dwFlags, time; public IntPtr dwExtraInfo; }
+  [StructLayout(LayoutKind.Sequential)]
+  struct KEYBDINPUT { public ushort wVk, wScan; public uint dwFlags, time; public IntPtr dwExtraInfo; }
+  [StructLayout(LayoutKind.Sequential)]
+  struct HARDWAREINPUT { public uint uMsg; public ushort wParamL, wParamH; }
+  [StructLayout(LayoutKind.Explicit)]
+  struct MKH {
+    [FieldOffset(0)] public MOUSEINPUT mi;
+    [FieldOffset(0)] public KEYBDINPUT ki;
+    [FieldOffset(0)] public HARDWAREINPUT hi;
+  }
+  [StructLayout(LayoutKind.Sequential)]
+  struct INPUT { public uint type; public MKH u; }
+
+  static string NameOf(IntPtr h) {
+    uint need;
+    GetUserObjectInformationW(h, UOI_NAME, IntPtr.Zero, 0, out need);
+    if (need == 0) return "unknown";
+    IntPtr buf = Marshal.AllocHGlobal((int)need);
+    try {
+      GetUserObjectInformationW(h, UOI_NAME, buf, need, out need);
+      return Marshal.PtrToStringUni(buf);
+    } finally { Marshal.FreeHGlobal(buf); }
+  }
+
+  static string ActiveDesktop() {
+    IntPtr h = OpenInputDesktop(0, false, GENERIC_ALL);
+    if (h == IntPtr.Zero) return "none";
+    string n = NameOf(h);
+    CloseDesktop(h);
+    return n;
+  }
+
+  static void AttachActive() {
+    IntPtr h = OpenInputDesktop(0, false, GENERIC_ALL);
+    if (h != IntPtr.Zero) { SetThreadDesktop(h); CloseDesktop(h); }
+  }
+
+  // Log to worker.log beside the exe — tailed by the agent so SendInput failures
+  // (wrong session, wrong desktop, UIPI block) surface without a console.
+  // NOTE: csc v4.0.30319 is C# 5.0 — no string interpolation ($""), no expression-bodied members.
+  static string LOG = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "worker.log");
+  static void L(string m) {
+    try { File.AppendAllText(LOG, "[" + DateTime.Now.ToString("HH:mm:ss.fff") + "] " + m + "\n"); } catch {}
+  }
+
+  // Atomic down+up in ONE SendInput call — matches the .docs/login pattern that
+  // was verified working. The Winlogon credential UI can drop keystrokes when
+  // key-down and key-up are sent in separate SendInput calls.
+  static void SendVK(ushort vk) {
+    INPUT[] inp = new INPUT[2];
+    inp[0].type = INPUT_KEYBOARD; inp[0].u.ki.wVk = vk;
+    inp[1].type = INPUT_KEYBOARD; inp[1].u.ki.wVk = vk; inp[1].u.ki.dwFlags = KEYEVENTF_KEYUP;
+    uint r = SendInput((uint)inp.Length, inp, Marshal.SizeOf(typeof(INPUT)));
+    if (r == 0) L("SendInput FAIL vk=0x" + vk.ToString("X2") + " winerr=" + Marshal.GetLastWin32Error());
+  }
+
+  // Single event (down or up) for modifier-hold sequences (shifted chars).
+  static void SendKey(ushort vk, bool up) {
+    INPUT inp = new INPUT { type = INPUT_KEYBOARD };
+    inp.u.ki.wVk = vk;
+    if (up) inp.u.ki.dwFlags = KEYEVENTF_KEYUP;
+    INPUT[] arr = new INPUT[] { inp };
+    uint r = SendInput(1, arr, Marshal.SizeOf(typeof(INPUT)));
+    if (r == 0) L("SendKey FAIL vk=0x" + vk.ToString("X2") + " up=" + up + " winerr=" + Marshal.GetLastWin32Error());
+  }
+
+  // VkKeyScanW high byte: bit0 = Shift, bit1 = Ctrl, bit2 = Alt. Only Shift handled here.
+  static void TypeText(string text) {
+    int sess = Process.GetCurrentProcess().SessionId;
+    string beforeDesk = ActiveDesktop();
+    L("TYPE session=" + sess + " desktop=" + beforeDesk + " len=" + text.Length);
+    AttachActive();
+    string afterDesk = ActiveDesktop();
+    if (afterDesk != beforeDesk) L("  attach flipped desktop " + beforeDesk + " -> " + afterDesk);
+    for (int i = 0; i < 30; i++) { SendVK(VK_BACK); Thread.Sleep(20); }
+    Thread.Sleep(80);
+    foreach (char c in text) {
+      short k = VkKeyScanW(c);
+      ushort vk = (ushort)(k & 0xFF);
+      bool shift = (k & 0x0100) != 0;
+      // Never log the char or its vk — TYPE carries the user's password.
+      if (shift) {
+        SendKey(VK_SHIFT, false);
+        SendKey(vk, false); Thread.Sleep(25); SendKey(vk, true);
+        SendKey(VK_SHIFT, true);
+      } else {
+        SendVK(vk);  // atomic — same path as .docs/login for digits
+      }
+      Thread.Sleep(30);
+    }
+    Thread.Sleep(80);
+    SendVK(VK_RETURN);
+    L("TYPE done");
+  }
+
+  static void Main() {
+    // Single-instance guard. The pipe is created with maxInstances=1, so a second
+    // worker could never serve — it would spin in the retry loop forever while
+    // holding a lock on this .exe, blocking every future csc rebuild.
+    //
+    // Held in a static field, not a local: GC.KeepAlive only protects up to the
+    // call, after which nothing references a local mutex for the rest of this
+    // infinite loop — the finalizer would release it mid-run and let a second
+    // worker in. A static root lives as long as the process.
+    // Never let the guard itself kill the worker: if the mutex can't be created
+    // or opened (ACL, exotic session), carry on unguarded — the pipe's own
+    // maxInstances=1 still prevents two workers from serving at once.
+    try {
+      bool isNew;
+      _instanceLock = new Mutex(true, MUTEX_NAME, out isNew);
+      if (!isNew) {
+        // The previous worker may be shutting down right now (agent issued STOP,
+        // then relaunched us via the task). Wait for it to release rather than
+        // exiting into a gap where no worker is running at all.
+        if (!_instanceLock.WaitOne(HANDOFF_WAIT_MS)) { L("another worker still holds the lock — exiting"); return; }
+        L("took over from a previous instance");
+      }
+    } catch (Exception e) { L("mutex guard unavailable: " + e.Message); }
+    try { L("start session=" + Process.GetCurrentProcess().SessionId + " pid=" + Process.GetCurrentProcess().Id + " user=" + WindowsIdentity.GetCurrent().Name); } catch {}
+    // ACL: SYSTEM + Administrators + Authenticated Users so the user-scope agent can connect.
+    var sec = new PipeSecurity();
+    sec.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null), PipeAccessRights.ReadWrite, AccessControlType.Allow));
+    sec.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null), PipeAccessRights.ReadWrite, AccessControlType.Allow));
+    sec.AddAccessRule(new PipeAccessRule(new SecurityIdentifier(WellKnownSidType.AuthenticatedUserSid, null), PipeAccessRights.ReadWrite, AccessControlType.Allow));
+
+    while (true) {
+      NamedPipeServerStream srv;
+      try {
+        srv = new NamedPipeServerStream(PIPE, PipeDirection.InOut, 1, PipeTransmissionMode.Byte, PipeOptions.None, 0, 0, sec);
+      } catch {
+        Thread.Sleep(1000); continue;
+      }
+      try {
+        srv.WaitForConnection();
+        var sr = new StreamReader(srv);
+        var sw = new StreamWriter(srv) { AutoFlush = true };
+        string line;
+        while ((line = sr.ReadLine()) != null) {
+          line = line.Trim();
+          if (line.Length == 0) continue;
+          if (line == "VERSION") {
+            sw.WriteLine("VERSION " + VERSION);
+          } else if (line == "STATE") {
+            sw.WriteLine("DESKTOP " + ActiveDesktop());
+          } else if (line.StartsWith("TYPE ")) {
+            TypeText(line.Substring(5));
+            sw.WriteLine("OK");
+          } else if (line == "STOP") {
+            sw.WriteLine("OK");
+            // Clean exit: STOP is an intentional shutdown (user toggled Off, or
+            // the agent is freeing the locked exe for a rebuild). Restarting here
+            // would defeat both. The boot task brings it back next reboot.
+            try { srv.Dispose(); } catch { }
+            Environment.Exit(0);
+          } else {
+            sw.WriteLine("ERR unknown");
+          }
+        }
+      } catch {
+      } finally {
+        try { srv.Dispose(); } catch { }
+      }
+    }
+  }
+}

package/dist/bin/desktop-elevate.cs

@@ -0,0 +1,166 @@
+// Desktop elevate launcher (run as admin via UAC). Spawns desktop-bridge.exe as
+// Local System inside the console session so it can SendInput into the Winlogon
+// (login) desktop. Worker path defaults to the launcher's own directory.
+//   csc -nologo -target:winexe -out:desktop-elevate.exe desktop-elevate.cs
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Threading;
+
+class DesktopElevate {
+  [DllImport("kernel32.dll")] static extern uint WTSGetActiveConsoleSessionId();
+  [DllImport("kernel32.dll")] static extern IntPtr GetCurrentProcess();
+  [DllImport("kernel32.dll", SetLastError = true)] static extern IntPtr OpenProcess(uint da, bool inh, int pid);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr h);
+  [DllImport("advapi32.dll", SetLastError = true)] static extern bool OpenProcessToken(IntPtr h, uint da, out IntPtr t);
+  [DllImport("advapi32.dll", SetLastError = true)] static extern bool DuplicateTokenEx(IntPtr ex, uint da, IntPtr sa, int imp, int t, out IntPtr dup);
+  [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)] static extern bool LookupPrivilegeValueW(string sys, string name, out LUID luid);
+  [DllImport("advapi32.dll", SetLastError = true)] static extern bool AdjustTokenPrivileges(IntPtr h, bool dis, ref TOKEN_PRIVILEGES np, int len, IntPtr p, IntPtr l);
+  [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+  static extern bool CreateProcessWithTokenW(IntPtr h, uint logonFlags, string app, string cmd, uint flags, IntPtr env, string dir, ref STARTUPINFO si, out PROCESS_INFORMATION pi);
+  [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+  static extern bool CreateProcessAsUserW(IntPtr h, string app, string cmd, IntPtr pa, IntPtr ta, bool inh, uint flags, IntPtr env, string dir, ref STARTUPINFO si, out PROCESS_INFORMATION pi);
+  [DllImport("advapi32.dll", SetLastError = true)] static extern bool SetTokenInformation(IntPtr h, int cls, ref uint val, int len);
+  [DllImport("userenv.dll", SetLastError = true)] static extern bool CreateEnvironmentBlock(out IntPtr env, IntPtr hToken, bool inherit);
+  [DllImport("userenv.dll")] static extern bool DestroyEnvironmentBlock(IntPtr env);
+
+  const uint TOKEN_QUERY = 0x0008;
+  const uint TOKEN_ADJUST_PRIVILEGES = 0x0020;
+  const uint TOKEN_DUPLICATE = 0x0002;
+  const uint TOKEN_ASSIGN_PRIMARY = 0x0001;
+  const uint TOKEN_ALL_ACCESS = 0xF01FF;
+  const uint PROCESS_QUERY_INFORMATION = 0x0400;
+  const int SecurityImpersonation = 2;
+  const int TokenPrimary = 1;
+  const uint SE_PRIVILEGE_ENABLED = 0x00000002;
+  const uint CREATE_UNICODE_ENVIRONMENT = 0x00000400;
+  const int TokenSessionId = 12;
+
+  // Launcher failures are otherwise silent (every error path just returns), and
+  // the only symptom downstream is "no worker". Log beside the exe like the worker.
+  static string LOG = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "launcher.log");
+  static void L(string m) {
+    try { File.AppendAllText(LOG, "[" + DateTime.Now.ToString("HH:mm:ss.fff") + "] " + m + "\n"); } catch {}
+  }
+
+  [StructLayout(LayoutKind.Sequential)]
+  struct LUID { public uint LowPart; public int HighPart; }
+  [StructLayout(LayoutKind.Sequential)]
+  struct LUID_AND_ATTRIBUTES { public LUID Luid; public uint Attributes; }
+  [StructLayout(LayoutKind.Sequential)]
+  struct TOKEN_PRIVILEGES { public uint PrivilegeCount; public LUID_AND_ATTRIBUTES Privileges; }
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  struct STARTUPINFO {
+    public int cb; public string lpReserved; public string lpDesktop; public string lpTitle;
+    public int dwX, dwY, dwXSize, dwYSize, dwXCountChars, dwYCountChars, dwFillAttribute, dwFlags;
+    public short wShowWindow, cbReserved2; public IntPtr lpReserved2, hStdInput, hStdOutput, hStdError;
+  }
+  [StructLayout(LayoutKind.Sequential)]
+  struct PROCESS_INFORMATION { public IntPtr hProcess, hThread; public int dwProcessId, dwThreadId; }
+
+  static void EnablePriv(IntPtr h, string n) {
+    LUID l;
+    if (!LookupPrivilegeValueW(null, n, out l)) return;
+    TOKEN_PRIVILEGES tp;
+    tp.PrivilegeCount = 1;
+    tp.Privileges.Luid = l;
+    tp.Privileges.Attributes = SE_PRIVILEGE_ENABLED;
+    AdjustTokenPrivileges(h, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
+  }
+
+  // Highest desktop-bridge-<n>.exe in dir, or null. Numeric compare — a string
+  // sort would rank "9" above "10" and pin the worker to an old build forever.
+  static string PickNewestWorker(string dir) {
+    string best = null;
+    int bestV = -1;
+    try {
+      foreach (var f in Directory.GetFiles(dir, "desktop-bridge-*.exe")) {
+        var name = Path.GetFileNameWithoutExtension(f);
+        int v;
+        if (!int.TryParse(name.Substring("desktop-bridge-".Length), out v)) continue;
+        if (v > bestV) { bestV = v; best = f; }
+      }
+    } catch { return null; }
+    return best;
+  }
+
+  static void Main() {
+    uint sid = 0xFFFFFFFF;
+    L("start pid=" + Process.GetCurrentProcess().Id + " session=" + Process.GetCurrentProcess().SessionId);
+
+    IntPtr hSelf;
+    if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out hSelf)) {
+      EnablePriv(hSelf, "SeImpersonatePrivilege");
+      EnablePriv(hSelf, "SeAssignPrimaryTokenPrivilege");
+      EnablePriv(hSelf, "SeIncreaseQuotaPrivilege");
+      // Required to rewrite a token's session id (see the SetTokenInformation below).
+      EnablePriv(hSelf, "SeTcbPrivilege");
+      CloseHandle(hSelf);
+    }
+
+    // At boot this launcher runs before the console session finishes coming up:
+    // WTSGetActiveConsoleSessionId can return 0xFFFFFFFF (no session attached)
+    // and winlogon.exe for that session may not exist yet. Poll for up to 2min
+    // instead of exiting — a one-shot check would leave the worker dead until
+    // the next reboot, which is the very failure this task exists to prevent.
+    int wpid = -1;
+    for (int attempt = 0; attempt < 120 && wpid < 0; attempt++) {
+      sid = WTSGetActiveConsoleSessionId();
+      if (sid != 0xFFFFFFFF) {
+        foreach (var p in Process.GetProcesses()) {
+          if (p.ProcessName.Equals("winlogon", StringComparison.OrdinalIgnoreCase) && p.SessionId == sid) { wpid = p.Id; break; }
+        }
+      }
+      if (wpid < 0) Thread.Sleep(1000);
+    }
+    if (wpid < 0) return;
+
+    IntPtr hp = OpenProcess(PROCESS_QUERY_INFORMATION, false, wpid);
+    if (hp == IntPtr.Zero) return;
+
+    IntPtr ht;
+    if (!OpenProcessToken(hp, TOKEN_DUPLICATE | TOKEN_QUERY | TOKEN_ASSIGN_PRIMARY, out ht)) { CloseHandle(hp); return; }
+
+    IntPtr dup;
+    if (!DuplicateTokenEx(ht, TOKEN_ALL_ACCESS, IntPtr.Zero, SecurityImpersonation, TokenPrimary, out dup)) { CloseHandle(ht); CloseHandle(hp); return; }
+
+    IntPtr env;
+    if (!CreateEnvironmentBlock(out env, dup, false)) { CloseHandle(dup); CloseHandle(ht); CloseHandle(hp); return; }
+
+    // Worker lives beside this launcher exe, named desktop-bridge-<version>.exe.
+    // Version-stamped so the agent can build a new one without overwriting (and
+    // locking) the copy currently running — this boot then picks up the newest.
+    string app = PickNewestWorker(AppDomain.CurrentDomain.BaseDirectory);
+    if (app == null) { DestroyEnvironmentBlock(env); CloseHandle(dup); CloseHandle(ht); CloseHandle(hp); return; }
+
+    var si = new STARTUPINFO { cb = Marshal.SizeOf(typeof(STARTUPINFO)) };
+    si.lpDesktop = @"winsta0\default";
+
+    // Pin the token to the console session. The duplicated winlogon token already
+    // carries it, but this is the one thing that must not be wrong — a worker in
+    // the wrong session still starts, still answers the pipe, and SendInput still
+    // reports success, while every keystroke lands on session 0's Winlogon desktop
+    // instead of the screen the user is looking at. Needs SeTcbPrivilege.
+    if (!SetTokenInformation(dup, TokenSessionId, ref sid, sizeof(uint)))
+      L("SetTokenInformation(session=" + sid + ") failed winerr=" + Marshal.GetLastWin32Error());
+
+    // CreateProcessAsUserW, not CreateProcessWithTokenW: the latter routes through
+    // the Secondary Logon service, which places the child in the CALLER's session
+    // and ignores the token's. That was invisible while the launcher was started by
+    // UAC from the console session — under the AtStartup task the launcher runs in
+    // session 0, and the worker went with it. CreateProcessAsUserW honours the
+    // token's session; SYSTEM already holds the required SeAssignPrimaryTokenPrivilege.
+    PROCESS_INFORMATION pi;
+    bool ok = CreateProcessAsUserW(dup, app, "\"" + app + "\"", IntPtr.Zero, IntPtr.Zero, false, CREATE_UNICODE_ENVIRONMENT, env, AppDomain.CurrentDomain.BaseDirectory, ref si, out pi);
+    if (!ok) {
+      L("CreateProcessAsUserW failed winerr=" + Marshal.GetLastWin32Error() + " — falling back to CreateProcessWithTokenW");
+      ok = CreateProcessWithTokenW(dup, 0, app, "\"" + app + "\"", CREATE_UNICODE_ENVIRONMENT, env, AppDomain.CurrentDomain.BaseDirectory, ref si, out pi);
+    }
+    L((ok ? "spawned " : "spawn FAILED ") + app + " session=" + sid + (ok ? " pid=" + pi.dwProcessId : " winerr=" + Marshal.GetLastWin32Error()));
+
+    DestroyEnvironmentBlock(env);
+    if (ok) { CloseHandle(pi.hProcess); CloseHandle(pi.hThread); }
+    CloseHandle(dup); CloseHandle(ht); CloseHandle(hp);
+  }
+}