9remote 2.2.1 → 2.2.4

package/dist/bin/desktop-bridge.cs

@@ -29,6 +29,19 @@ class DesktopBridge {
   const ushort VK_RETURN = 0x0D;
   const ushort VK_SHIFT = 0x10;
   const string PIPE = "9remote-desktop";
+  // Bump on every change to this file. The agent reads the same constant out of
+  // the shipped .cs and compares it against what the running worker reports, so
+  // a stale worker is detected without relying on file mtimes. Same contract as
+  // DAEMON_VERSION for the pty daemon.
+  const string VERSION = "2";
+  // Global\ (not Local\): the boot task runs in session 0 while a user-triggered
+  // launcher runs in the console session — a per-session mutex would not see across them.
+  const string MUTEX_NAME = "Global\\9remote-desktop-bridge";
+  // How long a starting worker waits for a shutting-down one to release the lock.
+  const int HANDOFF_WAIT_MS = 10000;
+
+  // Static so the GC never collects it while Main loops forever.
+  static Mutex _instanceLock;
 
   [StructLayout(LayoutKind.Sequential)]
   struct MOUSEINPUT { public int dx, dy; public uint mouseData, dwFlags, time; public IntPtr dwExtraInfo; }
@@ -112,7 +125,7 @@ class DesktopBridge {
       short k = VkKeyScanW(c);
       ushort vk = (ushort)(k & 0xFF);
       bool shift = (k & 0x0100) != 0;
-      L("  char='" + c + "' vk=0x" + vk.ToString("X2") + " shift=" + shift);
+      // Never log the char or its vk — TYPE carries the user's password.
       if (shift) {
         SendKey(VK_SHIFT, false);
         SendKey(vk, false); Thread.Sleep(25); SendKey(vk, true);
@@ -128,6 +141,28 @@ class DesktopBridge {
   }
 
   static void Main() {
+    // Single-instance guard. The pipe is created with maxInstances=1, so a second
+    // worker could never serve — it would spin in the retry loop forever while
+    // holding a lock on this .exe, blocking every future csc rebuild.
+    //
+    // Held in a static field, not a local: GC.KeepAlive only protects up to the
+    // call, after which nothing references a local mutex for the rest of this
+    // infinite loop — the finalizer would release it mid-run and let a second
+    // worker in. A static root lives as long as the process.
+    // Never let the guard itself kill the worker: if the mutex can't be created
+    // or opened (ACL, exotic session), carry on unguarded — the pipe's own
+    // maxInstances=1 still prevents two workers from serving at once.
+    try {
+      bool isNew;
+      _instanceLock = new Mutex(true, MUTEX_NAME, out isNew);
+      if (!isNew) {
+        // The previous worker may be shutting down right now (agent issued STOP,
+        // then relaunched us via the task). Wait for it to release rather than
+        // exiting into a gap where no worker is running at all.
+        if (!_instanceLock.WaitOne(HANDOFF_WAIT_MS)) { L("another worker still holds the lock — exiting"); return; }
+        L("took over from a previous instance");
+      }
+    } catch (Exception e) { L("mutex guard unavailable: " + e.Message); }
     try { L("start session=" + Process.GetCurrentProcess().SessionId + " pid=" + Process.GetCurrentProcess().Id + " user=" + WindowsIdentity.GetCurrent().Name); } catch {}
     // ACL: SYSTEM + Administrators + Authenticated Users so the user-scope agent can connect.
     var sec = new PipeSecurity();
@@ -150,17 +185,20 @@ class DesktopBridge {
         while ((line = sr.ReadLine()) != null) {
           line = line.Trim();
           if (line.Length == 0) continue;
-          if (line == "STATE") {
+          if (line == "VERSION") {
+            sw.WriteLine("VERSION " + VERSION);
+          } else if (line == "STATE") {
             sw.WriteLine("DESKTOP " + ActiveDesktop());
           } else if (line.StartsWith("TYPE ")) {
             TypeText(line.Substring(5));
             sw.WriteLine("OK");
           } else if (line == "STOP") {
             sw.WriteLine("OK");
-            // Non-zero exit so the scheduled task's restart-on-failure policy
-            // fires and re-launches the worker (with the freshly rebuilt exe).
+            // Clean exit: STOP is an intentional shutdown (user toggled Off, or
+            // the agent is freeing the locked exe for a rebuild). Restarting here
+            // would defeat both. The boot task brings it back next reboot.
             try { srv.Dispose(); } catch { }
-            Environment.Exit(1);
+            Environment.Exit(0);
           } else {
             sw.WriteLine("ERR unknown");
           }

package/dist/bin/desktop-elevate.cs

@@ -6,6 +6,7 @@ using System;
 using System.Diagnostics;
 using System.IO;
 using System.Runtime.InteropServices;
+using System.Threading;
 
 class DesktopElevate {
   [DllImport("kernel32.dll")] static extern uint WTSGetActiveConsoleSessionId();
@@ -18,6 +19,9 @@ class DesktopElevate {
   [DllImport("advapi32.dll", SetLastError = true)] static extern bool AdjustTokenPrivileges(IntPtr h, bool dis, ref TOKEN_PRIVILEGES np, int len, IntPtr p, IntPtr l);
   [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
   static extern bool CreateProcessWithTokenW(IntPtr h, uint logonFlags, string app, string cmd, uint flags, IntPtr env, string dir, ref STARTUPINFO si, out PROCESS_INFORMATION pi);
+  [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
+  static extern bool CreateProcessAsUserW(IntPtr h, string app, string cmd, IntPtr pa, IntPtr ta, bool inh, uint flags, IntPtr env, string dir, ref STARTUPINFO si, out PROCESS_INFORMATION pi);
+  [DllImport("advapi32.dll", SetLastError = true)] static extern bool SetTokenInformation(IntPtr h, int cls, ref uint val, int len);
   [DllImport("userenv.dll", SetLastError = true)] static extern bool CreateEnvironmentBlock(out IntPtr env, IntPtr hToken, bool inherit);
   [DllImport("userenv.dll")] static extern bool DestroyEnvironmentBlock(IntPtr env);
 
@@ -31,6 +35,14 @@ class DesktopElevate {
   const int TokenPrimary = 1;
   const uint SE_PRIVILEGE_ENABLED = 0x00000002;
   const uint CREATE_UNICODE_ENVIRONMENT = 0x00000400;
+  const int TokenSessionId = 12;
+
+  // Launcher failures are otherwise silent (every error path just returns), and
+  // the only symptom downstream is "no worker". Log beside the exe like the worker.
+  static string LOG = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "launcher.log");
+  static void L(string m) {
+    try { File.AppendAllText(LOG, "[" + DateTime.Now.ToString("HH:mm:ss.fff") + "] " + m + "\n"); } catch {}
+  }
 
   [StructLayout(LayoutKind.Sequential)]
   struct LUID { public uint LowPart; public int HighPart; }
@@ -57,20 +69,50 @@ class DesktopElevate {
     AdjustTokenPrivileges(h, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
   }
 
+  // Highest desktop-bridge-<n>.exe in dir, or null. Numeric compare — a string
+  // sort would rank "9" above "10" and pin the worker to an old build forever.
+  static string PickNewestWorker(string dir) {
+    string best = null;
+    int bestV = -1;
+    try {
+      foreach (var f in Directory.GetFiles(dir, "desktop-bridge-*.exe")) {
+        var name = Path.GetFileNameWithoutExtension(f);
+        int v;
+        if (!int.TryParse(name.Substring("desktop-bridge-".Length), out v)) continue;
+        if (v > bestV) { bestV = v; best = f; }
+      }
+    } catch { return null; }
+    return best;
+  }
+
   static void Main() {
-    uint sid = WTSGetActiveConsoleSessionId();
+    uint sid = 0xFFFFFFFF;
+    L("start pid=" + Process.GetCurrentProcess().Id + " session=" + Process.GetCurrentProcess().SessionId);
 
     IntPtr hSelf;
     if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, out hSelf)) {
       EnablePriv(hSelf, "SeImpersonatePrivilege");
       EnablePriv(hSelf, "SeAssignPrimaryTokenPrivilege");
       EnablePriv(hSelf, "SeIncreaseQuotaPrivilege");
+      // Required to rewrite a token's session id (see the SetTokenInformation below).
+      EnablePriv(hSelf, "SeTcbPrivilege");
       CloseHandle(hSelf);
     }
 
+    // At boot this launcher runs before the console session finishes coming up:
+    // WTSGetActiveConsoleSessionId can return 0xFFFFFFFF (no session attached)
+    // and winlogon.exe for that session may not exist yet. Poll for up to 2min
+    // instead of exiting — a one-shot check would leave the worker dead until
+    // the next reboot, which is the very failure this task exists to prevent.
     int wpid = -1;
-    foreach (var p in Process.GetProcesses()) {
-      if (p.ProcessName.Equals("winlogon", StringComparison.OrdinalIgnoreCase) && p.SessionId == sid) { wpid = p.Id; break; }
+    for (int attempt = 0; attempt < 120 && wpid < 0; attempt++) {
+      sid = WTSGetActiveConsoleSessionId();
+      if (sid != 0xFFFFFFFF) {
+        foreach (var p in Process.GetProcesses()) {
+          if (p.ProcessName.Equals("winlogon", StringComparison.OrdinalIgnoreCase) && p.SessionId == sid) { wpid = p.Id; break; }
+        }
+      }
+      if (wpid < 0) Thread.Sleep(1000);
     }
     if (wpid < 0) return;
 
@@ -86,19 +128,36 @@ class DesktopElevate {
     IntPtr env;
     if (!CreateEnvironmentBlock(out env, dup, false)) { CloseHandle(dup); CloseHandle(ht); CloseHandle(hp); return; }
 
-    // Worker lives beside this launcher exe.
-    string app = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "desktop-bridge.exe");
-    if (!File.Exists(app)) { DestroyEnvironmentBlock(env); CloseHandle(dup); CloseHandle(ht); CloseHandle(hp); return; }
+    // Worker lives beside this launcher exe, named desktop-bridge-<version>.exe.
+    // Version-stamped so the agent can build a new one without overwriting (and
+    // locking) the copy currently running — this boot then picks up the newest.
+    string app = PickNewestWorker(AppDomain.CurrentDomain.BaseDirectory);
+    if (app == null) { DestroyEnvironmentBlock(env); CloseHandle(dup); CloseHandle(ht); CloseHandle(hp); return; }
 
     var si = new STARTUPINFO { cb = Marshal.SizeOf(typeof(STARTUPINFO)) };
     si.lpDesktop = @"winsta0\default";
 
-    // CreateProcessWithTokenW: the launcher itself runs elevated in the console
-    // session (spawned via Start-Process -Verb RunAs from the agent), so the
-    // worker inherits the console session and SendInput reaches the user's
-    // Winlogon desktop. Same pattern as .docs/login/launcher.cs.
+    // Pin the token to the console session. The duplicated winlogon token already
+    // carries it, but this is the one thing that must not be wrong — a worker in
+    // the wrong session still starts, still answers the pipe, and SendInput still
+    // reports success, while every keystroke lands on session 0's Winlogon desktop
+    // instead of the screen the user is looking at. Needs SeTcbPrivilege.
+    if (!SetTokenInformation(dup, TokenSessionId, ref sid, sizeof(uint)))
+      L("SetTokenInformation(session=" + sid + ") failed winerr=" + Marshal.GetLastWin32Error());
+
+    // CreateProcessAsUserW, not CreateProcessWithTokenW: the latter routes through
+    // the Secondary Logon service, which places the child in the CALLER's session
+    // and ignores the token's. That was invisible while the launcher was started by
+    // UAC from the console session — under the AtStartup task the launcher runs in
+    // session 0, and the worker went with it. CreateProcessAsUserW honours the
+    // token's session; SYSTEM already holds the required SeAssignPrimaryTokenPrivilege.
     PROCESS_INFORMATION pi;
-    bool ok = CreateProcessWithTokenW(dup, 0, app, "\"" + app + "\"", CREATE_UNICODE_ENVIRONMENT, env, AppDomain.CurrentDomain.BaseDirectory, ref si, out pi);
+    bool ok = CreateProcessAsUserW(dup, app, "\"" + app + "\"", IntPtr.Zero, IntPtr.Zero, false, CREATE_UNICODE_ENVIRONMENT, env, AppDomain.CurrentDomain.BaseDirectory, ref si, out pi);
+    if (!ok) {
+      L("CreateProcessAsUserW failed winerr=" + Marshal.GetLastWin32Error() + " — falling back to CreateProcessWithTokenW");
+      ok = CreateProcessWithTokenW(dup, 0, app, "\"" + app + "\"", CREATE_UNICODE_ENVIRONMENT, env, AppDomain.CurrentDomain.BaseDirectory, ref si, out pi);
+    }
+    L((ok ? "spawned " : "spawn FAILED ") + app + " session=" + sid + (ok ? " pid=" + pi.dwProcessId : " winerr=" + Marshal.GetLastWin32Error()));
 
     DestroyEnvironmentBlock(env);
     if (ok) { CloseHandle(pi.hProcess); CloseHandle(pi.hThread); }