Function ProcessQueuedInjection

src/platform/win/cloud_intercept.cpp:1209–1361

Process a single queued injection (called on the network thread from RecvPktMonitorHook)

// Process a single queued injection (called on the network thread from RecvPktMonitorHook)
static void ProcessQueuedInjection(QueuedInjection* ctx) {
    LOG("[INJECT] Processing queued inject: %s (pkt=%u bytes, jobid=%llu)",
        ctx->methodName, ctx->pktSize, ctx->jobIdTarget);

    if (!g_wrapPacket || !g_bRouteMsgToJob || !g_releaseWrapped) {
        LOG("[INJECT] FATAL: BRouteMsgToJob bypass not resolved");
        VirtualFree(ctx->pktBuf, 0, MEM_RELEASE);
        free(ctx->pktStruct);
        delete ctx;
        return;
    }

    // WrapPacket takes ownership via refcount; caller frees on failure.
    void* wrappedPkt = nullptr;
    __try {
        wrappedPkt = g_wrapPacket(ctx->pktStruct, 1);
    } __except(EXCEPTION_EXECUTE_HANDLER) {
        LOG("[INJECT] EXCEPTION in WrapPacket: code=0x%08X", GetExceptionCode());
        VirtualFree(ctx->pktBuf, 0, MEM_RELEASE);
        free(ctx->pktStruct);
        delete ctx;
        return;
    }

    if (!wrappedPkt) {
        LOG("[INJECT] WrapPacket returned NULL -- packet validation failed");
        VirtualFree(ctx->pktBuf, 0, MEM_RELEASE);
        free(ctx->pktStruct);
        delete ctx;
        return;
    }

    // SEH-wrap vtable + slot reads on the Steam-internal wrapped packet.
    using GetEMsgFn = unsigned int(__fastcall*)(void* self);
    unsigned int wrappedEmsg = 0;
    __try {
        uintptr_t wrappedVtable = *(uintptr_t*)wrappedPkt;
        GetEMsgFn getEMsg = (GetEMsgFn)(*(uintptr_t*)(wrappedVtable + 0x40));
        wrappedEmsg = getEMsg(wrappedPkt);
        LOG("[INJECT]   wrappedPkt=%p GetEMsg()=%u (expected %u)",
            wrappedPkt, wrappedEmsg, (unsigned)EMSG_SERVICE_METHOD_RESP);
    } __except(EXCEPTION_EXECUTE_HANDLER) {
        LOG("[INJECT]   EXCEPTION in GetEMsg: code=0x%08X", GetExceptionCode());
        __try { g_releaseWrapped(wrappedPkt); } __except(EXCEPTION_EXECUTE_HANDLER) {}
        VirtualFree(ctx->pktBuf, 0, MEM_RELEASE);
        delete ctx;
        return;
    }

    // Get CJobMgr and connection context (SEH-protected like FindCCMInterface)
    void* jobMgr = nullptr;
    void* connCtx = nullptr;
    __try {
        uintptr_t* pEngineGlobal = (uintptr_t*)SC_RESOLVE(globalEngine);
        uintptr_t engine = *pEngineGlobal;
        jobMgr = (void*)(engine + ENGINE_OFF_JOBMGR);
        connCtx = *(void**)((uintptr_t)g_cmInterface.load(std::memory_order_acquire) + CCM_OFF_CONN_CONTEXT);
    } __except(EXCEPTION_EXECUTE_HANDLER) {