Skip to content

Shared text clipboard via VMware backdoor + W95TOOLS.EXE guest agent#361

Merged
felixrieseberg merged 1 commit into
mainfrom
claude/xenodochial-sanderson
Apr 12, 2026
Merged

Shared text clipboard via VMware backdoor + W95TOOLS.EXE guest agent#361
felixrieseberg merged 1 commit into
mainfrom
claude/xenodochial-sanderson

Conversation

@felixrieseberg

@felixrieseberg felixrieseberg commented Apr 12, 2026

Copy link
Copy Markdown
Owner

Bidirectional text clipboard between the host and the Win95 guest.

How it works

Layer Change
v86 src/vmware.js (fork branch vmware-clipboard, on top of vmware-abspointer) gains backdoor commands 6–9 — the legacy VMware text-clipboard protocol. Host stages bytes via vmware-clipboard-host bus event; guest pushes via 8/9 and the device emits vmware-clipboard-guest when complete. libv86.js rebuilt.
renderer src/renderer/clipboard.ts polls Electron's clipboard every 500 ms (no change event), converts UTF-8/LF ↔ CP-1252/CRLF, and bounces bytes through the bus. Echo-suppressed both ways.
guest guest-tools/agent/W95TOOLS.EXE — hidden window in the clipboard-viewer chain → backdoor 8/9 on WM_DRAWCLIPBOARD; 250 ms WM_TIMER polls backdoor 6/7 → SetClipboardData(CF_TEXT). Win9x leaves the I/O bitmap open so IN EAX,DX works from ring 3; no driver. 22 KB, subsystem 4.0, KERNEL32/USER32 only. Built with Open Watcom v2 in Docker (make -C guest-tools/agent). Named generically because time sync and host-initiated shutdown will live here too.

Install inside the guest

  1. Copy \\HOST\TOOLS\agent\W95TOOLS.EXE to C:\WINDOWS\
  2. Shortcut in C:\WINDOWS\Start Menu\Programs\StartUp

Text only, 64 KB cap.

Tested

  • tools/probe-boot.sh → SUCCESS at 32 s (no regression from libv86 rebuild / clipboard poller)
  • Probe-launched the EXE from \\HOST\TOOLS: SMB serves it, desktop stays clean (backdoor version check passed, agent running hidden)
  • Needs a manual round-trip check: Notepad paste / pbpaste — the harness can't drive Ctrl+C/V yet

Upstream

v86 source change is pushed to felixrieseberg/v86:vmware-clipboard (one commit on top of vmware-abspointer); PR not yet opened.

@felixrieseberg felixrieseberg force-pushed the claude/xenodochial-sanderson branch 2 times, most recently from d29ef76 to 05ff880 Compare April 12, 2026 02:56
@felixrieseberg felixrieseberg changed the title Shared text clipboard via VMware backdoor + CLIPSYNC.EXE guest agent Shared text clipboard via VMware backdoor + W95TOOLS.EXE guest agent Apr 12, 2026
Three layers:

  v86 — src/vmware.js gains the legacy text-clipboard backdoor commands
  (GETSELLENGTH/GETNEXTPIECE/SETSELLENGTH/SETNEXTPIECE, 6–9). The host
  stages bytes via the vmware-clipboard-host bus event; the guest pushes
  via 8/9 and the device emits vmware-clipboard-guest when the buffer
  fills. Same wire protocol as open-vm-tools' pre-RPC copy/paste.
  Committed on the windows95-base fork branch; libv86.js rebuilt here.

  renderer — src/renderer/clipboard.ts polls Electron's clipboard (no
  change event exists), translates host UTF-8/LF ↔ guest CP-1252/CRLF,
  and bounces bytes through the two bus events. Echo-suppressed so a
  value we just wrote does not come back as a change.

  guest — guest-tools/agent/W95TOOLS.EXE is a 22 KB hidden-window agent
  that joins the Win32 clipboard-viewer chain (push-on-copy) and polls
  the backdoor on a 250 ms timer (pull-from-host). Win9x runs ring-3
  with the I/O bitmap wide open, so a plain IN EAX,DX from a user
  process reaches the port — no driver needed. Named for growth: time
  sync and host-initiated shutdown will live here too. Built with Open
  Watcom v2 inside Docker (Makefile + Dockerfile alongside the source);
  subsystem 4.0, no msvcrt, runs on Win95 RTM.

Install: copy \\HOST\TOOLS\agent\W95TOOLS.EXE into the guest and drop a
shortcut in StartUp. Text only, 64 KB cap.
@felixrieseberg felixrieseberg force-pushed the claude/xenodochial-sanderson branch from 05ff880 to adabd11 Compare April 12, 2026 03:16
@felixrieseberg felixrieseberg merged commit bc76e9c into main Apr 12, 2026
1 check passed
@felixrieseberg felixrieseberg deleted the claude/xenodochial-sanderson branch April 12, 2026 03:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant