Add Current Tasks roadmap: injection hardening + audio-format correlation
Replace the Future-work section with a single "Current Tasks" list: - Injection hardening: toggling "Mirror video" has crashed a real game (Brotato) via a hook install/remove race. Test-first task -- make mock_game_test's hook/unhook stress aggressive enough to reproduce the crash (tight video-subsystem toggles from a separate thread while the game presents, across all backends), then apply the audio hooks' safe-unhook guard (epoch bump + restore-then-drain in-flight detours) to the Present / D3D9 / D3D10 / OpenGL / Vulkan hooks. - Audio format by correlating the loopback (known device format) and render-hook (unknown format) captures instead of guessing: (a) rate verification/correction, (b) channel + bit-depth recovery. - Mouse + keyboard forwarding (Raw Input / DirectInput) folded in. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
36
README.md
36
README.md
@@ -107,7 +107,41 @@ default** and covers anything the hooked path doesn't.
|
|||||||
|
|
||||||
## Roadmap
|
## Roadmap
|
||||||
|
|
||||||
### Future work
|
### Current Tasks
|
||||||
|
|
||||||
|
- **Injection hardening — provoke, then fix, the hook install/remove races.** Rapidly
|
||||||
|
toggling the **"Mirror video"** button has crashed a real game (Brotato): flipping the
|
||||||
|
Present-hook video subsystem on/off in quick succession races hook install/remove against
|
||||||
|
the game's Present thread and the host's capture path. Per the test-first rule, *first make
|
||||||
|
the crash reproducible in a test* — make `mock_game_test`'s hook/unhook stress against
|
||||||
|
`coop_mock_game` far more aggressive: tight, repeated subsystem toggles (especially video)
|
||||||
|
while the game is actively presenting, driven from a separate thread so the toggles interleave
|
||||||
|
with the Present detour, sustained long enough that an unguarded race is near-certain to
|
||||||
|
fault, and across all backends (DX11/12/9/10/GL/Vulkan). Then fix what it surfaces — the
|
||||||
|
install/remove path is the same safe-unhook problem the **audio** hooks already solved (bump
|
||||||
|
an epoch on each toggle, restore the vtable/inline first so no new detour starts, then drain
|
||||||
|
in-flight detours before tearing down shared state); apply the equivalent guard to the
|
||||||
|
Present / D3D9 / D3D10 / OpenGL / Vulkan hooks.
|
||||||
|
|
||||||
|
- **Determine a pre-existing stream's audio format by *correlating* the two capture
|
||||||
|
paths, instead of guessing.** When we attach to an already-running game we never saw its
|
||||||
|
`IAudioClient::Initialize`, so the render-hook assumes the device mix format and measures
|
||||||
|
only the sample rate from the render cadence — which can be wrong on a jittery game
|
||||||
|
(intermittent pitch shift) and can't recover channels/bit-depth at all. But during the
|
||||||
|
measurement window the game is still audible, so we already have *both* signals of the
|
||||||
|
same audio: the **process-loopback** capture (post-mix, at the **known** device format)
|
||||||
|
and the **render-hook** capture (pre-mix, at the unknown format). Cross-correlating them
|
||||||
|
pins the real format from ground truth rather than a guess. Two tasks:
|
||||||
|
- **(a) Rate verification/correction.** Resample the hook stream by each candidate standard
|
||||||
|
rate and cross-correlate against the loopback; the rate that holds alignment with no drift
|
||||||
|
over the window is the truth. Robust where cadence measurement is noisy — directly hardens
|
||||||
|
the intermittent pitch-shift symptom. Lands as a verify-and-correct step feeding the
|
||||||
|
existing rate path (the operator override stays as the manual escape hatch).
|
||||||
|
- **(b) Channels + bit-depth recovery.** Extend the correlation to the layout the cadence
|
||||||
|
method *can't* recover: interpret the hook bytes under candidate layouts (float32 vs
|
||||||
|
int16; mono/stereo/…) and keep whichever de-interleaving correlates with the loopback (a
|
||||||
|
wrong interpretation is noise and won't). Removes the "channels/bit-depth assumed = device"
|
||||||
|
limitation, so the garbled-layout case stops being undetectable.
|
||||||
|
|
||||||
- **Mouse + keyboard forwarding for Raw Input / DirectInput games.** The MKB
|
- **Mouse + keyboard forwarding for Raw Input / DirectInput games.** The MKB
|
||||||
subsystem forwards via window messages (`PostMessage`) plus synthesized
|
subsystem forwards via window messages (`PostMessage`) plus synthesized
|
||||||
|
|||||||
Reference in New Issue
Block a user