GciPlugin.dll

What this program actually does

GciPlugin.dll is the central security enforcement plugin in the GCIS (Grid Cloud Init Security) NvContainer stack. It runs inside NvContainerGcis.exe as a mandatory plugin with message-bus endpoint GciPluginSysmon.

It enforces GeForce NOW seat security policy by coordinating with GSConfigurator for seat config, masquerade/MSQRD kernel hooks, cloud/session messages (AIN, app launch, patching), LOFN key coordination via LkmPlugin, and telemetry to TAS. It publishes ProcessEventMessage events consumed by mb-repeater → Sysmon rules.

Build: version 2.0 2026-04-07-b253f97. DLL version 2.0.0.0.

---

Architecture / control flow

NvContainerGcis.exe
  └─ GciPlugin.dll (NvPluginGetInfo)
        ├─ GcisPluginTaskQueue / GciDeferredTaskQ
        │     ├─ PluginInitialization → subscribe MB, AIN via ContentController
        │     └─ PluginStart → telemetry, GSConfigClient fetch GcisConfigData, masquerade init
        ├─ GciPluginStub — GCIS Service API handler (protobuf)
        ├─ GSConfigClient — ZoneConfig / SeatConfig / GcisConfigData from GSConfigurator
        ├─ GsecTasTelemetry — TAS session
        └─ Msqrd/gfnmon callbacks — driver load, file access, reparse, registry filters

Core RTTI classes: GciPluginStub, GcisPluginTaskQueue, GciDeferredTaskQ, GSConfigClient, GsecTasTelemetry, Connector@tas@gs@gfn@nv.

---

External interfaces

GCIS Service API (protobuf)

Namespace: GCISCommunication.GCISServiceAPI

Message	Inferred purpose
GCISServiceAPI_GCISRequest_GciFeatureControl	Enable/disable GCI security features at runtime
GCISServiceAPI_GCISRequest_GetPatchingState	Query seat patching state
GCISServiceAPI_GCISRequest_GetLofnData / SetLofnData	LOFN key material (coordinates with LkmPlugin)
GCISServiceAPI_GCISRequest_ElmFeatureControl	Proxy to Elm plugin
GCISServiceAPI_GCISRequest_UadFeatureControl	Proxy to UAD plugin
GCISServiceAPI_GCISRequest_GssmFeatureControl	Proxy to GSSM plugin

Notifications (outbound): GCISNotification_CloudCheckProcesses, CloudCheckProcessInfo, SecurityTerminationInitiated, LaunchCommand, AppLaunchCommand.

Message Bus

• Endpoint: GciPluginSysmon
• Creates GSConfigClient_<pid>_... peer; waits for GSConfigurator
• Subscribes to AIN via ContentController (Subscribing for AIN message)
• mb-repeater.json forwards GCIS / GciPluginSysmon / ProcessEventMessage

Masquerade / MSQRD

Error string	Meaning
MsqrdFailedToLocateGfnmonConfigure	Cannot reach masquerade monitor
MsqrdFailedToSetDriverLoadNotifyCallback	Kernel driver load notifications
MsqrdFailedToSetFileAccessNotifyCallback	File access policy hooks
MsqrdFailedToSetReparsePointNotifyCallback	Reparse/junction monitoring
MsqrdFailedToConfigureMasqueradeGfnMonitor	Seat monitor setup
IgnoringLaunchCommandFromUntrustedProcess	Policy enforcement outcome
FailedToPostTerminateProcessEvent	Process kill/flag path

Telemetry (TAS)

Log sequence: Initializing telemetry reporter → Initiating GciPlugin <--> TAS session → GciPlugin <--> TAS session initiated.

---

Runtime timeline

Time (UTC)	Event	Source
18:43:01.337	Module load, MB-endpoint GciPluginSysmon, GSConfigurator config fetch OK	GciPluginOld.log
18:43:01.382	Init OK; AIN subscription succeeds (Successfully subscribed CC for AIN messages)	GciPluginOld.log
18:43:01.806	PluginStart: GcisConfigData OK, config version windows-1651, service config loaded	GciPluginOld.log
18:48:23.507	Session ID from GsServiceApi; session state → 1	GciPluginOld.log
19:04:52.395	Second GCIS start: init OK, seat [REDACTED_ZONE]/[REDACTED_POOL]	GciPluginCurrent.log
19:04:52.453	AIN subscription fails error 1; TAS UEC fails (no session yet)	GciPluginCurrent.log
19:04:52.975	TAS session initiated on Start attempt	GciPluginCurrent.log
19:04:53.026	GcisConfigData OBJECT_NOT_FOUND (0x80ec0006) → Failed to start GciPluginSysmon	GciPluginCurrent.log
19:04:53.029	Mandatory plugin failure → container exit 14109	NvContainerGcis.log

Seat metadata (both runs): Zone/Pool [REDACTED_ZONE]/[REDACTED_POOL], InstanceId [REDACTED_INSTANCE_ID], IpAddress [REDACTED_IP], Base environment [REDACTED_BASE_ENV].

---

Failure modes

Condition	Error / log	Impact
Missing GcisConfigData in GSConfigurator	OBJECT_NOT_FOUND (0x80ec0006): Property 'GcisConfigData' not found	PluginStart fails; container exits 14109
AIN subscription failure	Failed to subscribe CC for AIN messages with error 1	Non-fatal at init; CC may not be ready
TAS not connected at init	Failed to send UEC without establishing connection with TAS	Early telemetry dropped
Masquerade driver issues	MsqrdFailedToLocateGfnmon* strings	Kernel enforcement unavailable
Untrusted process actions	IgnoringLaunchCommandFromUntrustedProcess	Policy block (expected)
Telemetry consent	Failed to set telemetry device consent	Seen in first successful run only

---

Not verified

• Exact bitmask semantics of GciFeatureControl fields.
• Complete default allow/deny process lists (config not in workspace).
• Whether AIN error 1 is benign when ContentController unavailable at boot.
• Why GcisConfigData present at 18:43 but absent at 19:04 (GSConfigurator state change, not GciPlugin bug).

---

Evidence

• strings / RTTI on services/GCIS/plugins/GciPlugin.dll
• logs/GCIS/GciPluginCurrent.log, GciPluginOld.log
• logs/GCIS/NvContainerGcis.log
• logs/GSP/GSConfiguratorPluginCurrent.log (GcisConfigData requests)
• services/gs2/mb-repeater.json