Add container config export/import

[gigachadmma69]

Summary

Allows users to share and reuse container configurations by exporting/importing the settings JSON as a .wcc (Winlator Container Config) file.

Export

• New "Export Config" option in the container popup menu (between Duplicate and Remove)
• Saves to Downloads/Winlator/<container-name>.wcc
• Strips device-specific fields (id, cpuList, cpuListWoW64) that would be invalid on another device
• File is ~1KB and contains all tuning settings (graphics driver, DX wrapper, env vars, box86/64 preset, win components, etc.)

Import

• New import button in the containers toolbar (action bar)
• Opens the system file picker to select a .wcc file
• Creates a new container with the imported settings via the existing createContainerAsync(JSONObject) pipeline
• The pipeline automatically assigns a new ID, creates the directory, extracts the Wine container pattern, and applies all settings

Architecture

• Export reuses the existing .container JSON format — just reads, strips the ID, and writes
• Import reuses the existing createContainerAsync(JSONObject) — zero new container creation logic needed
• Follows the same file picker pattern used by InputControlsFragment for profile import

Test plan

• Open container popup menu → "Export Config" appears
• Export a container → .wcc file appears in Downloads/Winlator/
• Open .wcc file in a text editor → valid JSON with all container settings, no id field
• Tap import button → file picker opens
• Select the exported .wcc file → new container appears with matching settings
• Verify imported container's settings match the exported container

[Jeney6]

Please give me your email id

[Jeney6]

Really the emulator very flaut when I download batman game not perfectly work

[Jeney6]

Please improve make easy app configuration is very hard

[mabiruk]

I proposed the addition in #1998, but the config export/import might be another approach to solve it - whichever is the most suitable.

[BLaderStorm]

Hello. I tested Winlator 11.0 on a MediaTek Helio P35 device with a PowerVR GE8320 GPU and found some compatibility issues.

DXVK does not seem to work correctly. Direct3D tests only work when using WineD3D.

WineD3D works better than DXVK on my device.

Game launchers can open normally, but the actual 3D games do not start.

Amnesia: The Dark Descent launcher opens and detects the graphics driver, but the game itself never launches.

GTA San Andreas does not launch either.

Some games show a black screen before closing.

Direct3D test applications work with WineD3D, which suggests that rendering is partially functional.

Gladio is marked as experimental, and there may be compatibility issues with PowerVR GPUs.

My device is running Android 14. It is possible that PowerVR GPUs need additional testing and optimization, especially with Gladio and DXVK.

Thank you for your work on the project.

[7974346-netizen]

https://github.com/brunodev85/winlator/network

[7974346-netizen]

https://github.com/brunodev85/winlator/network

[Rehanasharmin]

Winlator Technical and Vulnerability Report

1. Technical Report

1.1 Overview

Winlator is an Android application designed to run Windows (x86 and x86_64) applications on Android devices using Wine and Box86/Box64. It provides a user-friendly interface to manage "containers" (Wine prefixes), configure hardware emulation, and launch Windows executables.

1.2 Architecture

The project follows a modular architecture:

• Frontend (Android): Written primarily in Java, managing the UI, container configurations, and the lifecycle of the emulation environment.
• Emulation Layer:
  • Wine: Provides the Windows API translation layer.
  • Box86/Box64: Provides the CPU instruction translation (x86/x86_64 to ARM).
• Graphics Subsystem: Implements a custom X Server in the Android environment to bridge Wine's X11 requirements with Android's Surface/OpenGL system.
• Audio Subsystem: Utilizes a custom ALSA (Advanced Linux Sound Architecture) server to route audio from Wine to the Android audio system.

1.3 Key Components

• com.winlator.core: Contains utility classes for process management (ProcessHelper), file operations (FileUtils), and installation logic (WineInstaller).
• com.winlator.xserver: Implements the X11 protocol handling.
• com.winlator.container: Manages Wine prefixes and their specific settings (resolution, environment variables, etc.).
• android_alsa: A native component providing audio support.

1.4 Process Management

Winlator uses java.lang.ProcessBuilder to launch native binaries (like Wine or Box64). It leverages reflection to access the underlying PID of the process for monitoring and signal handling (e.g., SIGSTOP, SIGCONT).

---

2. Vulnerability Report

2.1 Critical: Path Traversal (ZipSlip) in Archive Extraction

Location: com.winlator.core.TarCompressorUtils.extract
Description: The application extracts .tar.xz and .tar.zst archives using TarArchiveInputStream. It constructs the destination file path by directly concatenating the destination directory with the entry name from the archive:

File file = new File(destination, entry.getName());

Impact: An attacker who provides a malicious archive (e.g., as a custom Wine version or game update) could include entries with ../ in their names. This allows writing arbitrary files to any location the app has permission to access, potentially overwriting critical app files or executable binaries.

2.2 High: Potential Command Injection in ProcessHelper

Location: com.winlator.core.ProcessHelper.splitCommand and exec
Description: The splitCommand method uses custom logic to parse command-line strings into an array of arguments. If any part of the command string (such as a filename or a container name) is derived from user-controlled input without strict validation, an attacker could use special characters (quotes, spaces, etc.) to inject additional arguments or commands.
Impact: Arbitrary code execution within the context of the Winlator application.

2.3 Medium: Insecure Resource Downloading (MitM Risk)

Location: com.winlator.core.WineInstaller
Description: The installer facilitates the download and extraction of Wine versions and other components. While the repository provides the framework, the actual download links often point to external servers. The code lacks explicit integrity checks (like SHA-256 checksums or digital signature verification) for these downloaded resources before extraction and execution.
Impact: A Man-in-the-Middle (MitM) attacker could replace the legitimate Wine binaries with malicious ones, leading to a full compromise of the emulated environment and the host app.

2.4 Medium: Broad Storage Permissions

Location: AndroidManifest.xml
Description: The app requests READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE.
Impact: On older Android versions (pre-Scoped Storage), this gives the app broad access to the user's files. If the app is compromised via the vulnerabilities mentioned above, the attacker gains access to all user data on the external storage. On newer versions, the risk is mitigated but still present for shared directories.

2.5 Low: Information Leakage via /proc

Location: com.winlator.core.ProcessHelper.getChildProcesses
Description: The app iterates through /proc to find and monitor child processes.
Impact: While necessary for process management, if not strictly limited to its own UID, it could theoretically expose metadata about other processes running on the system, depending on the Android version's kernel security policies.

3. Recommendations

1. Fix ZipSlip: Implement validation in TarCompressorUtils.extract to ensure that the canonical path of the extracted file starts with the canonical path of the destination directory.
2. Sanitize Inputs: Ensure all inputs used in ProcessHelper.exec are strictly sanitized or use the String[] version of ProcessBuilder directly without relying on a custom string splitter for untrusted data.
3. Integrity Checks: Implement checksum verification for all downloaded components before they are installed or executed.
4. Principle of Least Privilege: Audit permissions and move towards more restrictive Android storage APIs where possible.

[BLaderStorm]

Winlator 11

Can start some games but with wrong colors.

I could start and play LEGO Harry Potter, but there are to much shader glitches

Amnesia The Dark Descent opens at all, but the actual game does not start and crashes

[bassamner001]

Bugs in winlator v11.1

MT5 EA connection drops specifically on order execution, not general instability.

Idle/price-tick traffic is solid. Every market order triggers a drop-reconnect, regardless of broker (tested 2, 269ms and 190ms ping - same result) or code (tested with a bare-minimum diagnostic EA, no logic - same result). Ruled out: battery optimization, background services (Normal vs Aggressive), Box64 preset (Stability vs Conservative).

Log pattern, same on both brokers:
Trades: order sent
Trades: FAILED [rejected due to absence of network connection]
Network: connection lost
Network: reconnects ~1s later

Rejection logs before "connection lost" - looks like the burst/handshake of an order-send trips something in the virtual net adapter that steady inbound tick traffic doesn't. Can share full logs/config if useful.

[Khanhlc8273]

Tôi không thể gõ văn bản trên winlator, giúp tôi sửa lỗi này