Launched Process Isolation - Looking for Documentation

[Kissaki]

I am looking for information on how itch.io launches games. The manual does not seem to provide such information. Where can I find information, or the code in question?

For context:

Mumble uses the parent ID of processes to identify which programs that are using graphics API (D3D, OpenGL, etc) have been launched by a known (game) launcher and are thus most likely video games, which it shows an ingame status overlay in.

Itch seems to spawn and isolate the process in one way or another (Process Explorer shows itch.exe being a parent of isolate.exe being a parent of conhost.exe and the game exe). However, Mumble can not (currently) identify the process parent as it does not seem to have a parent process ID.

Thus, I am looking for more information on the isolation process, and how/whether Mumble could identify apps as being launched from itch when they load API DLLs (D3D, OpenGL, etc).

I am using itch v23.4.0

[Kissaki]

We found https://itch.io/docs/itch/using/sandbox.html documenting the sandbox setting, and that it launches the game as a less privileged user.

[fasterthanlime]

Hey there! Thanks for reaching out! Are you directly involved with Mumble's development?

The source code of isolate is open-source, here it is: https://github.com/itchio/isolate

Basically:

• Sandboxing setup (the reason the itch app asks for admin rights once) creates another user, that is hidden from the Users list (and even isn't in the Users group), named itch-player-XXXXXX.
• When running a game in the sandbox, isolate first grants read/write/execute permission to the game folder, to the itch-player-XXXXXX user, then uses LogonUserW and ImpersonateLoggedOnUser to retrieve various paths (AppData, LocalAppData, etc.). It then uses CreateProcessWithLogonW to launch the actual game.

I'm betting the reason Mumble can't identify the parent process id is that, as you found out from Process Explorer, CreateProcessWithLogonW seems to make the game process inherit from conhost.exe.

However, Mumble can not (currently) identify the process parent as it does not seem to have a parent process ID.

I'd be interested in reading Mumble code to see how it looks for process with known game clients as parents. Since the game is running as a different user, maybe mumble doesn't have permission to query info on the process? If you can retrieve which user the game is running as, anything starting with itch-player is a safe sign that it's been launched with itch.

However, there are non-game programs launched by itch so your mileage may vary! (But it's the same with Steam, for example).

[Kissaki]

Thank you for coming back to me. Yes, I am part of the core Mumble team.

The corresponding code is at https://github.com/mumble-voip/mumble/blob/8f65051faf9e1cb4a921c4512387ddfc35eae9e5/overlay/excludecheck.cpp#L125 respective https://github.com/mumble-voip/mumble/blob/8f65051faf9e1cb4a921c4512387ddfc35eae9e5/overlay/ancestor.cpp#L116

We will look into it further, and see what we can do, tracking process in https://github.com/mumble-voip/mumble/issues/3043

Again, thank you for the elaborate information. I'll close this request.