Sidecar Helper Architecture English

Sidecar Helper Architecture: Controlling Anti-Cheat Game IMEs & Microsoft Store Compliance

English · 繁體中文

Under Windows' security model, unprivileged applications cannot interact with elevated anti-cheat games or send window messages across User Interface Privilege Isolation (UIPI) boundaries to modern packaged apps like Windows 11 Notepad.

ImeModePersistence (v1.5.0+) introduces the Sidecar Helper architecture, which bridges these barriers without requiring the main application to run as administrator, without DLL injection, and without synthetic keystroke simulation. This achieves three critical goals:

1. Seamlessly pinning and switching input languages for elevated / anti-cheat games like Helldivers 2.
2. Persisting native/alphanumeric IME modes across modern WinUI windows (Windows 11 Notepad).
3. 100% compliance with Microsoft Store security policies for certified store distribution.

This technical document details the design principles, security boundaries, and implementation details of this architecture.

---

1. The Challenge: Windows User Interface Privilege Isolation (UIPI)

Introduced in Windows Vista, UIPI (User Interface Privilege Isolation) isolates processes based on their Integrity Level (IL):

• Low-IL: Browser sandboxes.
• Medium-IL: Normal user desktop apps and Microsoft Store (MSIX) applications.
• High-IL: Processes run as Administrator and full-screen games launching kernel anti-cheat drivers (e.g. Helldivers 2 with nProtect GameGuard).

Why unprivileged utilities fail against anti-cheat games:

When ImeModePersistence runs as a normal user application (Medium-IL), even though it can discover the foreground window class (class:stingray_window) via standard Win32 APIs, attempts to deliver window messages:

• PostMessage(hwnd, WM_INPUTLANGCHANGEREQUEST, 0, hkl) (Keyboard layout switch)
• SendMessage(imeWnd, WM_IME_CONTROL, IMC_SETCONVERSIONMODE, ...) (Native / Alphanumeric mode toggle)

are silently dropped and rejected by the Windows kernel with ERROR_ACCESS_DENIED.

---

2. The Sidecar Helper Architecture

Rather than forcing the entire application to autostart as Administrator (which creates a permanent high-privilege attack surface and triggers antivirus heuristics), we decouple privileges using a dedicated Sidecar Helper:

+-------------------------------------------------------------+
|  Main GUI App (ImeModePersistence.exe)                      |
|  - Privilege: Medium-IL (Normal user / Store MSIX container)|
|  - Role: Tray UI, Focus tracking, Rules, State management   |
+-------------------------------------------------------------+
                              │
             Named Pipe IPC (\\.\pipe\ImeModePersistence.Sidecar)
             Strict SDDL: Interactive User & Administrators Only
                              │
                              ▼
+-------------------------------------------------------------+
|  Elevated Helper (ImeModePersistence.exe --helper <pid>)    |
|  - Privilege: High-IL (Spawned on-demand via standard UAC)  |
|  - Role: Relays Win32 messages across UIPI to High-IL apps  |
|  - Watchdog Thread: Monitors parent PID; exits immediately  |
+-------------------------------------------------------------+
                              │
               Standard Win32 Window Messages (Crosses UIPI)
                              │
                              ▼
+-------------------------------------------------------------+
|  Target Window (Helldivers 2 / Windows 11 Modern Notepad)   |
+-------------------------------------------------------------+

Key Components:

1. On-Demand Launch: The user clicks "Enable WinUI/Admin support..." in the tray menu. The app invokes ShellExecuteExW with the runas verb to spawn ImeModePersistence.exe --helper <parent_pid>, presenting a standard Windows UAC prompt.
2. Secure Named Pipe IPC:
   • Pipe name: \\.\pipe\ImeModePersistence.Sidecar
   • SDDL: D:(A;;GA;;;BA)(A;;GA;;;IU)S:(ML;;NW;;;ME)
   • Strictly restricts connections to the local Interactive User and Builtin Administrators, preventing unauthorized cross-session or network access.
3. Synchronous Duplex Message Protocol: Uses PIPE_TYPE_MESSAGE | PIPE_WAIT to guarantee precise byte alignment and eliminate overlapped I/O races.
4. Lifecycle Watchdog:
   • The Helper runs an independent watchdog thread waiting on { hParentProcess, hShutdownEvent }.
   • If the parent application exits, crashes, or the user turns off the helper from the tray menu, the helper unblocks immediately and terminates cleanly without leaving orphan background processes.

---

3. Why Anti-Cheat Software Does Not Flag or Ban It

Players are rightfully cautious about third-party software triggering anti-cheat bans (GameGuard, EAC, BattlEye, Vanguard). The Sidecar Helper remains completely safe because it strictly adheres to zero-intrusion principles:

Technique	Used by Game Cheats	Used by ImeModePersistence	Safety Rationale
Process Memory Read/Write (ReadProcessMemory, WriteProcessMemory)	Yes	❌ None	Never inspects or modifies game memory.
DLL Injection / Remote Threads (CreateRemoteThread, SetWindowsHookEx)	Yes	❌ None	Never injects foreign code into the game process.
Synthetic Keystrokes (SendInput, keybd_event)	Yes	❌ None	Never synthesises virtual key presses (avoids bot / macro flags).
Global Keystroke Logging (WH_KEYBOARD_LL, GetAsyncKeyState)	Yes	❌ None	Never sniffs user keystrokes.
Standard Win32 Messages (WM_INPUTLANGCHANGEREQUEST, WM_IME_CONTROL)	No	✅ Sole mechanism	Identical to the standard OS notification dispatched when pressing Win+Space. Anti-cheat and the IME framework treat this as standard window manager notifications.

---

4. Why It Can Be Published to the Microsoft Store

The Microsoft Store enforces rigorous safety and packaging constraints:

1. MSIX Packaging and asInvoker Compliance

• Microsoft Store manifests (AppxManifest.xml) strictly prohibit declaring requireAdministrator. The main application must always launch as asInvoker.
• ImeModePersistence runs 100% compliant in the Store app container.

2. Microsoft Store Policy 10.2 (User Control and Consent)

• Store policies require that elevated operations must be explicitly initiated by the user through standard OS consent prompts (UAC), rather than via silent elevation or privilege-escalation exploits.
• The Sidecar Helper is spawned only upon explicit user selection in the tray menu via ShellExecuteEx (runas), satisfying all Store security reviews.

3. Module Path Execution (Eliminating LPE / TOCTOU Vulnerabilities)

• Some legacy tools copied binaries into %Temp% or %LocalAppData% before elevating, introducing Local Privilege Escalation (LPE) and file hijacking risks.
• ImeModePersistence elevates directly against its authentic registered module path (autostart::module_path()), eliminating code-tampering vectors.

---

5. Summary

With the Sidecar Helper architecture, ImeModePersistence achieves the ideal balance between maximum user security and low-level input reliability:

• 🎮 Gamers: Enjoy seamless English layout locking in anti-cheat games without running the main utility elevated.
• 📝 Everyday Users: Prevent unwanted Chinese mode resets across modern Windows 11 WinUI apps.
• 🛡️ Security-First: 0 injection, 0 key simulation, open-source auditability, and validated by both the Microsoft Store and OpenSSF.