GCIS Plugin System

This page now owns the GCIS host and plugin-system reverse-engineering notes from the 2026-05-19 Asgard snapshot. Individual plugin pages live in this Plugins category rather than under /reverse-engineering/ duplicates.

2026-05-19 application notes

NvContainerGcis.exe

What this program actually does

NvContainerGcis.exe is the Windows service host for GCIS (Grid Cloud Init Security) on a GeForce NOW gameseat. It implements NVIDIA NvContainer v1.45, loads seven mandatory security plugins from services/GCIS/plugins/, and orchestrates their lifecycle: secure load → initialize → start → stop → unload. It does not implement seat security policy itself; it is the process supervisor that keeps all GCIS plugins running in one SYSTEM service (GCIS).

If any mandatory plugin fails during Starting, the container tears down all plugins and exits — observed exit code 14109 in this snapshot.

---

Architecture / control flow (recovered symbols)

main / ServiceHost
  └─ nvc::ServiceHost / NvcServiceHost
        └─ nvc::HostWin32 (dynamic plugin load/unload disabled on seat)
              └─ nvc::PluginManager
                    ├─ RegistryStorage (per-plugin config during load)
                    ├─ Secure plugin load (NvcPluginLoadHel)
                    └─ State machine: Unloaded → Initializing → Initialized → Starting → Started
                          │ fail (mandatory) → Stopping → Stopped → Uninitializing → Unloaded → container exit
                          └─ MessageQueue (plugin notifications)

RTTI classes (strings): ServiceHost, PluginConfig, RegistryStorage, MessageQueue, DirectoryListenerWin32, DefaultContainerConfig, HostWin32.

Export: NvPluginGetInfo is used by plugins, not this EXE. This EXE exports NvOptimusEnablement (Optimus-related; seat usage not verified).

Build path string: C:\dvs\p4\build\sw\gcomp\rel\src\NvContainer\...\NvContainer.pdb

---

External interfaces

Interface	Role
Windows Service GCIS	Installed/stopped via services/GCIS/Uninstall.bat (net stop GCIS, sc delete GCIS)
Plugin directory	%AG_HOME%\services\GCIS\plugins\ — loads ElmPlugin, GciPlugin, GcpPlugin, GssmPlugin, LkmPlugin, UadMLPlugin, UadPlugin
Registry	RegistryStorage created for each plugin load (config source not in workspace)
Logs	%AG_LOGS%\GCIS\NvContainerGcis.log
Message bus	Indirect — plugins use GSConfigClient; host forwards system messages to plugins
DACL adjustment	On start: Created new DACL with added privileges 0x00100000 for child process

No direct network/RPC surface in this binary — all external I/O is via loaded plugins.

---

Plugin lifecycle API (inferred from strings + logs)

Function / component	Behavior
NvcPluginManager::Load	Secure-load DLL, query NvPluginGetInfo, mark mandatory
Initiate transition to Initializing	Async plugin init; notification code 1 = success
Initiate transition to Starting	PluginStart task in each plugin
Notification 2 from plugin	Failure during Starting (observed for all GCIS plugins)
NvcPluginUnloadStats	Per-plugin stop/uninit timing telemetry
Base host: mandatory plugin %s has failed. Exit	Fatal path
AllowDynamicPluginLoad / AllowDynamicPluginUnload	Disabled on gameseat (Dynamic loading of plugins is disabled)

---

Runtime timeline (from logs/GCIS/NvContainerGcis.log)

Time (local)	Event
19:04:51.902	Container main v1.45, telemetry API init
19:04:51.906	Load plugins from C:\Asgard\services\GCIS\plugins
19:04:51.906–52.264	Secure-load all 7 mandatory plugins (versions 1.0.0.0 / 2.0.0.0)
19:04:52.264–52.882	All plugins reach Initialized (notification 1)
19:04:52.882	Container initialized; service reports Running
19:04:52.882	Parallel transition to Starting for all plugins
19:04:53.028–53.052	All mandatory plugins fail Starting (notification 2)
19:04:53.053–53.084	Unload/stop each plugin; Failed to complete transition to Started
19:04:53.084	Container exit; service Stopped, exit code 14109

Root cause (from plugin logs): each plugin’s PluginStart fetches GcisConfigData from GSConfigurator → OBJECT_NOT_FOUND → container abort.

---

Failure modes (error strings)

String	Meaning
Failed to load plugins. Exiting	Plugin directory load failure
Failed to complete transition to Started	One or more mandatory plugins failed Starting
Async state transition failure is detected for %s plugin	Plugin reported failure asynchronously
Base host: mandatory plugin %s has failed. Exit	Fatal mandatory plugin failure
Failed to initialize RegistryStorage with status	Registry config access failure
Plugin count exceeded maximum allowed %u	Too many plugins configured

---

Relationships

Component	Interaction
GCIS plugins (7 DLLs)	Loaded/managed by this host
NvContainerGSP.exe	Sibling container; hosts GSConfigurator (config authority)
GSConfiguratorPlugin	Plugins fetch GcisConfigData, ZoneConfig, SeatConfig via message bus
mb-repeater	Forwards GciPluginSysmon / ProcessEventMessage broadcasts
GciSch	Co-uninstalled with GCIS per Uninstall.bat

---

Not verified

• Exact GCIS acronym expansion.
• Service install registry keys / SCM configuration (not in workspace).
• Meaning of exit code 14109.
• Whether NvOptimusEnablement export is invoked on the gameseat.
• Container JSON/XML config file location (only RegistryStorage referenced in logs).

---

Evidence

• strings / objdump -p on services/GCIS/NvContainerGcis.exe
• logs/GCIS/NvContainerGcis.log, NvContainerGcis.log_backup1
• services/GCIS/Uninstall.bat
• Plugin logs under logs/GCIS/*Plugin*.log