Asgard Services Deep-Dive Catalog

This page organizes the latest C:\Asgard\services snapshot into clean categories so the stack is easy to understand, audit, and maintain.

Snapshot basis used for this catalog:

• Package path: C:\Users\Zortos\Downloads\asgard\services
• Date context in docs: February 22, 2026 snapshot
• Binary and config string extraction from shipped executables, plugins, .inf, .man, and .bat scripts

Category Map (Sorted)

Category	Components	Primary Binaries	Purpose	Current Status
1. Orchestration & Session Control	gs2, morph	gs2-agent.exe, mb-repeater.exe, dummy-svc.exe, morph.exe	Seat/session state machine and transition handling	Primary path
2. Configuration & Policy Plane	GSP, GCIS	NvContainerGsp.exe, GSConfiguratorPlugin.dll, NvContainerGcis.exe, GCIS plugins	Runtime config resolution, policy, service messaging	Primary path
3. Security & Enforcement	masquerade, GCIS	nvmsqrdsvc.exe, nvguardsvc.exe, msq.exe, gfnmon.dll, GciPlugin.dll, GssmPlugin.dll	Kernel/user-mode protection and policy enforcement	Primary path
4. Capture, Telemetry & Diagnostics	NDC, StutterShark	NvContainerNdc.exe, PipsController.exe, _NdcPlugin.dll, StutterShark.exe	Network capture, telemetry pipelines, stutter/deadzone diagnostics	Expanded/newer
5. Lifecycle, Packaging & Recovery	SeatUpdater, AutoOnboarder, NvRollbackWrapper	install_seat_packages.py runners, fpgen.exe, NvRollbackWrapper.exe	Package update/install, baseline restore, rollback support	Active + compatibility hooks
6. Logging & Environment Bootstrap	nxlog-agent, CommonEnvironment	config_nxlog.bat, ag_env.bat, common_env_on_boot.bat	Environment setup and centralized log shipping	Active
7. Compatibility & Transition Surface	cross-cutting	dummy-svc.exe, LegacyPipeApi paths, pre_session_software_updater.bat	Legacy bridge while migrating off old stack	Transitional (important)

App Inventory (By Service Folder)

Folder	Key App/Plugin Artifacts	Notes
gs2	gs2-agent.exe, mb-repeater.exe, dummy-svc.exe	gRPC + MessageBus bridge; contains explicit legacy bridge symbols
morph	morph.exe	Transition coordinator with morph lifecycle events
GCIS	NvContainerGcis.exe, Elm/Gci/Gcp/Gssm/Lkm/Uad/UadML plugins	Security/session plugin host
GSP	NvContainerGsp.exe, GSConfiguratorPlugin.dll, messagebus.conf	Config and policy service hub
masquerade	msq.exe, msqrun.exe, nvguardsvc.exe, nvmsqrdsvc.exe, *.inf, gfnmon.dll	Driver/filter orchestration and enforcement runtime
NDC	NvContainerNdc.exe, PipsController.exe, _NdcPlugin.dll	Network capture orchestration with API + telemetry
StutterShark	StutterShark.exe, StutterSharkTest.exe	Realtime stutter/deadzone analysis and tuning support
SeatUpdater	pre/post session updater/log scripts	Startup/shutdown package flow and log merge
AutoOnboarder	dummy.exe, fpgen.exe, ctmt-plugin.dll	Baseline/state restore + content lifecycle workflows
nxlog-agent	deploy/config_nxlog.bat	Syslog/log upload bootstrap
CommonEnvironment	ag_env.bat, common_env_on_boot.bat	AG env bootstrap and core startup environment
NvRollbackWrapper	NvRollbackWrapper.exe	Recovery helper for rollback path

1) Orchestration & Session Control

GS2 stack (gs2-agent, mb-repeater, dummy-svc)

Observed behavior:

• Strong gRPC and stream handling surface in gs2-agent / mb-repeater.
• dummy-svc.exe embeds explicit migration hooks:
  • initToLegacy
  • initFromLegacy
  • IsLegacyRequired
  • MarkDeprecated
• Embedded source path references point to gameseat2 message-bus code paths.

Operational meaning:

• GS2 is the active orchestration plane.
• Legacy paths are intentionally retained to keep older integrations alive during migration.

Morph service (morph.exe)

Observed behavior:

• Self-description: Coordinates seat infrastructure transitions
• Service name marker: Gameseat Morph Service (NTS)
• Emits lifecycle telemetry/events:
  • SendMorphInitializedEvent
  • SendMorphCompletedEvent

Operational meaning:

• Morph is the transition controller between seat states and should be treated as a core orchestrator in the modern stack.

2) Configuration & Policy Plane

GSP + GSConfigurator

Core artifacts:

• NvContainerGsp.exe
• GSConfiguratorPlugin.dll
• plugins/messagebus.conf

Observed behavior:

• Config API supports read/update/add/delete operations for root/service configuration.
• Includes fail-safe config path handling:
  • %AG_HOME%\services\GSP\failsafe_config.txt
• Session-aware config mutation guardrails:
  • OP_DENIED_SESSION_ACTIVATED
  • immutable-config protections.

MessageBus peer policy (very high-value)

messagebus.conf exposes cross-session ACL relationships, including:

• SSAU modules to SSAS modules
• GCIS peers for UadMLPlugin and UadPlugin
• telemetry/control peers (for example Traceroute, GPUViewTraceControl)
• AllowedUsers set to S-1-5-18 (LocalSystem) for privileged cross-session channels

Operational meaning:

• This file is effectively a live trust graph for inter-module communication.

3) Security & Enforcement

Masquerade driver/filter stack

Core artifacts:

• User-mode services: nvmsqrdsvc.exe, nvguardsvc.exe
• Helpers: msq.exe, msqrun.exe
• Drivers/configs: nvmsqrd.inf, nvgfnmon.inf, nvfoxhnd.inf, nvguard.inf

Driver load and registration process (install_driver.bat):

• unload/load filter drivers using fltmc
• install INF packages with InfDefaultInstall.exe
• register/unregister perf counters via lodctr/unlodctr

Key altitudes and filter groups from INF files:

• nvfoxhnd altitude 383000 (FSFilter Activity Monitor)
• nvgfnmon altitude 384000 (FSFilter Activity Monitor)
• nvguard altitude 385000 (FSFilter Activity Monitor)
• nvmsqrd altitude 189861 (FSFilter HSM, demand-start)

Operational meaning:

• This is a layered filesystem monitoring/enforcement stack with explicit ordering.

GCIS plugin enforcement plane

GCIS host:

• NvContainerGcis.exe

Plugin set in this snapshot:

• ElmPlugin.dll
• GciPlugin.dll
• GcpPlugin.dll
• GssmPlugin.dll
• LkmPlugin.dll
• UadMLPlugin.dll (+ UadMLPlugin.dat)
• UadPlugin.dll (legacy compatibility)

See /plugins/overview and per-plugin pages for full internals.

4) Capture, Telemetry & Diagnostics

NDC

Core artifacts:

• NvContainerNdc.exe
• PipsController.exe
• _NdcPlugin.dll

Observed capabilities from _NdcPlugin.dll:

• Network capture API (NdcServiceAPI)
• explicit start/stop actions (NdcStartCapture, NdcFinishCapture)
• condition-based capture scheduling
• two capture modes:
  • NETWORK_CAPTURE
  • GENERIC_CAPTURE (command-driven)
• telemetry integration with Gameseat telemetry connector/service

StutterShark

Core artifacts:

• StutterShark.exe
• StutterSharkTest.exe

Observed capabilities:

• realtime stutter/deadzone monitoring
• trace sessions and offline symbol/module resolution
• telemetry output (StutterSharkTelemetry)
• controller plugins (GPU/CPU tuning hooks in binary strings)

5) Lifecycle, Packaging & Recovery

SeatUpdater scripts

Key scripts:

• pre_session_update_check.bat
• pre_session_software_updater.bat
• post_session_software_updater.bat
• post_session_backuplog.bat

Observed behavior:

• runs package installer in startup/shutdown phases
• checks/reports update-required states
• merges and trims GameStream logs post-session
• legacy compatibility call remains:
  • net start nvgridsvc in pre-session updater

AutoOnboarder + NvRollbackWrapper

• AutoOnboarder remains the baseline restore/content workflow engine
• NvRollbackWrapper.exe provides rollback path support

6) Logging & Environment Bootstrap

CommonEnvironment

• ag_env.bat
• common_env_on_boot.bat

Role:

• sets core Asgard environment assumptions during startup.

nxlog-agent

• deploy/config_nxlog.bat

Role:

• bootstraps centralized log shipping configuration.

7) Compatibility & Transition Surface

Compatibility indicators that should remain documented:

• GS2 binaries still include legacy bridge symbols.
• GCIS/LKM stack still exposes LegacyPipeApi surfaces.
• SeatUpdater still references nvgridsvc startup.

These are strong signs of staged migration rather than a hard cutover.

Suggested Reading Order

1. /services/overview
2. /services/service-catalog (this page)
3. /services/apps/gs2
4. /services/apps/morph
5. /services/apps/ndc-gsp
6. /plugins/overview
7. /error-codes/crosswalk