Shared text clipboard via VMware backdoor + W95TOOLS.EXE guest agent#361
Merged
Conversation
d29ef76 to
05ff880
Compare
Three layers: v86 — src/vmware.js gains the legacy text-clipboard backdoor commands (GETSELLENGTH/GETNEXTPIECE/SETSELLENGTH/SETNEXTPIECE, 6–9). The host stages bytes via the vmware-clipboard-host bus event; the guest pushes via 8/9 and the device emits vmware-clipboard-guest when the buffer fills. Same wire protocol as open-vm-tools' pre-RPC copy/paste. Committed on the windows95-base fork branch; libv86.js rebuilt here. renderer — src/renderer/clipboard.ts polls Electron's clipboard (no change event exists), translates host UTF-8/LF ↔ guest CP-1252/CRLF, and bounces bytes through the two bus events. Echo-suppressed so a value we just wrote does not come back as a change. guest — guest-tools/agent/W95TOOLS.EXE is a 22 KB hidden-window agent that joins the Win32 clipboard-viewer chain (push-on-copy) and polls the backdoor on a 250 ms timer (pull-from-host). Win9x runs ring-3 with the I/O bitmap wide open, so a plain IN EAX,DX from a user process reaches the port — no driver needed. Named for growth: time sync and host-initiated shutdown will live here too. Built with Open Watcom v2 inside Docker (Makefile + Dockerfile alongside the source); subsystem 4.0, no msvcrt, runs on Win95 RTM. Install: copy \\HOST\TOOLS\agent\W95TOOLS.EXE into the guest and drop a shortcut in StartUp. Text only, 64 KB cap.
05ff880 to
adabd11
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bidirectional text clipboard between the host and the Win95 guest.
How it works
src/vmware.js(fork branchvmware-clipboard, on top ofvmware-abspointer) gains backdoor commands 6–9 — the legacy VMware text-clipboard protocol. Host stages bytes viavmware-clipboard-hostbus event; guest pushes via 8/9 and the device emitsvmware-clipboard-guestwhen complete.libv86.jsrebuilt.src/renderer/clipboard.tspolls Electron's clipboard every 500 ms (no change event), converts UTF-8/LF ↔ CP-1252/CRLF, and bounces bytes through the bus. Echo-suppressed both ways.guest-tools/agent/W95TOOLS.EXE— hidden window in the clipboard-viewer chain → backdoor 8/9 onWM_DRAWCLIPBOARD; 250 msWM_TIMERpolls backdoor 6/7 →SetClipboardData(CF_TEXT). Win9x leaves the I/O bitmap open soIN EAX,DXworks from ring 3; no driver. 22 KB, subsystem 4.0, KERNEL32/USER32 only. Built with Open Watcom v2 in Docker (make -C guest-tools/agent). Named generically because time sync and host-initiated shutdown will live here too.Install inside the guest
\\HOST\TOOLS\agent\W95TOOLS.EXEtoC:\WINDOWS\C:\WINDOWS\Start Menu\Programs\StartUpText only, 64 KB cap.
Tested
tools/probe-boot.sh→ SUCCESS at 32 s (no regression from libv86 rebuild / clipboard poller)\\HOST\TOOLS: SMB serves it, desktop stays clean (backdoor version check passed, agent running hidden)Upstream
v86 source change is pushed to
felixrieseberg/v86:vmware-clipboard(one commit on top ofvmware-abspointer); PR not yet opened.