Perf(screen): skip encode on identical frames to cut HW encoder idle bandwidth

Feature: Implement H.264 and AV1 hardware encoding for remote control
Remark: Need to update FFmpeg static libraries to take effort
2026-05-30 00:12:47 +02:00 · 2026-05-30 00:12:38 +02:00 · 2026-05-28 23:50:56 +02:00 · 2026-05-27 18:58:29 +02:00 · 2026-05-27 15:28:56 +02:00 · 2026-05-27 08:55:14 +02:00
64 changed files with 3717 additions and 10587 deletions
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,6 +1,10 @@
 # Auto detect text files and perform LF normalization
 * text=auto

+# Shell scripts must keep LF line endings even when checked out on Windows,
+# otherwise Linux refuses them with "bad interpreter: /usr/bin/env^M".
+*.sh text eol=lf
+
 # Custom for Visual Studio
 *.cs     diff=csharp

--- a/.gitignore
+++ b/.gitignore
@@ -81,6 +81,7 @@ Releases/*
 linux/Makefile
 linux/cmake_install.cmake
 .vs
+client/ghost_vs2015.vcxproj.user
 docs/macOS_Support_Design.md
 settings.local.json
 *.zip
--- a/Dependencies.md
+++ b/Dependencies.md
@@ -12,6 +12,12 @@
 - [opus-1.6.1](https://opus-codec.org/release/stable/2026/01/14/libopus-1_6_1.html)
 - [libpeconv c7d1e48](https://github.com/hasherezade/libpeconv)

+## execution
+
+- [MemoryModule](https://github.com/fancycode/MemoryModule.git)
+- [sRDI](https://github.com/Drewsif/sRDI.git)
+- [pe_to_shellcode](https://github.com/hasherezade/pe_to_shellcode.git)
+
 ## *Note*

 The proper operation of the program depends on the above library files. 
--- a/LICENSE-THIRD-PARTY.txt
+++ b/LICENSE-THIRD-PARTY.txt
@@ -0,0 +1,279 @@
+THIRD-PARTY SOFTWARE NOTICES AND LICENSES
+
+This document contains intellectual property notices and license information for 
+third-party software components used in this product.
+
+================================================================================
+SUMMARY OF LICENSE TYPES
+================================================================================
+The third-party components included in this software are governed by the following 
+open-source licenses. For complete compliance, ensure that any modifications to 
+LGPL and MPL covered components are made available under their respective terms, 
+and this text file is distributed with your software product.
+
+1. Zlib License
+   - zlib v1.3.2
+2. BSD 3-Clause License
+   - zstd v1.5.7
+   - libyuv v190
+   - jpeg (libjpeg-turbo) v3.1.1
+   - opus-1.6.1
+3. BSD 2-Clause License
+   - libpeconv c7d1e48
+   - pe_to_shellcode
+4. MIT License
+   - jsoncpp v1.9.6
+   - sRDI
+5. GNU Lesser General Public License v2.1 (LGPL v2.1)
+   - ffmpeg v7.1 (Compiled in shared, non-GPL mode)
+6. Mozilla Public License v2.0 (MPL 2.0)
+   - MemoryModule
+
+================================================================================
+1. zlib v1.3.2 (Zlib License)
+================================================================================
+Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler
+
+This software is provided 'as-is', without any express or implied
+warranty.  In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.
+
+================================================================================
+2. zstd v1.5.7 (BSD 3-Clause License)
+================================================================================
+Copyright (c) 2016-present, Facebook, Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+ * Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+ * Neither the name Facebook nor the names of its contributors may be used to
+   endorse or promote products derived from this software without specific
+   prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+================================================================================
+3. libyuv v190 (BSD 3-Clause License)
+================================================================================
+Copyright 2011 The LibYuv Project Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+ * Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+ * Neither the name of Google nor the names of its contributors may be used to
+   endorse or promote products derived from this software without specific
+   prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+================================================================================
+4. jpeg (libjpeg-turbo) v3.1.1 (BSD 3-Clause / IJG License)
+================================================================================
+Copyright (C) 2009-2024 D. R. Commander. All Rights Reserved.
+Copyright (C) 2015 Viktor Szathmáry. All Rights Reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+- Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+- Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+- Neither the name of the libjpeg-turbo Project nor the names of its
+  contributors may be used to endorse or promote products derived from this
+  software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+================================================================================
+5. opus-1.6.1 (BSD 3-Clause License)
+================================================================================
+Copyright 2001-2011 Xiph.Org, Skype Limited, Octasic,
+                   Jean-Marc Valin, Timothy B. Terriberry,
+                   CSIRO, Gregory Maxwell, Mark Borgerding,
+                   Erik de Castro Lopo
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+- Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+
+- Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+- Neither the name of the Xiph.Org Foundation nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION
+OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+================================================================================
+6. libpeconv c7d1e48 & pe_to_shellcode (BSD 2-Clause License)
+================================================================================
+Copyright (c) 2020, hasherezade
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+================================================================================
+7. jsoncpp v1.9.6 (MIT License)
+================================================================================
+Copyright (c) 2007-2010 The JsonCpp Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+================================================================================
+8. sRDI (MIT License)
+================================================================================
+Copyright (c) 2017 Drewsif
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+================================================================================
+9. ffmpeg v7.1 (GNU Lesser General Public License v2.1)
+================================================================================
+This software uses libraries from the FFmpeg project (v7.1), licensed under the 
+GNU Lesser General Public License (LGPL) version 2.1.
+FFmpeg is a trademark of Fabrice Bellard, originator of the FFmpeg project.
+
+Our product links to FFmpeg dynamically as a shared library (.dll/.so/.dylib) 
+and does NOT enable any GPL-licensed plugins (such as x264).
+
+The source code of FFmpeg v7.1 can be obtained from the official FFmpeg 
+website (https://ffmpeg.org). If you require the exact build script and build 
+configuration used by our product to build the FFmpeg binary, please contact 
+our open-source compliance team.
+
+================================================================================
+10. MemoryModule (Mozilla Public License v2.0)
+================================================================================
+This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. 
+If a copy of the MPL was not distributed with this file, You can obtain one at 
+http://mozilla.org/MPL/2.0/.
+
+MemoryModule is Copyright (c) Joachim Bauch.
+
+Under the terms of the MPL 2.0, you may distribute this component as part of 
+your commercial/proprietary application without being required to open-source 
+your own proprietary code, provided that:
+1. MemoryModule source files remain unmodified, or if modified, those modifications 
+   are made available under the MPL 2.0.
+2. Users are informed that MemoryModule is used and where they can find its source.
--- a/ReadMe.md
+++ b/ReadMe.md
@@ -9,8 +9,8 @@
  <a href="https://github.com/yuanyuanxiang/SimpleRemoter/network/members">
    <img src="https://img.shields.io/github/forks/yuanyuanxiang/SimpleRemoter?style=flat-square&logo=github" alt="GitHub Forks">
  </a>
-  <a href="https://github.com/yuanyuanxiang/SimpleRemoter/releases">
-    <img src="https://img.shields.io/github/v/release/yuanyuanxiang/SimpleRemoter?style=flat-square" alt="GitHub Release">
+  <a href="https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases">
+    <img src="https://img.shields.io/gitea/v/release/yuanyuanxiang/SimpleRemoter?gitea_url=https%3A%2F%2Fgit.simpleremoter.com&style=flat-square&logo=gitea" alt="Gitea Release">
  </a>
  <img src="https://img.shields.io/badge/client-Windows%20%7C%20Linux%20%7C%20macOS-blue?style=flat-square" alt="Client Platforms">
  <img src="https://img.shields.io/badge/server-Windows%20%7C%20Linux%20%7C%20macOS-success?style=flat-square" alt="Server Platforms">
@@ -19,8 +19,8 @@
 </p>

 <p align="center">
-  <a href="https://github.com/yuanyuanxiang/SimpleRemoter/releases/latest">
-    <img src="https://img.shields.io/badge/Download-最新版本-2ea44f?style=for-the-badge&logo=github" alt="Download Latest">
+  <a href="https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases/latest">
+    <img src="https://img.shields.io/badge/Download-最新版本-2ea44f?style=for-the-badge&logo=gitea" alt="Download Latest">
  </a>
 </p>

@@ -291,7 +291,7 @@

 无需编译，下载即用：

-1. **下载发布版** - 从 [Releases](https://github.com/yuanyuanxiang/SimpleRemoter/releases/latest) 下载最新版本
+1. **下载发布版** - 从 [Releases](https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases/latest) 下载最新版本
 2. **启动主控** - 运行 `YAMA.exe`（或 Linux 上的 `server_linux_amd64`），输入授权信息
 3. **生成客户端** - 工具栏「生成」配置服务器 IP 和端口
 4. **部署客户端** - 复制到目标机器运行
--- a/ReadMe_EN.md
+++ b/ReadMe_EN.md
@@ -9,8 +9,8 @@
  <a href="https://github.com/yuanyuanxiang/SimpleRemoter/network/members">
    <img src="https://img.shields.io/github/forks/yuanyuanxiang/SimpleRemoter?style=flat-square&logo=github" alt="GitHub Forks">
  </a>
-  <a href="https://github.com/yuanyuanxiang/SimpleRemoter/releases">
-    <img src="https://img.shields.io/github/v/release/yuanyuanxiang/SimpleRemoter?style=flat-square" alt="GitHub Release">
+  <a href="https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases">
+    <img src="https://img.shields.io/gitea/v/release/yuanyuanxiang/SimpleRemoter?gitea_url=https%3A%2F%2Fgit.simpleremoter.com&style=flat-square&logo=gitea" alt="Gitea Release">
  </a>
  <img src="https://img.shields.io/badge/client-Windows%20%7C%20Linux%20%7C%20macOS-blue?style=flat-square" alt="Client Platforms">
  <img src="https://img.shields.io/badge/server-Windows%20%7C%20Linux%20%7C%20macOS-success?style=flat-square" alt="Server Platforms">
@@ -19,8 +19,8 @@
 </p>

 <p align="center">
-  <a href="https://github.com/yuanyuanxiang/SimpleRemoter/releases/latest">
-    <img src="https://img.shields.io/badge/Download-Latest%20Release-2ea44f?style=for-the-badge&logo=github" alt="Download Latest">
+  <a href="https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases/latest">
+    <img src="https://img.shields.io/badge/Download-Latest%20Release-2ea44f?style=for-the-badge&logo=gitea" alt="Download Latest">
  </a>
 </p>

@@ -291,7 +291,7 @@ Full description: [Multi-Layer License](./docs/MultiLayerLicense.md)

 No compilation required — download and run:

-1. **Download a release** — grab the latest build from [Releases](https://github.com/yuanyuanxiang/SimpleRemoter/releases/latest)
+1. **Download a release** — grab the latest build from [Releases](https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases/latest)
 2. **Start the master** — run `YAMA.exe` (or `server_linux_amd64` on Linux), enter the license info
 3. **Generate a client** — click *Build* in the toolbar, configure server IP / port
 4. **Deploy the client** — copy to the target machine and run it
--- a/ReadMe_TW.md
+++ b/ReadMe_TW.md
@@ -9,8 +9,8 @@
  <a href="https://github.com/yuanyuanxiang/SimpleRemoter/network/members">
    <img src="https://img.shields.io/github/forks/yuanyuanxiang/SimpleRemoter?style=flat-square&logo=github" alt="GitHub Forks">
  </a>
-  <a href="https://github.com/yuanyuanxiang/SimpleRemoter/releases">
-    <img src="https://img.shields.io/github/v/release/yuanyuanxiang/SimpleRemoter?style=flat-square" alt="GitHub Release">
+  <a href="https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases">
+    <img src="https://img.shields.io/gitea/v/release/yuanyuanxiang/SimpleRemoter?gitea_url=https%3A%2F%2Fgit.simpleremoter.com&style=flat-square&logo=gitea" alt="Gitea Release">
  </a>
  <img src="https://img.shields.io/badge/client-Windows%20%7C%20Linux%20%7C%20macOS-blue?style=flat-square" alt="Client Platforms">
  <img src="https://img.shields.io/badge/server-Windows%20%7C%20Linux%20%7C%20macOS-success?style=flat-square" alt="Server Platforms">
@@ -19,8 +19,8 @@
 </p>

 <p align="center">
-  <a href="https://github.com/yuanyuanxiang/SimpleRemoter/releases/latest">
-    <img src="https://img.shields.io/badge/Download-最新版本-2ea44f?style=for-the-badge&logo=github" alt="Download Latest">
+  <a href="https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases/latest">
+    <img src="https://img.shields.io/badge/Download-最新版本-2ea44f?style=for-the-badge&logo=gitea" alt="Download Latest">
  </a>
 </p>

@@ -291,7 +291,7 @@

 無需編譯，下載即用：

-1. **下載發行版** - 從 [Releases](https://github.com/yuanyuanxiang/SimpleRemoter/releases/latest) 下載最新版本
+1. **下載發行版** - 從 [Releases](https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases/latest) 下載最新版本
 2. **啟動主控** - 執行 `YAMA.exe`（或 Linux 上的 `server_linux_amd64`），輸入授權資訊
 3. **生成用戶端** - 工具列「生成」設定伺服器 IP 和埠
 4. **部署用戶端** - 複製到目標機器執行
--- a/build.cmd
+++ b/build.cmd
@@ -1,6 +1,8 @@
@echo off
 :: SimpleRemoter Quick Build Script
-:: Usage: build.cmd [release|debug] [x64|x86|all] [server|clean|publish]
+:: Usage: build.cmd [release|debug] [x64|x86|all] [server|clean|publish|go-server]
+::   go-server          Build Go fallback server only -> Bin\YamaGo_x64.exe
+::   go-server publish  Same, plus UPX --best compression

 setlocal enabledelayedexpansion

@@ -18,6 +20,7 @@ if /i "%~1"=="all" (set PLATFORM=all& shift& goto :parse_args)
 if /i "%~1"=="server" (set EXTRA_ARGS=!EXTRA_ARGS! -ServerOnly& shift& goto :parse_args)
 if /i "%~1"=="clean" (set EXTRA_ARGS=!EXTRA_ARGS! -Clean& shift& goto :parse_args)
 if /i "%~1"=="publish" (set EXTRA_ARGS=!EXTRA_ARGS! -Publish& shift& goto :parse_args)
+if /i "%~1"=="go-server" (set EXTRA_ARGS=!EXTRA_ARGS! -GoServer& shift& goto :parse_args)
 echo Unknown argument: %~1
 shift
 goto :parse_args
--- a/build.ps1
+++ b/build.ps1
@@ -15,11 +15,110 @@ param(

    [switch]$ServerOnly,  # Only build main server (Yama), skip client projects
    [switch]$Clean,       # Clean before build
-    [switch]$Publish      # Publish mode: rebuild all deps + x64 Release + UPX compress
+    [switch]$Publish,     # Publish mode: rebuild all deps + x64 Release + UPX compress
+    [switch]$GoServer     # Build Go fallback server (server/go) -> Bin/YamaGo_x64.exe
 )

 $ErrorActionPreference = "Stop"

+$rootDir = $PSScriptRoot
+$binDir = Join-Path $rootDir "Bin"
+$upxPath = Join-Path $rootDir "server\2015Remote\res\3rd\upx.exe"
+
+# Build Go fallback server. No-op (with warning) if Go compiler is not installed.
+# When -Compress is set, run UPX --best on the output (mirrors C++ publish flow).
+function Build-GoServer {
+    param(
+        [string]$Configuration,
+        [switch]$Compress
+    )
+
+    Write-Host ""
+    Write-Host "Building Go server (server/go)..." -ForegroundColor Magenta
+
+    $goCmd = Get-Command go -ErrorAction SilentlyContinue
+    if (-not $goCmd) {
+        Write-Host "WARNING: Go compiler not found in PATH. Skipping Go server build." -ForegroundColor Yellow
+        Write-Host "  Install from https://go.dev/dl/ and ensure 'go' is in PATH." -ForegroundColor DarkGray
+        return $false
+    }
+
+    Write-Host "Using Go: $($goCmd.Source)" -ForegroundColor Cyan
+
+    $goDir = Join-Path $rootDir "server\go"
+    if (-not (Test-Path $goDir)) {
+        Write-Host "ERROR: Go source directory not found at $goDir" -ForegroundColor Red
+        return $false
+    }
+
+    # Sync web assets (mirrors Makefile `sync` target — single source is server/web/index.html)
+    $webSrc = Join-Path $rootDir "server\web\index.html"
+    $webDstDir = Join-Path $goDir "web\assets"
+    if (Test-Path $webSrc) {
+        if (-not (Test-Path $webDstDir)) { New-Item -ItemType Directory -Path $webDstDir -Force | Out-Null }
+        Copy-Item -Path $webSrc -Destination (Join-Path $webDstDir "index.html") -Force
+    }
+
+    if (-not (Test-Path $binDir)) { New-Item -ItemType Directory -Path $binDir -Force | Out-Null }
+
+    $outFile = Join-Path $binDir "YamaGo_x64.exe"
+    # Release strips debug info for smaller binary; Debug keeps symbols.
+    $ldflags = if ($Configuration -eq "Debug") { "" } else { "-s -w" }
+
+    Push-Location $goDir
+    try {
+        $env:GOOS = "windows"
+        $env:GOARCH = "amd64"
+        if ($ldflags) {
+            & go build -ldflags $ldflags -o $outFile ./cmd
+        } else {
+            & go build -o $outFile ./cmd
+        }
+        $code = $LASTEXITCODE
+    } finally {
+        Pop-Location
+    }
+
+    if ($code -ne 0) {
+        Write-Host "ERROR: Go build failed (exit $code)" -ForegroundColor Red
+        return $false
+    }
+
+    $size = (Get-Item $outFile).Length / 1MB
+    Write-Host "OK: $outFile ($($size.ToString('F2')) MB)" -ForegroundColor Green
+
+    # In-place UPX compression. Failure is a warning, not an error — the
+    # uncompressed binary is still usable, and UPX occasionally refuses on
+    # certain PE sections.
+    if ($Compress) {
+        Write-Host ""
+        Write-Host "UPX compressing Go server..." -ForegroundColor Magenta
+        if (-not (Test-Path $upxPath)) {
+            Write-Host "WARNING: UPX not found at $upxPath — skipping compression" -ForegroundColor Yellow
+        } else {
+            $sizeBefore = (Get-Item $outFile).Length / 1MB
+            Write-Host "  Before: $($sizeBefore.ToString('F2')) MB" -ForegroundColor DarkGray
+            & $upxPath --best $outFile
+            if ($LASTEXITCODE -ne 0) {
+                Write-Host "WARNING: UPX compression failed, uncompressed binary kept" -ForegroundColor Yellow
+            } else {
+                $sizeAfter = (Get-Item $outFile).Length / 1MB
+                $ratio = (1 - $sizeAfter / $sizeBefore) * 100
+                Write-Host "  After:  $($sizeAfter.ToString('F2')) MB (-$($ratio.ToString('F1'))%)" -ForegroundColor Green
+            }
+        }
+    }
+    return $true
+}
+
+# Go-only fast path: skip MSBuild entirely. -Publish here means "compress the
+# Go binary too" (not the full C++ publish flow).
+if ($GoServer) {
+    $ok = Build-GoServer -Configuration $Config -Compress:$Publish
+    if (-not $ok) { exit 1 }
+    exit 0
+}
+
 # Find MSBuild (VS2019 or VS2022, including Insiders/Preview)
 # Order: Prefer installations with v142 toolset (VS2019) over VS2022 BuildTools
 $msBuildPaths = @(
@@ -72,9 +171,7 @@ elseif ($msBuild -match "\\18\\") { $vsYear = "2019 Insiders" }

 Write-Host "Using MSBuild: $msBuild" -ForegroundColor Cyan

-$rootDir = $PSScriptRoot
 $slnFile = Join-Path $rootDir "YAMA.sln"
-$upxPath = Join-Path $rootDir "server\2015Remote\res\3rd\upx.exe"

 # Publish mode overrides
 if ($Publish) {
--- a/client/CFFmpegAV1Encoder.cpp
+++ b/client/CFFmpegAV1Encoder.cpp
@@ -0,0 +1,243 @@
+#include "CFFmpegAV1Encoder.h"
+#include "common/config.h"
+#include "common/logger.h"
+
+// 合规守护：DISABLE_FFMPEG_FOR_TEST=1 时整个实现移出编译单元（FFmpeg lib 已在
+// CFFmpegH264Encoder.cpp 用同条件链接，此处不重复 #pragma comment）
+#if defined(_WIN64) && !DISABLE_FFMPEG_FOR_TEST
+
+extern "C" {
+#include <libavcodec/avcodec.h>
+#include <libavutil/opt.h>
+#include <libavutil/imgutils.h>
+#include <libyuv/libyuv.h>
+}
+
+#include <string.h>
+
+// FFmpeg / 系统库已经由 CFFmpegH264Encoder.cpp 的 #pragma comment(lib) 引入。
+// 这里不再重复声明（重复 #pragma comment 在同一 link 单元不冲突但冗余）。
+
+// av_opt_set 包装：拼错的参数值会被 FFmpeg 静默忽略，包一层日志便于发现。
+// 实现与 CFFmpegH264Encoder 内的 helper 相同；放成 static 文件内可见即可。
+static void setOpt(void* obj, const char* name, const char* val, const char* backend) {
+    int rc = av_opt_set(obj, name, val, 0);
+    if (rc < 0) {
+        char errbuf[128] = {0};
+        av_strerror(rc, errbuf, sizeof(errbuf));
+        Mprintf("[WARN] av_opt_set('%s'='%s') on %s failed (%d): %s\n",
+                name, val, backend, rc, errbuf);
+    }
+}
+static void setOptInt(void* obj, const char* name, int64_t val, const char* backend) {
+    int rc = av_opt_set_int(obj, name, val, 0);
+    if (rc < 0) {
+        char errbuf[128] = {0};
+        av_strerror(rc, errbuf, sizeof(errbuf));
+        Mprintf("[WARN] av_opt_set_int('%s'=%lld) on %s failed (%d): %s\n",
+                name, (long long)val, backend, rc, errbuf);
+    }
+}
+
+// AV1 硬编后端探测顺序，没有 av1_mf 兜底（FFmpeg 7.1 不支持）。
+// 全失败时 EncoderFactory 自动回退到 H.264 路径，行为对称。
+static const char* kAV1Backends[] = {
+    "av1_nvenc",    // NVIDIA RTX 40 / 50 系（Ada Lovelace+）
+    "av1_amf",      // AMD RX 7000+（RDNA 3+）
+    "av1_qsv",      // Intel Arc 独显 / 部分 11 代+ 核显
+};
+
+CFFmpegAV1Encoder::CFFmpegAV1Encoder() = default;
+
+CFFmpegAV1Encoder::~CFFmpegAV1Encoder() {
+    close();
+}
+
+void CFFmpegAV1Encoder::cleanupCodec() {
+    if (m_packet) { av_packet_free(&m_packet); m_packet = nullptr; }
+    if (m_frame)  { av_frame_free(&m_frame);   m_frame  = nullptr; }
+    if (m_ctx)    { avcodec_free_context(&m_ctx); m_ctx = nullptr; }
+}
+
+void CFFmpegAV1Encoder::close() {
+    cleanupCodec();
+    m_backend.clear();
+    m_pts = 0;
+    m_forceIDR = false;
+}
+
+bool CFFmpegAV1Encoder::open(const EncoderParams& params) {
+    close();
+    for (const char* name : kAV1Backends) {
+        if (tryOpenBackend(name, params)) {
+            m_backend = name;
+            return true;
+        }
+        cleanupCodec();
+    }
+    return false;
+}
+
+bool CFFmpegAV1Encoder::tryOpenBackend(const char* name, const EncoderParams& p) {
+    const AVCodec* codec = avcodec_find_encoder_by_name(name);
+    if (!codec) {
+        // AV1 硬编没注册 = 老 ffmpeg lib 不含 AV1 encoder（compress\ffmpeg 没启用 av1）
+        Mprintf("=> FFmpeg: AV1 encoder '%s' NOT in linked lib\n", name);
+        return false;
+    }
+
+    m_ctx = avcodec_alloc_context3(codec);
+    if (!m_ctx) {
+        Mprintf("=> FFmpeg: avcodec_alloc_context3('%s') failed\n", name);
+        return false;
+    }
+
+    m_ctx->width        = p.width  & ~1;
+    m_ctx->height       = p.height & ~1;
+    m_ctx->time_base    = AVRational{1, p.fps};
+    m_ctx->framerate    = AVRational{p.fps, 1};
+    m_ctx->pix_fmt      = AV_PIX_FMT_NV12;
+    m_ctx->gop_size     = p.fps * (p.gop_seconds > 0 ? p.gop_seconds : 15);
+    m_ctx->max_b_frames = 0;
+    m_ctx->bit_rate     = (int64_t)p.bitrate_kbps * 1000;
+    m_ctx->rc_max_rate  = (int64_t)p.bitrate_kbps * 1500;
+    m_ctx->rc_buffer_size = (int)(p.bitrate_kbps * 1000);
+
+    // RC 策略与 H.264 路径对齐：peak-constrained VBR，远控静态画面省带宽。
+    if (strcmp(name, "av1_nvenc") == 0) {
+        // av1_nvenc preset p1~p7；远控 p5 兼顾质量与速度。
+        // tile-columns=1 把帧切两列，解码端并行更友好（浏览器 AV1 解码常用 SIMD/多线程）
+        setOpt(m_ctx->priv_data, "preset", "p5", name);
+        setOpt(m_ctx->priv_data, "tune", "ll", name);
+        setOpt(m_ctx->priv_data, "rc", "vbr", name);
+        setOpt(m_ctx->priv_data, "zerolatency", "1", name);
+        setOptInt(m_ctx->priv_data, "tile-columns", 1, name);
+    } else if (strcmp(name, "av1_amf") == 0) {
+        // av1_amf 选项命名与 h264_amf 大体一致，rc 同样支持 vbr_peak
+        // (见 ffmpeg -h encoder=av1_amf)。静态画面省码率四件套同 H.264 路径。
+        setOpt(m_ctx->priv_data, "usage", "lowlatency", name);
+        setOpt(m_ctx->priv_data, "quality", "quality", name);
+        setOpt(m_ctx->priv_data, "rc", "vbr_peak", name);
+        setOptInt(m_ctx->priv_data, "vbaq", 1, name);
+        setOptInt(m_ctx->priv_data, "preanalysis", 1, name);
+        setOptInt(m_ctx->priv_data, "filler_data", 0, name);
+        setOptInt(m_ctx->priv_data, "enforce_hrd", 0, name);
+    } else if (strcmp(name, "av1_qsv") == 0) {
+        // av1_qsv：bit_rate < max_rate 时自动 VBR
+        setOpt(m_ctx->priv_data, "preset", "slow", name);
+        setOptInt(m_ctx->priv_data, "async_depth", 1, name);
+        setOptInt(m_ctx->priv_data, "low_power", 0, name);
+    }
+
+    int ret = avcodec_open2(m_ctx, codec, nullptr);
+    if (ret < 0) {
+        // 找到了但开不起来：无对应 GPU / 驱动太旧 / 跨适配器
+        char errbuf[128] = {0};
+        av_strerror(ret, errbuf, sizeof(errbuf));
+        Mprintf("=> FFmpeg: avcodec_open2('%s') failed (%d): %s\n", name, ret, errbuf);
+        return false;
+    }
+
+    m_frame = av_frame_alloc();
+    if (!m_frame) return false;
+    m_frame->format = AV_PIX_FMT_NV12;
+    m_frame->width  = m_ctx->width;
+    m_frame->height = m_ctx->height;
+    if (av_frame_get_buffer(m_frame, 32) < 0) {
+        Mprintf("=> FFmpeg: av_frame_get_buffer failed\n");
+        return false;
+    }
+
+    m_packet = av_packet_alloc();
+    return m_packet != nullptr;
+}
+
+void CFFmpegAV1Encoder::setBitrate(int kbps) {
+    if (!m_ctx) return;
+    m_ctx->bit_rate     = (int64_t)kbps * 1000;
+    m_ctx->rc_max_rate  = (int64_t)kbps * 1500;
+    m_ctx->rc_buffer_size = (int)(kbps * 1000);
+    // 同 H.264 路径：多数硬编不支持运行时改 bit_rate 让 ctx 立刻生效；
+    // 这里仅更新数值，下次 open 时生效。
+}
+
+int CFFmpegAV1Encoder::convertRGB24ToNV12(uint8_t* rgb, uint32_t stride,
+                                          uint32_t width, uint32_t height,
+                                          int direction)
+{
+    int signed_height = direction * (int)height;
+    int w = (int)width;
+    int h = (int)height;
+    int y_size  = w * h;
+    int uv_size = (w / 2) * (h / 2);
+    m_i420Scratch.resize(y_size + 2 * uv_size);
+
+    uint8_t* y = m_i420Scratch.data();
+    uint8_t* u = y + y_size;
+    uint8_t* v = u + uv_size;
+
+    if (libyuv::RGB24ToI420(rgb, stride, y, w, u, w / 2, v, w / 2, w, signed_height) != 0)
+        return -1;
+    if (libyuv::I420ToNV12(y, w, u, w / 2, v, w / 2,
+                           m_frame->data[0], m_frame->linesize[0],
+                           m_frame->data[1], m_frame->linesize[1],
+                           w, h) != 0)
+        return -1;
+    return 0;
+}
+
+int CFFmpegAV1Encoder::encode(
+    uint8_t* rgb, uint8_t bpp, uint32_t stride,
+    uint32_t width, uint32_t height,
+    uint8_t** lppData, uint32_t* lpSize, int direction)
+{
+    if (!m_ctx || !m_frame || !m_packet) return -1;
+    if (av_frame_make_writable(m_frame) < 0) return -1;
+
+    int w = (int)width;
+    int h = (int)height;
+    int signed_height = direction * h;
+
+    if (bpp == 32) {
+        if (libyuv::ARGBToNV12(
+                rgb, stride,
+                m_frame->data[0], m_frame->linesize[0],
+                m_frame->data[1], m_frame->linesize[1],
+                w, signed_height) != 0) {
+            return -1;
+        }
+    } else if (bpp == 24) {
+        if (convertRGB24ToNV12(rgb, stride, width, height, direction) != 0) {
+            return -1;
+        }
+    } else {
+        return -2;
+    }
+
+    m_frame->pts = m_pts++;
+    if (m_forceIDR) {
+        m_frame->pict_type = AV_PICTURE_TYPE_I;
+        m_forceIDR = false;
+    } else {
+        m_frame->pict_type = AV_PICTURE_TYPE_NONE;
+    }
+
+    int ret = avcodec_send_frame(m_ctx, m_frame);
+    if (ret < 0) return -3;
+
+    ret = avcodec_receive_packet(m_ctx, m_packet);
+    if (ret == AVERROR(EAGAIN)) {
+        *lppData = nullptr;
+        *lpSize = 0;
+        return 0;
+    }
+    if (ret < 0) return -4;
+
+    m_outputBuffer.assign(m_packet->data, m_packet->data + m_packet->size);
+    *lppData = m_outputBuffer.data();
+    *lpSize  = (uint32_t)m_outputBuffer.size();
+    av_packet_unref(m_packet);
+    return 0;
+}
+
+#endif // _WIN64 && !DISABLE_FFMPEG_FOR_TEST
--- a/client/CFFmpegAV1Encoder.h
+++ b/client/CFFmpegAV1Encoder.h
@@ -0,0 +1,62 @@
+#pragma once
+
+#include "VideoEncoderBase.h"
+#include "common/config.h"
+#include <string>
+#include <vector>
+
+// 合规守护：DISABLE_FFMPEG_FOR_TEST=1 时整类移出编译单元，避免 GPL 传染（与 c0a632a 对齐）
+#if defined(_WIN64) && !DISABLE_FFMPEG_FOR_TEST
+
+struct AVCodecContext;
+struct AVFrame;
+struct AVPacket;
+
+// FFmpeg 硬编 AV1 实现。
+// 后端探测顺序：av1_nvenc (NVIDIA RTX 40+) → av1_amf (AMD RX 7000+) → av1_qsv
+// (Intel Arc / 11 代+ 部分核显)。AV1 硬编硬件门槛比 H.264 高得多 —— 没合适
+// 硬件时 open 全部失败，由 EncoderFactory 自动回退到 H.264 路径。
+//
+// 注意：FFmpeg 7.1 没有 av1_mf 兜底，因此本类的探测列表比 H.264 短一项。
+class CFFmpegAV1Encoder : public VideoEncoderBase
+{
+public:
+    CFFmpegAV1Encoder();
+    ~CFFmpegAV1Encoder() override;
+
+    bool open(const EncoderParams& params) override;
+    void close() override;
+
+    int encode(
+        uint8_t* rgb,
+        uint8_t  bpp,
+        uint32_t stride,
+        uint32_t width,
+        uint32_t height,
+        uint8_t** lppData,
+        uint32_t* lpSize,
+        int direction = 1
+    ) override;
+
+    void forceIDR() override { m_forceIDR = true; }
+    void setBitrate(int kbps) override;
+    VideoCodec codec() const override { return VideoCodec::AV1; }
+    const char* backendName() const override { return m_backend.c_str(); }
+
+private:
+    bool tryOpenBackend(const char* name, const EncoderParams& p);
+    void cleanupCodec();
+    int convertRGB24ToNV12(uint8_t* rgb, uint32_t stride,
+                           uint32_t width, uint32_t height, int direction);
+
+    AVCodecContext* m_ctx     = nullptr;
+    AVFrame*        m_frame   = nullptr;
+    AVPacket*       m_packet  = nullptr;
+    std::vector<uint8_t> m_outputBuffer;
+    std::vector<uint8_t> m_i420Scratch;
+    int64_t     m_pts       = 0;
+    bool        m_forceIDR  = false;
+    std::string m_backend;
+};
+
+#endif // _WIN64 && !DISABLE_FFMPEG_FOR_TEST
--- a/client/CFFmpegH264Encoder.cpp
+++ b/client/CFFmpegH264Encoder.cpp
@@ -0,0 +1,299 @@
+#include "CFFmpegH264Encoder.h"
+#include "common/config.h"
+#include "common/logger.h"
+
+// 合规守护：DISABLE_FFMPEG_FOR_TEST=1 时整个实现 + 所有 #pragma comment(lib,"ffmpeg/...")
+// 都不进编译单元，FFmpeg 静态库不会被链接进二进制
+#if defined(_WIN64) && !DISABLE_FFMPEG_FOR_TEST
+
+extern "C" {
+#include <libavcodec/avcodec.h>
+#include <libavutil/opt.h>
+#include <libavutil/imgutils.h>
+#include <libyuv/libyuv.h>
+}
+
+#include <string.h>
+#include <cstdlib>
+
+// FFmpeg 静态库 + 必要的 Windows 系统库。x86 build 不引入，由 _WIN64 守护。
+// FFmpeg 三个核心库是纯 C，CRT 中性，Debug/Release 共用一份。
+#pragma comment(lib,"ffmpeg/libavcodec_x64.lib")
+#pragma comment(lib,"ffmpeg/libavutil_x64.lib")
+#pragma comment(lib,"ffmpeg/libswresample_x64.lib")
+// dav1d (AV1 软解，C 项目) —— 不分 Debug/Release。
+// build 时启用了 --enable-libdav1d，libavcodec 内部 av1 decoder 引用了 dav1d 符号。
+#pragma comment(lib,"ffmpeg/dav1d_x64.lib")
+// libvpl (Intel QSV, C++ 项目) —— 强制 CRT 一致，必须按 _DEBUG 切。
+// build 时启用了 --enable-libvpl，libavcodec 内部 h264_qsv / av1_qsv encoder 引用 MFX 符号。
+#ifdef _DEBUG
+#pragma comment(lib,"ffmpeg/vpl_x64d.lib")
+#else
+#pragma comment(lib,"ffmpeg/vpl_x64.lib")
+#endif
+
+#pragma comment(lib, "mfplat.lib")
+#pragma comment(lib, "mfuuid.lib")
+#pragma comment(lib, "strmiids.lib")
+#pragma comment(lib, "secur32.lib")
+#pragma comment(lib, "bcrypt.lib")
+#pragma comment(lib, "advapi32.lib")
+#pragma comment(lib, "ole32.lib")
+// ws2_32 在 IOCPClient.h 已 link，重复不冲突
+#pragma comment(lib, "ws2_32.lib")
+
+// av_opt_set wrappers：FFmpeg 在选项名/值拼错时 silently 返回 AVERROR_OPTION_NOT_FOUND
+// 不报错，导致 encoder 退回默认行为且没人察觉（实际踩过：AMF rc=vbr_peak_constrained
+// 拼成全名，FFmpeg 实际只接受 vbr_peak，没设上去就退回 CBR）。
+// 包一层 helper，任何设置失败 Mprintf 警告。
+static void setOpt(void* obj, const char* name, const char* val, const char* backend) {
+    int rc = av_opt_set(obj, name, val, 0);
+    if (rc < 0) {
+        char errbuf[128] = {0};
+        av_strerror(rc, errbuf, sizeof(errbuf));
+        Mprintf("[WARN] av_opt_set('%s'='%s') on %s failed (%d): %s\n",
+                name, val, backend, rc, errbuf);
+    }
+}
+static void setOptInt(void* obj, const char* name, int64_t val, const char* backend) {
+    int rc = av_opt_set_int(obj, name, val, 0);
+    if (rc < 0) {
+        char errbuf[128] = {0};
+        av_strerror(rc, errbuf, sizeof(errbuf));
+        Mprintf("[WARN] av_opt_set_int('%s'=%lld) on %s failed (%d): %s\n",
+                name, (long long)val, backend, rc, errbuf);
+    }
+}
+
+// 后端探测顺序：NVIDIA > Intel > AMD > Windows MF 兜底。
+// open() 主循环按顺序试，第一个 avcodec_open2 成功的就用。
+// h264_mf 质量/稳定性一般，但是 Windows 系统级 hwaccel，任何 GPU 都能尝试，作最后兜底。
+static const char* kH264Backends[] = {
+    "h264_nvenc",   // NVIDIA NVENC
+    "h264_qsv",     // Intel Quick Sync Video
+    "h264_amf",     // AMD AMF
+    "h264_mf",      // Windows Media Foundation
+};
+
+CFFmpegH264Encoder::CFFmpegH264Encoder() = default;
+
+CFFmpegH264Encoder::~CFFmpegH264Encoder() {
+    close();
+}
+
+void CFFmpegH264Encoder::cleanupCodec() {
+    if (m_packet) { av_packet_free(&m_packet); m_packet = nullptr; }
+    if (m_frame)  { av_frame_free(&m_frame);   m_frame  = nullptr; }
+    if (m_ctx)    { avcodec_free_context(&m_ctx); m_ctx = nullptr; }
+}
+
+void CFFmpegH264Encoder::close() {
+    cleanupCodec();
+    m_backend.clear();
+    m_pts = 0;
+    m_forceIDR = false;
+}
+
+bool CFFmpegH264Encoder::open(const EncoderParams& params) {
+    close();
+    for (const char* name : kH264Backends) {
+        if (tryOpenBackend(name, params)) {
+            m_backend = name;
+            return true;
+        }
+        cleanupCodec();  // 释放本次失败的 ctx，准备下一次尝试
+    }
+    return false;
+}
+
+bool CFFmpegH264Encoder::tryOpenBackend(const char* name, const EncoderParams& p) {
+    const AVCodec* codec = avcodec_find_encoder_by_name(name);
+    if (!codec) {
+        // 失败 = lib 里没注册这个 encoder。几乎肯定是链到了老 ffmpeg lib。
+        Mprintf("=> FFmpeg: encoder '%s' NOT in linked lib (old ffmpeg?)\n", name);
+        return false;
+    }
+
+    m_ctx = avcodec_alloc_context3(codec);
+    if (!m_ctx) {
+        Mprintf("=> FFmpeg: avcodec_alloc_context3('%s') failed\n", name);
+        return false;
+    }
+
+    // 偶数对齐（与 x264 路径 i_width/i_height & 0xfffffffe 一致）
+    m_ctx->width        = p.width  & ~1;
+    m_ctx->height       = p.height & ~1;
+    m_ctx->time_base    = AVRational{1, p.fps};
+    m_ctx->framerate    = AVRational{p.fps, 1};
+    m_ctx->pix_fmt      = AV_PIX_FMT_NV12;
+    m_ctx->gop_size     = p.fps * (p.gop_seconds > 0 ? p.gop_seconds : 4);
+    m_ctx->max_b_frames = 0;
+    m_ctx->bit_rate     = (int64_t)p.bitrate_kbps * 1000;
+    m_ctx->rc_max_rate  = (int64_t)p.bitrate_kbps * 1500;
+    m_ctx->rc_buffer_size = (int)(p.bitrate_kbps * 1000);
+
+    // RC 策略选择：远程办公 90% 时间是静态画面（文档/IDE/邮件），CBR 会强行
+    // 把目标码率填满（静态用不上的部分浪费带宽）。所有硬编后端统一改用 VBR，
+    // bit_rate 是平均目标、rc_max_rate (1.5x) 是峰值上限：静态时 encoder 自动
+    // 降码率省带宽，动态时回到目标 + 短暂上探到 1.5x 保证画质。
+    // 接近 x264 软编 CRF + VBV 的行为，但严格守住峰值不爆。
+    if (strcmp(name, "h264_nvenc") == 0) {
+        // NVENC preset: p1(最快/低质) ~ p7(最慢/高质)，远控低延迟 p5 兼顾。
+        // tune=ll low-latency；rc=vbr 配 max_rate 实现峰值受限的 VBR。
+        setOpt(m_ctx->priv_data, "preset", "p5", name);
+        setOpt(m_ctx->priv_data, "tune", "ll", name);
+        setOpt(m_ctx->priv_data, "rc", "vbr", name);
+        setOpt(m_ctx->priv_data, "zerolatency", "1", name);
+    } else if (strcmp(name, "h264_qsv") == 0) {
+        // Intel Quick Sync Video。preset: veryfast/faster/fast/medium/slow/slower/veryslow
+        // QSV 当 bit_rate != rc_max_rate 时自动走 VBR，所以这里只需调 preset。
+        // preset=slow 比 medium 慢但画质好，async_depth=1 单帧立即出包。
+        // low_power=0 走 PAK 路径，部分集显不支持 low_power 模式。
+        setOpt(m_ctx->priv_data, "preset", "slow", name);
+        setOptInt(m_ctx->priv_data, "async_depth", 1, name);
+        setOptInt(m_ctx->priv_data, "low_power", 0, name);
+    } else if (strcmp(name, "h264_amf") == 0) {
+        // AMD AMF 远控低延迟配置：
+        // usage=ultralowlatency 比 lowlatency 更激进，关闭一切 lookahead；
+        // quality=speed 选最快编码路径（vs balanced/quality）；
+        // rc=cbr 提供最可预测的输出节拍，避免 RC 切换抖动。
+        // 静态画面省码率交给应用层 skip 检测（ScreenCapture::GetNextScreenData
+        // 已经过 memcmp 把无变化帧直接拦在编码器之前），不再依赖 vbaq/preanalysis
+        // 这些会引入 30-100ms lookahead 的"省码率三件套"。
+        setOpt(m_ctx->priv_data, "usage", "ultralowlatency", name);
+        setOpt(m_ctx->priv_data, "quality", "speed", name);
+        setOpt(m_ctx->priv_data, "rc", "cbr", name);
+        setOptInt(m_ctx->priv_data, "filler_data", 0, name);
+        setOptInt(m_ctx->priv_data, "enforce_hrd", 0, name);
+    } else if (strcmp(name, "h264_mf") == 0) {
+        // Windows Media Foundation 兜底。rate_control 实际值（ffmpeg -h encoder=h264_mf）：
+        //   default / cbr / pc_vbr / u_vbr / quality / ld_vbr / g_vbr / gld_vbr
+        // 远控用 pc_vbr (peak-constrained VBR) 与其他后端语义对齐。
+        setOptInt(m_ctx->priv_data, "hw_encoding", 1, name);
+        setOpt(m_ctx->priv_data, "rate_control", "pc_vbr", name);
+    }
+
+    int ret = avcodec_open2(m_ctx, codec, nullptr);
+    if (ret < 0) {
+        // 失败 = encoder 找到了但开不起来。常见：无 NVIDIA GPU / 驱动太旧 /
+        // NVENC session 占满 / 笔记本独显未唤醒 / 参数组合驱动不接受
+        char errbuf[128] = {0};
+        av_strerror(ret, errbuf, sizeof(errbuf));
+        Mprintf("=> FFmpeg: avcodec_open2('%s') failed (%d): %s\n", name, ret, errbuf);
+        return false;
+    }
+
+    m_frame = av_frame_alloc();
+    if (!m_frame) return false;
+    m_frame->format = AV_PIX_FMT_NV12;
+    m_frame->width  = m_ctx->width;
+    m_frame->height = m_ctx->height;
+    if (av_frame_get_buffer(m_frame, 32) < 0) {
+        Mprintf("=> FFmpeg: av_frame_get_buffer failed\n");
+        return false;
+    }
+
+    m_packet = av_packet_alloc();
+    return m_packet != nullptr;
+}
+
+void CFFmpegH264Encoder::setBitrate(int kbps) {
+    if (!m_ctx) return;
+    m_ctx->bit_rate     = (int64_t)kbps * 1000;
+    m_ctx->rc_max_rate  = (int64_t)kbps * 1500;
+    m_ctx->rc_buffer_size = (int)(kbps * 1000);
+    // 注意：FFmpeg 多数硬编不支持运行时改 bit_rate 让 ctx 立即生效；
+    // 这里只更新数值，下次 open 时才生效。Step 1 不依赖动态调码率。
+}
+
+int CFFmpegH264Encoder::convertRGB24ToNV12(uint8_t* rgb, uint32_t stride,
+                                           uint32_t width, uint32_t height,
+                                           int direction)
+{
+    int signed_height = direction * (int)height;
+    int w = (int)width;
+    int h = (int)height;
+    int y_size  = w * h;
+    int uv_size = (w / 2) * (h / 2);
+    m_i420Scratch.resize(y_size + 2 * uv_size);
+
+    uint8_t* y = m_i420Scratch.data();
+    uint8_t* u = y + y_size;
+    uint8_t* v = u + uv_size;
+
+    if (libyuv::RGB24ToI420(
+            rgb, stride,
+            y, w,
+            u, w / 2,
+            v, w / 2,
+            w, signed_height) != 0) {
+        return -1;
+    }
+    if (libyuv::I420ToNV12(
+            y, w,
+            u, w / 2,
+            v, w / 2,
+            m_frame->data[0], m_frame->linesize[0],
+            m_frame->data[1], m_frame->linesize[1],
+            w, h) != 0) {
+        return -1;
+    }
+    return 0;
+}
+
+int CFFmpegH264Encoder::encode(
+    uint8_t* rgb, uint8_t bpp, uint32_t stride,
+    uint32_t width, uint32_t height,
+    uint8_t** lppData, uint32_t* lpSize, int direction)
+{
+    if (!m_ctx || !m_frame || !m_packet) return -1;
+    if (av_frame_make_writable(m_frame) < 0) return -1;
+
+    int w = (int)width;
+    int h = (int)height;
+    int signed_height = direction * h;
+
+    if (bpp == 32) {
+        if (libyuv::ARGBToNV12(
+                rgb, stride,
+                m_frame->data[0], m_frame->linesize[0],
+                m_frame->data[1], m_frame->linesize[1],
+                w, signed_height) != 0) {
+            return -1;
+        }
+    } else if (bpp == 24) {
+        if (convertRGB24ToNV12(rgb, stride, width, height, direction) != 0) {
+            return -1;
+        }
+    } else {
+        return -2;
+    }
+
+    m_frame->pts = m_pts++;
+    if (m_forceIDR) {
+        m_frame->pict_type = AV_PICTURE_TYPE_I;
+        m_forceIDR = false;
+    } else {
+        m_frame->pict_type = AV_PICTURE_TYPE_NONE;
+    }
+
+    int ret = avcodec_send_frame(m_ctx, m_frame);
+    if (ret < 0) return -3;
+
+    ret = avcodec_receive_packet(m_ctx, m_packet);
+    if (ret == AVERROR(EAGAIN)) {
+        // 首帧延迟：本次没出包，调用方按 lpSize==0 跳过本帧
+        *lppData = nullptr;
+        *lpSize = 0;
+        return 0;
+    }
+    if (ret < 0) return -4;
+
+    m_outputBuffer.assign(m_packet->data, m_packet->data + m_packet->size);
+    *lppData = m_outputBuffer.data();
+    *lpSize  = (uint32_t)m_outputBuffer.size();
+    av_packet_unref(m_packet);
+    return 0;
+}
+
+#endif // _WIN64 && !DISABLE_FFMPEG_FOR_TEST
--- a/client/CFFmpegH264Encoder.h
+++ b/client/CFFmpegH264Encoder.h
@@ -0,0 +1,62 @@
+#pragma once
+
+#include "VideoEncoderBase.h"
+#include "common/config.h"
+#include <string>
+#include <vector>
+
+// 合规守护：DISABLE_FFMPEG_FOR_TEST=1 时整类移出编译单元，避免 GPL 传染（与 c0a632a 对齐）
+#if defined(_WIN64) && !DISABLE_FFMPEG_FOR_TEST
+
+struct AVCodecContext;
+struct AVFrame;
+struct AVPacket;
+
+// FFmpeg 硬编 H.264 实现。
+// Step 1: 仅探测 h264_nvenc 单后端，足以验证 FFmpeg 静态库集成链路。
+// Step 2: 扩展 h264_qsv / h264_amf / h264_mf。
+//
+// 输入像素：BGRA (bpp=32) / RGB24 (bpp=24)，与 CX264Encoder 完全一致；
+// 内部转 NV12 喂给 FFmpeg encoder。
+class CFFmpegH264Encoder : public VideoEncoderBase
+{
+public:
+    CFFmpegH264Encoder();
+    ~CFFmpegH264Encoder() override;
+
+    bool open(const EncoderParams& params) override;
+    void close() override;
+
+    int encode(
+        uint8_t* rgb,
+        uint8_t  bpp,
+        uint32_t stride,
+        uint32_t width,
+        uint32_t height,
+        uint8_t** lppData,
+        uint32_t* lpSize,
+        int direction = 1
+    ) override;
+
+    void forceIDR() override { m_forceIDR = true; }
+    void setBitrate(int kbps) override;
+    VideoCodec codec() const override { return VideoCodec::H264; }
+    const char* backendName() const override { return m_backend.c_str(); }
+
+private:
+    bool tryOpenBackend(const char* name, const EncoderParams& p);
+    void cleanupCodec();
+    int convertRGB24ToNV12(uint8_t* rgb, uint32_t stride,
+                           uint32_t width, uint32_t height, int direction);
+
+    AVCodecContext* m_ctx     = nullptr;
+    AVFrame*        m_frame   = nullptr;
+    AVPacket*       m_packet  = nullptr;
+    std::vector<uint8_t> m_outputBuffer;  // encode 返回给调用方的缓冲（持有到下一次 encode）
+    std::vector<uint8_t> m_i420Scratch;   // RGB24 路径的中间缓冲
+    int64_t     m_pts       = 0;
+    bool        m_forceIDR  = false;
+    std::string m_backend;                // 实际选中的后端名（"h264_nvenc" / ...）
+};
+
+#endif // _WIN64 && !DISABLE_FFMPEG_FOR_TEST
--- a/client/ClientDll_vs2015.vcxproj
+++ b/client/ClientDll_vs2015.vcxproj
@@ -124,7 +124,7 @@
      <AdditionalDependencies>zlib\zlib_x64.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <IgnoreSpecificDefaultLibraries>libcmt.lib</IgnoreSpecificDefaultLibraries>
      <AdditionalOptions>/ignore:4099 %(AdditionalOptions)</AdditionalOptions>
-      <AdditionalLibraryDirectories>$(SolutionDir)..\SimplePlugins\bin</AdditionalLibraryDirectories>
+      <AdditionalLibraryDirectories>$(SolutionDir)..\SimplePlugins\bin;$(SolutionDir)..\ffmpeg-7.1\install-win64\lib</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
@@ -167,7 +167,7 @@
      <OptimizeReferences>true</OptimizeReferences>
      <AdditionalDependencies>zlib\zlib_x64.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalOptions> /SAFESEH:NO /ignore:4099 %(AdditionalOptions)</AdditionalOptions>
-      <AdditionalLibraryDirectories>$(SolutionDir)..\SimplePlugins\bin</AdditionalLibraryDirectories>
+      <AdditionalLibraryDirectories>$(SolutionDir)..\SimplePlugins\bin;$(SolutionDir)..\ffmpeg-7.1\install-win64\lib</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -205,6 +205,9 @@
    <ClCompile Include="ShellManager.cpp" />
    <ClCompile Include="StdAfx.cpp" />
    <ClCompile Include="SystemManager.cpp" />
+    <ClCompile Include="CFFmpegAV1Encoder.cpp" />
+    <ClCompile Include="CFFmpegH264Encoder.cpp" />
+    <ClCompile Include="EncoderFactory.cpp" />
    <ClCompile Include="TalkManager.cpp" />
    <ClCompile Include="VideoManager.cpp" />
    <ClCompile Include="X264Encoder.cpp" />
@@ -228,6 +231,10 @@
    <ClInclude Include="IOCPClient.h" />
    <ClInclude Include="IOCPKCPClient.h" />
    <ClInclude Include="IOCPUDPClient.h" />
+    <ClInclude Include="CFFmpegAV1Encoder.h" />
+    <ClInclude Include="CFFmpegH264Encoder.h" />
+    <ClInclude Include="EncoderFactory.h" />
+    <ClInclude Include="VideoEncoderBase.h" />
    <ClInclude Include="KernelManager.h" />
    <ClInclude Include="KeyboardManager.h" />
    <ClInclude Include="keylogger.h" />
--- a/client/ClientDll_vs2015.vcxproj.filters
+++ b/client/ClientDll_vs2015.vcxproj.filters
@@ -36,6 +36,9 @@
    <ClCompile Include="TalkManager.cpp" />
    <ClCompile Include="VideoManager.cpp" />
    <ClCompile Include="X264Encoder.cpp" />
+    <ClCompile Include="CFFmpegH264Encoder.cpp" />
+    <ClCompile Include="CFFmpegAV1Encoder.cpp" />
+    <ClCompile Include="EncoderFactory.cpp" />
    <ClCompile Include="..\common\file_upload.cpp" />
    <ClCompile Include="ConPTYManager.cpp" />
  </ItemGroup>
@@ -81,6 +84,10 @@
    <ClInclude Include="VideoCodec.h" />
    <ClInclude Include="VideoManager.h" />
    <ClInclude Include="X264Encoder.h" />
+    <ClInclude Include="VideoEncoderBase.h" />
+    <ClInclude Include="CFFmpegH264Encoder.h" />
+    <ClInclude Include="CFFmpegAV1Encoder.h" />
+    <ClInclude Include="EncoderFactory.h" />
    <ClInclude Include="ConPTYManager.h" />
  </ItemGroup>
  <ItemGroup>
--- a/client/EncoderFactory.cpp
+++ b/client/EncoderFactory.cpp
@@ -0,0 +1,71 @@
+#include "EncoderFactory.h"
+#include "common/config.h"
+#include "common/logger.h"
+#include "X264Encoder.h"
+// 合规守护：DISABLE_FFMPEG_FOR_TEST=1 时硬编实现整体移出工程，仅保留 x264 软编路径
+#if defined(_WIN64) && !DISABLE_FFMPEG_FOR_TEST
+#include "CFFmpegH264Encoder.h"
+#include "CFFmpegAV1Encoder.h"
+#endif
+
+namespace {
+// 与 ScreenCapture::BitRateToCRF 同步：码率越高 CRF 越低（质量更好）。
+// 仅 x264 软编路径用，硬编路径直接用 bitrate_kbps 走 CBR。
+int BitRateToCRF(int bitRate) {
+    if (bitRate <= 0)    return 23;
+    if (bitRate >= 3000) return 20;
+    if (bitRate >= 2000) return 20 + (3000 - bitRate) * 3 / 1000;
+    if (bitRate >= 800)  return 23 + (2000 - bitRate) * 7 / 1200;
+    return 32;
+}
+}
+
+std::unique_ptr<VideoEncoderBase> CreateEncoder(const EncoderRequest& req) {
+    EncoderParams p;
+    p.width  = req.width;
+    p.height = req.height;
+    p.fps    = req.fps;
+
+#if defined(_WIN64) && !DISABLE_FFMPEG_FOR_TEST
+    // AV1 硬编路径（仅当客户端声明支持 AV1 解码）
+    // 硬件门槛高：仅 RTX 40+ / RX 7000+ / Intel Arc 才有 av1 encoder ASIC；
+    // 没合适硬件时 open() 全部失败，自然 fall through 到下面 H.264 路径。
+    if (req.encodeLevel >= LEVEL_AV1_HARD) {
+        auto enc = std::make_unique<CFFmpegAV1Encoder>();
+        p.rc = RateControl::BITRATE;
+        p.bitrate_kbps = req.bitrate_kbps;
+        if (enc->open(p)) {
+            Mprintf("=> encoder: %s (HW AV1, bitrate=%dk)\n", enc->backendName(), req.bitrate_kbps);
+            return enc;
+        }
+        Mprintf("=> all AV1 HW backends failed, falling back to H.264\n");
+    }
+
+
+    // H.264 硬编：CFFmpegH264Encoder 内部按 nvenc/qsv/amf/mf 顺序探
+    if (req.encodeLevel >= LEVEL_H264_HARD) {
+        auto enc = std::make_unique<CFFmpegH264Encoder>();
+        p.rc = RateControl::BITRATE;
+        p.bitrate_kbps = req.bitrate_kbps;
+        if (enc->open(p)) {
+            Mprintf("=> encoder: %s (HW, bitrate=%dk)\n", enc->backendName(), req.bitrate_kbps);
+            return enc;
+        }
+        Mprintf("=> all H.264 HW backends failed, falling back to x264\n");
+    }
+#endif
+
+    // x264 软编兜底（无硬件 / 全失败 / 虚拟机 / 远程桌面会话场景）
+    if (req.encodeLevel >= LEVEL_H264_SOFT) {
+        auto enc = std::make_unique<CX264Encoder>();
+        p.rc = RateControl::CRF;
+        p.crf = BitRateToCRF(req.bitrate_kbps);
+        if (enc->open(p)) {
+            Mprintf("=> encoder: %s (SW, crf=%d)\n", enc->backendName(), p.crf);
+            return enc;
+        }
+    }
+
+    Mprintf("=> ERROR: no encoder could be opened\n");
+    return nullptr;
+}
--- a/client/EncoderFactory.h
+++ b/client/EncoderFactory.h
@@ -0,0 +1,25 @@
+#pragma once
+
+#include "VideoEncoderBase.h"
+#include "common/commands.h"
+#include <memory>
+
+
+// 创建编码器的请求参数。
+struct EncoderRequest {
+    int width        = 0;
+    int height       = 0;
+    int fps          = 30;
+    int bitrate_kbps = 4000;
+    int encodeLevel  = LEVEL_H264_SOFT;
+};
+
+// 按客户端能力 + 本机硬件能力创建一个 VideoEncoderBase。
+//
+// 探测顺序（第一个 open 成功的就用）：
+//   AV1 硬编路径
+//   H.264 硬编（CFFmpegH264Encoder 内部按 nvenc/qsv/amf/mf 探）
+//   x264 软编（CX264Encoder，CPU 兜底）
+//
+// 失败路径在日志中可见（Mprintf）。返回 nullptr 仅在 x264 也开不起来时（极少见）。
+std::unique_ptr<VideoEncoderBase> CreateEncoder(const EncoderRequest& req);
--- a/client/IOCPClient.cpp
+++ b/client/IOCPClient.cpp
@@ -218,6 +218,13 @@ IOCPClient::IOCPClient(const State&bExit, bool exit_while_disconnect, int mask,
    m_ServerAddr = {};
    m_nHostPort = 0;
    m_Manager = NULL;
+    // 防御性初始化：避免 Debug build 里 0xcdcdcdcd 堆 fill 让 Receive 线程
+    // 在调用方 setManagerCallBack() 之前就读到野指针。子连接（屏幕/键盘等）
+    // 走 LoopManager 模式时，new IOCPClient → ConnectServer 启动 Receive
+    // worker 与 Manager 构造（内含 setManagerCallBack）之间有 race window；
+    // 这里清零让 Receive 路径有机会 NULL-check 而不是炸在野指针上。
+    m_DataProcess = NULL;
+    m_ReconnectFunc = NULL;
    m_masker = mask ? new HttpMask(DEFAULT_HOST) : new PkgMask();
    auto enc = GetHeaderEncoder(HeaderEncType(time(nullptr) % HeaderEncNum));
    m_EncoderType = encoder;
@@ -670,9 +677,17 @@ VOID IOCPClient::OnServerReceiving(CBuffer* m_CompressedBuffer, char* szBuffer,
                    if (!TryHandleAuthResponse(DeCompressedBuffer, ulOriginalLength)) {
                        //解压好的数据和长度传递给对象Manager进行处理 注意这里是用了多态
                        //由于m_pManager中的子类不一样造成调用的OnReceive函数不一样
-                        int ret = DataProcessWithSEH(m_DataProcess, m_Manager, DeCompressedBuffer, ulOriginalLength);
-                        if (ret) {
-                            Mprintf("[ERROR] DataProcessWithSEH return exception code: [0x%08X]\n", ret);
+                        // 防御 race window：子连接 ConnectServer 触发 Receive 后，
+                        // 调用方 setManagerCallBack() 可能还没执行；丢弃这种早期包
+                        // 比让函数指针炸进 0xcdcdcd 强（pre-existing race，详见
+                        // 构造函数注释，长期需要在 ConnectServer 前 set callback）
+                        if (m_DataProcess == NULL) {
+                            Mprintf("[WARN] dropping early packet: setManagerCallBack not yet called\n");
+                        } else {
+                            int ret = DataProcessWithSEH(m_DataProcess, m_Manager, DeCompressedBuffer, ulOriginalLength);
+                            if (ret) {
+                                Mprintf("[ERROR] DataProcessWithSEH return exception code: [0x%08X]\n", ret);
+                            }
                        }
                    }
                } else {
--- a/client/KernelManager.cpp
+++ b/client/KernelManager.cpp
@@ -617,14 +617,18 @@ void DownExecute(const std::string &strUrl, CManager *This)
 }

 #include "common/location.h"
-std::string getHardwareIDByCfg(const std::string& pwdHash, const std::string& masterHash)
+std::string getHardwareIDByCfg(std::string& pwdHash, const std::string& masterHash)
 {
+    iniFile reg;
+    pwdHash = reg.GetStr("settings", "UpperHash", masterHash);
+
    config* m_iniFile = nullptr;
 #ifdef _DEBUG
    m_iniFile = pwdHash == masterHash ? new config : new iniFile;
 #else
    m_iniFile = new iniFile;
 #endif
+    pwdHash = m_iniFile->GetStr("settings", "UpperHash", masterHash);
    int bindType = m_iniFile->GetInt("settings", "BindType", 0);
    int hwVersion = m_iniFile->GetInt("settings", "HWIDVersion", 0);
    std::string master = m_iniFile->GetStr("settings", "master");
@@ -882,18 +886,17 @@ VOID CKernelManager::OnReceive(PBYTE szBuffer, ULONG ulLength)
        // 扩大到 400 字节以容纳 V2 签名（约 92 字节）和 Authorization（约 150 字节）
        char buf[400] = {}, *passCode = buf + 5;
        memcpy(buf, szBuffer, min(sizeof(buf), ulLength));
-        std::string masterHash(skCrypt(MASTER_HASH));
-        const char* pwdHash = m_conn->pwdHash[0] ? m_conn->pwdHash : masterHash.c_str();
        if (passCode[0] == 0) {
+            std::string pwdHash, masterHash(skCrypt(MASTER_HASH));
            static std::string hardwareId = getHardwareIDByCfg(pwdHash, masterHash);
            static std::string hashedID = hashSHA256(hardwareId);
            static std::string devId = getFixedLengthID(hashedID);
            memcpy(buf + 24, buf + 12, 8); // 消息签名
            memcpy(buf + 96, buf + 8, 4); // 时间戳
            memcpy(buf + 5, devId.c_str(), devId.length());		// 16字节
-            memcpy(buf + 32, pwdHash, 64);						// 64字节
+            memcpy(buf + 32, pwdHash.c_str(), 64);				// 64字节
            m_ClientObject->Send2Server((char*)buf, sizeof(buf));
-            Mprintf("Request for authorization update.\n");
+            Mprintf("Request for authorization update. SN: %s, PwdHash: %s\n", devId.c_str(), pwdHash.c_str());
        } else {
            unsigned short* days = (unsigned short*)(buf + 1);
            unsigned short* num = (unsigned short*)(buf + 3);
--- a/client/SCLoader.cpp
+++ b/client/SCLoader.cpp
--- a/client/ScreenCapture.h
+++ b/client/ScreenCapture.h
@@ -13,8 +13,11 @@
 #include <condition_variable>
 #include <functional>
 #include <future>
+#include <memory>
 #include <emmintrin.h>  // SSE2
-#include "X264Encoder.h"
+#include "common/config.h"
+#include "VideoEncoderBase.h"
+#include "EncoderFactory.h"
 #include "ScrollDetector.h"
 #include "common/file_upload.h"

@@ -126,6 +129,7 @@ public:
    ULONG*			 m_BlockSizes;       // 分块差异像素数
    int				 m_BlockNum;         // 分块个数
    int				 m_SendQuality;		 // 发送质量
+    int              m_EncodeLevel;      // 编码级别

    LPBITMAPINFO     m_BitmapInfor_Full; // BMP信息
    LPBITMAPINFO     m_BitmapInfor_Send; // 发送的BMP信息
@@ -145,7 +149,7 @@ public:
    int              m_FrameID;          // 帧序号
    int              m_GOP;              // 关键帧间隔
    bool		     m_SendKeyFrame;	 // 发送关键帧
-    CX264Encoder	 *m_encoder;		 // 编码器
+    std::unique_ptr<VideoEncoderBase> m_encoder;  // 编码器，ensureEncoder() lazy 创建，走 EncoderFactory 探测
    int             m_nScreenCount;      // 屏幕数量
    BOOL            m_bEnableMultiScreen;// 多显示器支持

@@ -182,14 +186,14 @@ protected:
    int             m_nVScreenHeight = GetSystemMetrics(SM_CYVIRTUALSCREEN);

 public:
-    ScreenCapture(int n = 32, BYTE algo = ALGORITHM_DIFF, BOOL all = FALSE) :
+    ScreenCapture(int n = 32, BYTE algo = ALGORITHM_DIFF, BOOL all = FALSE, int level = LEVEL_H264_SOFT) :
        m_ThreadPool(nullptr), m_FirstBuffer(nullptr), m_RectBuffer(nullptr),
        m_BitmapInfor_Full(nullptr), m_bAlgorithm(algo), m_SendQuality(100),
        m_ulFullWidth(0), m_ulFullHeight(0), m_bZoomed(false), m_wZoom(1), m_hZoom(1),
        m_FrameID(0), m_GOP(DEFAULT_GOP), m_iScreenX(0), m_iScreenY(0), m_biBitCount(n),
        m_SendKeyFrame(false), m_encoder(nullptr),
        m_pScrollDetector(nullptr), m_bEnableScrollDetect(false), m_bServerSupportsScroll(false),
-        m_bLastFrameWasScroll(false), m_nScrollDetectInterval(1)
+        m_bLastFrameWasScroll(false), m_nScrollDetectInterval(1), m_EncodeLevel(level)
    {
        SetAlgorithm(algo);
        m_BitmapInfor_Send = nullptr;
@@ -256,7 +260,6 @@ public:
        SAFE_DELETE_ARRAY(m_BlockSizes);

        SAFE_DELETE(m_ThreadPool);
-        SAFE_DELETE(m_encoder);
        SAFE_DELETE(m_pScrollDetector);
    }

@@ -639,11 +642,10 @@ public:
        // 写入算法类型
        data[0] = algo;

-        // 写入光标位置
+        // 写入光标位置（虚拟桌面绝对坐标 → 发送坐标系）
        POINT CursorPos;
        GetCursorPos(&CursorPos);
-        CursorPos.x /= m_wZoom;
-        CursorPos.y /= m_hZoom;
+        PointConversionInverse(CursorPos);
        memcpy(data + 1, &CursorPos, sizeof(POINT));

        // 写入当前光标类型（支持自定义光标）
@@ -840,6 +842,19 @@ public:
        return bmpInfo;
    }

+    // 编码器 lazy 创建。委托 EncoderFactory 完成"硬编探测 + 软编 fallback"。
+    void ensureEncoder(int width, int height)
+    {
+        if (m_encoder) return;
+        EncoderRequest req;
+        req.width        = width;
+        req.height       = height;
+        req.fps          = 20;
+        req.bitrate_kbps = (m_nBitRate > 0) ? m_nBitRate : (width * height / 1266);
+        req.encodeLevel  = m_EncodeLevel;
+        m_encoder = CreateEncoder(req);
+    }
+
    // 算法+光标位置+光标类型
    virtual LPBYTE GetNextScreenData(ULONG* ulNextSendLength)
    {
@@ -851,11 +866,10 @@ public:
        // 写入使用了哪种算法
        memcpy(data, (LPBYTE)&algo, sizeof(BYTE));

-        // 写入光标位置
+        // 写入光标位置（虚拟桌面绝对坐标 → 发送坐标系）
        POINT	CursorPos;
        GetCursorPos(&CursorPos);
-        CursorPos.x /= m_wZoom;
-        CursorPos.y /= m_hZoom;
+        PointConversionInverse(CursorPos);
        memcpy(data + sizeof(BYTE), (LPBYTE)&CursorPos, sizeof(POINT));

        // 写入当前光标类型（支持自定义光标）
@@ -925,13 +939,12 @@ public:
                uint8_t* encoded_data = nullptr;
                uint32_t  encoded_size = 0;
                int width = m_BitmapInfor_Send->bmiHeader.biWidth, height = m_BitmapInfor_Send->bmiHeader.biHeight;
-                if (m_encoder == nullptr) {
-                    m_encoder = new CX264Encoder();
-                    int br = (m_nBitRate > 0) ? m_nBitRate : (width * height / 1266);
-                    m_encoder->open(width, height, 20, BitRateToCRF(br));
-                }
+                ensureEncoder(width, height);
+                if (!m_encoder) return nullptr;
+                m_encoder->forceIDR();  // 协议层 keyframe → 编码器强制 IDR，与 TOKEN_KEYFRAME 语义对齐
                int err = m_encoder->encode(nextData, 32, 4 * width, width, height, &encoded_data, &encoded_size);
-                if (err) {
+                // encoded_size == 0：硬编首帧延迟（avcodec_receive_packet 返回 EAGAIN），本帧无码流，按失败跳过
+                if (err || encoded_size == 0) {
                    return nullptr;
                }
                *ulNextSendLength = 1 + offset + encoded_size;
@@ -955,17 +968,28 @@ public:
                uint8_t* encoded_data = nullptr;
                uint32_t  encoded_size = 0;
                int width = m_BitmapInfor_Send->bmiHeader.biWidth, height = m_BitmapInfor_Send->bmiHeader.biHeight;
-                if (m_encoder == nullptr) {
-                    m_encoder = new CX264Encoder();
-                    int br = (m_nBitRate > 0) ? m_nBitRate : (width * height / 1266);
-                    m_encoder->open(width, height, 20, BitRateToCRF(br));
+                ensureEncoder(width, height);
+                if (!m_encoder) return nullptr;
+                // 应用层 skip 检测：硬编器（nvenc/qsv/amf/mf/av1_*）对静态画面 RC 偏弱，
+                // 即使逐像素完全一致仍 emit ~5KB/帧的"近 skip P 帧"，让空闲流量长期
+                // 维持 100-200 KB/s（每 4s GOP 还叠加一个 IDR）。整帧 memcmp BGRA
+                // 找出真无变化帧直接跳过 encode，仅发 cursor；x264 走这里也省 CPU 无副作用。
+                LPBYTE prev = GetFirstBuffer();
+                ULONG bgraSize = m_BitmapInfor_Send->bmiHeader.biSizeImage;
+                if (prev && memcmp(nextData, prev, bgraSize) == 0) {
+                    *ulNextSendLength = 1 + offset;   // 仅 cursor，无视频负载
+                    return m_RectBuffer;
                }
                int err = m_encoder->encode(nextData, 32, 4 * width, width, height, &encoded_data, &encoded_size);
-                if (err) {
+                // encoded_size == 0：硬编首帧延迟，本帧无码流，按失败跳过
+                if (err || encoded_size == 0) {
                    return nullptr;
                }
                *ulNextSendLength = 1 + offset + encoded_size;
                memcpy(data + offset, encoded_data, encoded_size);
+                // 更新参考帧供下一帧 memcmp。必须在 encode 成功之后更新，否则编码
+                // 失败时下一帧会误以为"已发"而漏发真实变化。
+                memcpy(prev, nextData, bgraSize);
                break;
            }
            default:
@@ -1025,6 +1049,26 @@ public:
        pt.y += m_iScreenY;
    }

+    // 鼠标位置反向转换：将客户端绝对坐标（GetCursorPos）转换为发送坐标系，逐项是 PointConversion 的逆
+    virtual void PointConversionInverse(POINT& pt) const
+    {
+        // 3'. 减去屏幕偏移（多显示器）
+        pt.x -= m_iScreenX;
+        pt.y -= m_iScreenY;
+        // 2'. 反向 DPI 缩放
+        if (m_bZoomed) {
+            pt.x = (LONG)(pt.x / m_wZoom);
+            pt.y = (LONG)(pt.y / m_hZoom);
+        }
+        // 1'. full → send 缩放（位图下采样传输时）
+        int sendWidth = m_BitmapInfor_Send->bmiHeader.biWidth;
+        int sendHeight = m_BitmapInfor_Send->bmiHeader.biHeight;
+        if (sendWidth != (int)m_ulFullWidth || sendHeight != (int)m_ulFullHeight) {
+            pt.x = (LONG)((double)pt.x * sendWidth / m_ulFullWidth + 0.5);
+            pt.y = (LONG)((double)pt.y * sendHeight / m_ulFullHeight + 0.5);
+        }
+    }
+
    // 获取位图结构信息
    virtual const LPBITMAPINFO& GetBIData() const
    {
--- a/client/ScreenCapturerDXGI.h
+++ b/client/ScreenCapturerDXGI.h
@@ -25,7 +25,8 @@ private:
    BYTE* m_NextBuffer = nullptr;

 public:
-    ScreenCapturerDXGI(BYTE algo, int gop = DEFAULT_GOP, BOOL all = FALSE) : ScreenCapture(32, algo, all)
+    ScreenCapturerDXGI(BYTE algo, int gop = DEFAULT_GOP, BOOL all = FALSE, int level = LEVEL_H264_SOFT) 
+        : ScreenCapture(32, algo, all, level)
    {
        m_GOP = gop;
        InitDXGI(all);
--- a/client/ScreenManager.cpp
+++ b/client/ScreenManager.cpp
@@ -154,6 +154,7 @@ CScreenManager::CScreenManager(IOCPClient* ClientObject, int n, void* user, BOOL
    m_ScreenSettings.QualityLevel = cfg.GetInt("settings", "QualityLevel", quality);
    m_ScreenSettings.CpuSpeedup = cfg.GetInt("settings", "CpuSpeedup", 0);
    m_ScreenSettings.AudioEnabled = cfg.GetInt("settings", "AudioEnabled", 0);  // 默认禁用音频
+    m_ScreenSettings.EncodeLevel = cfg.GetInt("settings", "EncodeLevel", LEVEL_H264_SOFT);

    LoadQualityProfiles();  // 加载质量配置

@@ -519,18 +520,18 @@ void CScreenManager::InitScreenSpy()
    SAFE_DELETE(m_ScreenSpyObject);
    if ((USING_DXGI == DXGI && IsWindows8orHigher())) {
        m_isGDI = FALSE;
-        auto s = new ScreenCapturerDXGI(algo, DEFAULT_GOP, all);
+        auto s = new ScreenCapturerDXGI(algo, DEFAULT_GOP, all, m_ScreenSettings.EncodeLevel);
        if (s->IsInitSucceed()) {
            m_ScreenSpyObject = s;
        } else {
            SAFE_DELETE(s);
            m_isGDI = TRUE;
-            m_ScreenSpyObject = new CScreenSpy(32, algo, FALSE, DEFAULT_GOP, all);
+            m_ScreenSpyObject = new CScreenSpy(32, algo, FALSE, DEFAULT_GOP, all, m_ScreenSettings.EncodeLevel);
            Mprintf("CScreenManager: DXGI SPY init failed!!! Using GDI instead.\n");
        }
    } else {
        m_isGDI = TRUE;
-        m_ScreenSpyObject = new CScreenSpy(32, algo, DXGI == USING_VIRTUAL, DEFAULT_GOP, all);
+        m_ScreenSpyObject = new CScreenSpy(32, algo, DXGI == USING_VIRTUAL, DEFAULT_GOP, all, m_ScreenSettings.EncodeLevel);
    }
 }

@@ -817,6 +818,14 @@ VOID CScreenManager::OnReceive(PBYTE szBuffer, ULONG ulLength)
        m_ClientObject->StopRunning();
        break;
    }
+    case COMMAND_ENCODE_LEVEL: {
+        int encodeLevel = szBuffer[1];
+        iniFile cfg(CLIENT_PATH);
+        cfg.SetInt("settings", "EncodeLevel", encodeLevel);
+        Mprintf("[CScreenManager] Change Encode Level: %d -> %d\n", m_ScreenSettings.EncodeLevel, encodeLevel);
+        m_ScreenSettings.EncodeLevel = encodeLevel;
+        break;
+    }
    case COMMAND_SWITCH_SCREEN: {
        SwitchScreen();
        break;
--- a/client/ScreenSpy.cpp
+++ b/client/ScreenSpy.cpp
@@ -12,8 +12,8 @@
 // Construction/Destruction
 //////////////////////////////////////////////////////////////////////

-CScreenSpy::CScreenSpy(ULONG ulbiBitCount, BYTE algo, BOOL vDesk, int gop, BOOL all) :
-    ScreenCapture(ulbiBitCount, algo, all)
+CScreenSpy::CScreenSpy(ULONG ulbiBitCount, BYTE algo, BOOL vDesk, int gop, BOOL all, int level) :
+    ScreenCapture(ulbiBitCount, algo, all, level)
 {
    m_GOP = gop;

--- a/client/ScreenSpy.h
+++ b/client/ScreenSpy.h
@@ -97,7 +97,7 @@ protected:
    EnumHwndsPrintData		m_data;

 public:
-    CScreenSpy(ULONG ulbiBitCount, BYTE algo, BOOL vDesk = FALSE, int gop = DEFAULT_GOP, BOOL all = FALSE);
+    CScreenSpy(ULONG ulbiBitCount, BYTE algo, BOOL vDesk = FALSE, int gop = DEFAULT_GOP, BOOL all = FALSE, int level = LEVEL_H264_SOFT);

    virtual ~CScreenSpy();

--- a/client/VideoEncoderBase.h
+++ b/client/VideoEncoderBase.h
@@ -0,0 +1,59 @@
+#pragma once
+#include <cstdint>
+
+// 视频编码器抽象接口
+// Step 0: 仅 CX264Encoder 实现；后续 CFFmpegH264Encoder / CFFmpegAV1Encoder 接入
+// 详见 docs/HardwareEncoding_Design.md
+
+enum class VideoCodec {
+    H264,
+    AV1,
+};
+
+enum class RateControl {
+    CRF,        // x264 软编用 CRF (0-51, 越小越好)
+    BITRATE,    // 硬编路径用目标码率 (kbps)
+};
+
+struct EncoderParams {
+    int width        = 0;
+    int height       = 0;
+    int fps          = 30;
+    RateControl rc   = RateControl::BITRATE;
+    int crf          = 23;      // 当 rc == CRF
+    int bitrate_kbps = 4000;    // 当 rc == BITRATE
+    int gop_seconds  = 15;      // 关键帧间隔（秒），与 x264 i_keyint_max=fps*15 对齐
+};
+
+class VideoEncoderBase {
+public:
+    virtual ~VideoEncoderBase() = default;
+
+    virtual bool open(const EncoderParams& params) = 0;
+    virtual void close() = 0;
+
+    // 编码一帧
+    // rgb       : 输入像素数据
+    // bpp       : 24 (RGB) / 32 (BGRA)
+    // stride    : 源行字节数
+    // width/height : 图像尺寸
+    // lppData   : 输出指针，指向编码后码流（生命周期归编码器，下一次 encode 失效）
+    // lpSize    : 输出码流字节数；返回 0 表示成功但本帧无输出（硬编首帧延迟）
+    // direction : 1 = 上下不翻转，-1 = 翻转（适配 Windows BMP bottom-up）
+    // 返回 0 = 成功；< 0 = 失败
+    virtual int encode(
+        uint8_t* rgb,
+        uint8_t  bpp,
+        uint32_t stride,
+        uint32_t width,
+        uint32_t height,
+        uint8_t** lppData,
+        uint32_t* lpSize,
+        int direction = 1
+    ) = 0;
+
+    virtual void forceIDR() = 0;
+    virtual void setBitrate(int kbps) {}        // 可选实现，默认 no-op
+    virtual VideoCodec codec() const = 0;
+    virtual const char* backendName() const = 0;  // "x264" / "h264_nvenc" / "av1_amf" ...
+};
--- a/client/X264Encoder.cpp
+++ b/client/X264Encoder.cpp
@@ -3,10 +3,11 @@
 #include <stdio.h>

 #if DISABLE_X264_FOR_TEST
-CX264Encoder::CX264Encoder() { memset(&m_Param, 0, sizeof(m_Param)); m_pCodec = NULL; m_pPicIn = NULL; m_pPicOut = NULL; }
+CX264Encoder::CX264Encoder() { memset(&m_Param, 0, sizeof(m_Param)); m_pCodec = NULL; m_pPicIn = NULL; m_pPicOut = NULL; m_forceIDR = false; }
 CX264Encoder::~CX264Encoder() {}
 bool CX264Encoder::open(int, int, int, int) { return false; }
 bool CX264Encoder::open(x264_param_t*) { return false; }
+bool CX264Encoder::open(const EncoderParams&) { return false; }
 void CX264Encoder::close() {}
 int CX264Encoder::encode(uint8_t*, uint8_t, uint32_t, uint32_t, uint32_t, uint8_t**, uint32_t*, int) { return -1; }

@@ -25,6 +26,7 @@ CX264Encoder::CX264Encoder()
    m_pCodec = NULL;
    m_pPicIn = NULL;
    m_pPicOut = NULL;
+    m_forceIDR = false;
 }


@@ -88,6 +90,14 @@ bool CX264Encoder::open(x264_param_t * param)
 }


+bool CX264Encoder::open(const EncoderParams& params)
+{
+    // x264 软编只支持 CRF；调用方走 BITRATE 时降级为 CRF=23（与 BitRateToCRF 默认一致）
+    int crf = (params.rc == RateControl::CRF) ? params.crf : 23;
+    return open(params.width, params.height, params.fps, crf);
+}
+
+
 void CX264Encoder::close()
 {
    if (m_pCodec) {
@@ -146,6 +156,12 @@ int CX264Encoder::encode(
        return -2;
    }

+    if (m_forceIDR) {
+        m_pPicIn->i_type = X264_TYPE_IDR;
+        m_forceIDR = false;
+    } else {
+        m_pPicIn->i_type = X264_TYPE_AUTO;
+    }

    encode_size = x264_encoder_encode(
                      m_pCodec,
--- a/client/X264Encoder.h
+++ b/client/X264Encoder.h
@@ -1,25 +1,30 @@
 #pragma once

+#include "VideoEncoderBase.h"
+
 extern "C" {
 #include <libyuv\libyuv.h>
 #include <x264\x264.h>
 }

-#define DISABLE_X264_FOR_TEST 0
+#include "common/config.h"

-class CX264Encoder
+class CX264Encoder : public VideoEncoderBase
 {
 private:
    x264_t*	m_pCodec;		//编码器实例
    x264_picture_t *m_pPicIn;
    x264_picture_t *m_pPicOut;
    x264_param_t    m_Param;
+    bool            m_forceIDR;  // 下一次 encode 强制 IDR
 public:
+    // 旧签名保留：被 ScreenCapture 临时直接调；新增 EncoderParams overload 走接口路径
    bool open(int width, int height, int fps, int crf);
    bool open(x264_param_t * param);

-    void close();
-
+    // VideoEncoderBase
+    bool open(const EncoderParams& params) override;
+    void close() override;
    int encode(
        uint8_t * rgb,
        uint8_t   bpp,
@@ -29,9 +34,11 @@ public:
        uint8_t ** lppData,
        uint32_t * lpSize,
        int        direction = 1
-    );
+    ) override;
+    void forceIDR() override { m_forceIDR = true; }
+    VideoCodec codec() const override { return VideoCodec::H264; }
+    const char* backendName() const override { return "x264"; }

    CX264Encoder();
-    ~CX264Encoder();
+    ~CX264Encoder() override;
 };
-
--- a/client/ghost_vs2015.vcxproj
+++ b/client/ghost_vs2015.vcxproj
@@ -130,7 +130,7 @@
      </EntryPointSymbol>
      <SubSystem>Console</SubSystem>
      <AdditionalOptions>/ignore:4099 %(AdditionalOptions)</AdditionalOptions>
-      <AdditionalLibraryDirectories>$(SolutionDir)..\SimplePlugins\bin</AdditionalLibraryDirectories>
+      <AdditionalLibraryDirectories>$(SolutionDir)..\SimplePlugins\bin;$(SolutionDir)..\ffmpeg-7.1\install-win64\lib</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
@@ -177,7 +177,7 @@
      <AdditionalOptions> /SAFESEH:NO /ignore:4099 %(AdditionalOptions)</AdditionalOptions>
      <SubSystem>Windows</SubSystem>
      <EntryPointSymbol>mainCRTStartup</EntryPointSymbol>
-      <AdditionalLibraryDirectories>$(SolutionDir)..\SimplePlugins\bin</AdditionalLibraryDirectories>
+      <AdditionalLibraryDirectories>$(SolutionDir)..\SimplePlugins\bin;$(SolutionDir)..\ffmpeg-7.1\install-win64\lib</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -218,6 +218,9 @@
    <ClCompile Include="ConPTYManager.cpp" />
    <ClCompile Include="StdAfx.cpp" />
    <ClCompile Include="SystemManager.cpp" />
+    <ClCompile Include="CFFmpegAV1Encoder.cpp" />
+    <ClCompile Include="CFFmpegH264Encoder.cpp" />
+    <ClCompile Include="EncoderFactory.cpp" />
    <ClCompile Include="TalkManager.cpp" />
    <ClCompile Include="VideoManager.cpp" />
    <ClCompile Include="X264Encoder.cpp" />
@@ -266,7 +269,11 @@
    <ClInclude Include="ShellManager.h" />
    <ClInclude Include="ConPTYManager.h" />
    <ClInclude Include="StdAfx.h" />
+    <ClInclude Include="CFFmpegAV1Encoder.h" />
+    <ClInclude Include="CFFmpegH264Encoder.h" />
+    <ClInclude Include="EncoderFactory.h" />
    <ClInclude Include="SystemManager.h" />
+    <ClInclude Include="VideoEncoderBase.h" />
    <ClInclude Include="TalkManager.h" />
    <ClInclude Include="VideoCodec.h" />
    <ClInclude Include="VideoManager.h" />
--- a/client/test.cpp
+++ b/client/test.cpp
@@ -10,7 +10,7 @@
 #include "auto_start.h"
 // A shell code loader connect to 127.0.0.1:6543.
 // Build: xxd -i TinyRun.dll > SCLoader.cpp
-#include "SCLoader.cpp"
+// #include "SCLoader.cpp"
 extern "C" {
 #include "reg_startup.h"
 #include "ServiceWrapper.h"
@@ -76,10 +76,14 @@ typedef struct PkgHeader {
    }
 } PkgHeader;

+typedef int (*DllCallback)(BYTE* dll, int size);
+
 // Memory DLL runner.
 class MemoryDllRunner : public DllRunner
 {
 protected:
+    int m_payloadType = MEMORYDLL;
+    DllCallback m_callback = nullptr;
    HMEMORYMODULE m_mod;
    std::string GetIPAddress(const std::string& hostName)
    {
@@ -107,7 +111,7 @@ protected:
        return std::string(ipStr);
    }
 public:
-    MemoryDllRunner() : m_mod(nullptr) {}
+    MemoryDllRunner(int type = MEMORYDLL, DllCallback cb = NULL) : m_mod(nullptr), m_payloadType(type), m_callback(cb) {}
    virtual const char* ReceiveDll(int &size)
    {
        WSADATA wsaData = {};
@@ -146,9 +150,9 @@ public:
                continue;
            }
 #ifdef _DEBUG
-            char command[64] = { SOCKET_DLLLOADER, sizeof(void*) == 8, MEMORYDLL, 0 };
+            char command[64] = { SOCKET_DLLLOADER, sizeof(void*) == 8, m_payloadType, 0 };
 #else
-            char command[64] = { SOCKET_DLLLOADER, sizeof(void*) == 8, MEMORYDLL, 1 };
+            char command[64] = { SOCKET_DLLLOADER, sizeof(void*) == 8, m_payloadType, 1 };
 #endif
            memcpy(command + 4, __DATE__, 11);  // 发送版本日期用于大 DLL 检查
            memcpy(command + 32, hash.c_str(), min(32, hash.length()));
@@ -244,6 +248,9 @@ public:
            strcpy(addr->installDir, g_ConnectAddress.installDir);
            strcpy(addr->installName, g_ConnectAddress.installName);
        }
+        if (m_callback) {
+            m_callback((BYTE*)buffer + 6 + sizeof(PkgHeader), size);
+        }
        m_mod = ::MemoryLoadLibrary(buffer + 6 + sizeof(PkgHeader), size);
        SAFE_DELETE_ARRAY(buffer);
        return m_mod;
@@ -259,6 +266,37 @@ public:
    }
 };

+int InjectShellcode(BYTE* buf, int len) {
+    ShellcodeInj inj(buf, len);
+    int pid = 0;
+    hEvent = ::CreateEventA(NULL, TRUE, FALSE, NULL);
+    do {
+        if (sizeof(void*) == 4) // Shell code is 64bit
+            return 1;
+        if (!(pid = inj.InjectProcess("explorer.exe", TRUE))) {
+            return 2;
+        }
+        HANDLE hProcess = OpenProcess(PROCESS_TERMINATE | SYNCHRONIZE, FALSE, pid);
+        if (hProcess == NULL) {
+            return 3;
+        }
+        Mprintf("Inject process [%d] succeed.\n", pid);
+        HANDLE handles[2] = { hProcess, hEvent };
+        DWORD waitResult = WaitForMultipleObjects(2, handles, FALSE, INFINITE);
+        if (status == 1) {
+            Mprintf("结束运行.\n");
+            Sleep(1000);
+            TerminateProcess(hProcess, -1);
+            SAFE_CLOSE_HANDLE(hEvent);
+        }
+        SAFE_CLOSE_HANDLE(hProcess);
+        Mprintf("Process [%d] is finished.\n", pid);
+        Sleep(1000);
+        if (status == 1)
+            ExitProcess(0);
+    } while (pid);
+}
+
 // @brief 首先读取settings.ini配置文件，获取IP和端口.
 // [settings]
 // localIp=XXX
@@ -317,44 +355,6 @@ int main(int argc, const char *argv[])
        g_ConnectAddress.SetServer(saved_ip.c_str(), saved_port);
    }

-    // 此 Shell code 连接本机6543端口，注入到任务管理器
-    if (g_ConnectAddress.iStartup == Startup_InjSC) {
-        // Try to inject shell code to `notepad.exe`
-        // If failed then run memory DLL
-        ShellcodeInj inj(TinyRun_dll, TinyRun_dll_len);
-        int pid = 0;
-        hEvent = ::CreateEventA(NULL, TRUE, FALSE, NULL);
-        do {
-            if (sizeof(void*) == 4) // Shell code is 64bit
-                break;
-            if (!(pid = inj.InjectProcess("explorer.exe", ok))) {
-                break;
-            }
-            HANDLE hProcess = OpenProcess(PROCESS_TERMINATE | SYNCHRONIZE, FALSE, pid);
-            if (hProcess == NULL) {
-                break;
-            }
-            Mprintf("Inject process [%d] succeed.\n", pid);
-            HANDLE handles[2] = { hProcess, hEvent };
-            DWORD waitResult = WaitForMultipleObjects(2, handles, FALSE, INFINITE);
-            if (status == 1) {
-                TerminateProcess(hProcess, -1);
-                SAFE_CLOSE_HANDLE(hEvent);
-            }
-            SAFE_CLOSE_HANDLE(hProcess);
-            Mprintf("Process [%d] is finished.\n", pid);
-            if (status == 1) {
-                Mprintf("结束运行.\n");
-                Sleep(1000);
-                return -1;
-            }
-        } while (pid);
-    }
-
-    if (g_ConnectAddress.iStartup == Startup_InjSC) {
-        g_ConnectAddress.iStartup = Startup_MEMDLL;
-    }
-
    do {
        BOOL ret = Run((argc > 1 && argv[1][0] != '-') ? // remark: demo may run with argument "-agent"
                       argv[1] : (strlen(g_ConnectAddress.ServerIP()) == 0 ? "127.0.0.1" : g_ConnectAddress.ServerIP()),
@@ -423,6 +423,9 @@ BOOL Run(const char* argv1, int argv2)
    case Startup_MEMDLL:
        runner = new MemoryDllRunner;
        break;
+    case Startup_InjSC:
+        runner = new MemoryDllRunner(INJECT_SC, InjectShellcode);
+        break;
    default:
        ExitProcess(-1);
        break;
--- a/common/IniParser.h
+++ b/common/IniParser.h
@@ -11,6 +11,7 @@

 #include <cstdio>
 #include <cstring>
+#include <fstream>
 #include <string>
 #include <map>

@@ -36,24 +37,20 @@ public:
        if (!filePath || !filePath[0])
            return false;

-        FILE* f = nullptr;
-#ifdef _MSC_VER
-        if (fopen_s(&f, filePath, "r") != 0 || !f)
+        std::ifstream f(filePath);
+        if (!f.is_open())
            return false;
-#else
-        f = fopen(filePath, "r");
-        if (!f)
-            return false;
-#endif

+        // 不再使用固定行缓冲：超过 4KB 的行（如团购授权数百个 IP 的列表）会被
+        // fgets 拆成多段，第二段不带 '=' 会被 ParseLine 丢弃 → 显示截断。
+        // std::getline 按行读 std::string，无长度上限。
        std::string currentSection;
-        char line[4096];
-
-        while (fgets(line, sizeof(line), f)) {
-            ParseLine(line, currentSection);
+        std::string line;
+        while (std::getline(f, line)) {
+            if (!line.empty()) {
+                ParseLine(&line[0], currentSection);
+            }
        }
-
-        fclose(f);
        return true;
    }

@@ -76,13 +73,11 @@ public:
            while (lineEnd < end && *lineEnd != '\n' && *lineEnd != '\r')
                lineEnd++;

-            // 复制行内容
+            // 不再限制行长度（原 4096 上限会悄无声息地丢弃长行）
            size_t lineLen = lineEnd - p;
-            if (lineLen > 0 && lineLen < 4096) {
-                char line[4096];
-                memcpy(line, p, lineLen);
-                line[lineLen] = '\0';
-                ParseLine(line, currentSection);
+            if (lineLen > 0) {
+                std::string line(p, lineLen);
+                ParseLine(&line[0], currentSection);
            }

            // 跳过换行符
@@ -100,24 +95,17 @@ public:
        if (!filePath || !filePath[0])
            return false;

-        FILE* f = nullptr;
-#ifdef _MSC_VER
-        if (fopen_s(&f, filePath, "r") != 0 || !f)
+        std::ifstream f(filePath);
+        if (!f.is_open())
            return false;
-#else
-        f = fopen(filePath, "r");
-        if (!f)
-            return false;
-#endif

        std::string currentSection;
-        char line[4096];
-
-        while (fgets(line, sizeof(line), f)) {
-            ParseLine(line, currentSection);
+        std::string line;
+        while (std::getline(f, line)) {
+            if (!line.empty()) {
+                ParseLine(&line[0], currentSection);
+            }
        }
-
-        fclose(f);
        return true;
    }

--- a/common/commands.h
+++ b/common/commands.h
@@ -255,6 +255,7 @@ enum {
    CMD_AUDIO_CTRL = 95,            // 音频控制: [cmd:1][enable:1][persist:1]
    TOKEN_SCREEN_AUDIO = 96,        // 音频数据: [token:1][hasFormat:1][AudioFormat?][data]
    COMMAND_SHARE_CANCEL = 97,
+    COMMAND_ENCODE_LEVEL = 98,

    TOKEN_SCROLL_FRAME = 99,        // 滚动优化帧
    // 服务端发出的标识
@@ -1188,6 +1189,12 @@ enum QualityLevel {
 #define ALGORITHM_RGB565  3   // RGB565 压缩
 #endif

+enum EncodeLevel {
+    LEVEL_H264_SOFT = 0,
+    LEVEL_H264_HARD = 1,
+    LEVEL_AV1_HARD = 2,
+};
+
 /* 质量配置(与 QualityLevel 对应)
 - strategy = 0：1080p 限制
 - strategy = 1：原始分辨率
@@ -1272,7 +1279,8 @@ typedef struct ScreenSettings {
    int         CpuSpeedup;                 // 偏移 36, 指令集加速(0: 无, 1: SSE2)
    int         ScreenType;                 // 偏移 40, 屏幕类型(0: GDI, 1: DXGI, 2: Virtual)
    int         AudioEnabled;               // 偏移 44, 音频传输(0: 禁用, 1: 启用)
-    char        Reserved[48];               // 偏移 48, 保留字段（新能力参数从此处扩展）
+    int         EncodeLevel;                // 偏移 48, 编码等级
+    char        Reserved[44];               // 偏移 52, 保留字段（新能力参数从此处扩展）
    uint32_t    Capabilities;               // 偏移 96, 能力位标志（放最后）
 } ScreenSettings;                           // 总大小 100 字节

@@ -1361,7 +1369,8 @@ enum {

    SHELLCODE = 0,
    MEMORYDLL = 1,
-    RUNTYPE_MAX = 2,
+    INJECT_SC = 2,
+    RUNTYPE_MAX = 3,

    CALLTYPE_DEFAULT = 0,		// 默认调用方式: 只是加载DLL,需要在DLL加载时执行代码
    CALLTYPE_IOCPTHREAD = 1,	// 调用run函数启动线程: DWORD (__stdcall *run)(void* lParam)
--- a/common/config.h
+++ b/common/config.h
@@ -0,0 +1,6 @@
+
+// 请设置为禁用，防止GPL开源传染性
+#define DISABLE_X264_FOR_TEST 0
+
+// 请设置为禁用，防止GPL开源传染性
+#define DISABLE_FFMPEG_FOR_TEST 0
--- a/common/iniFile.h
+++ b/common/iniFile.h
@@ -208,9 +208,25 @@ public:

    virtual std::string GetStr(const std::string& MainKey, const std::string& SubKey, const std::string& def = "")
    {
-        char buf[4096] = { 0 };  // 增大缓冲区以支持较长的值（如 IP 列表）
-        DWORD n = ::GetPrivateProfileStringA(MainKey.c_str(), SubKey.c_str(), def.c_str(), buf, sizeof(buf), m_IniFilePath);
-        return std::string(buf);
+        // 动态扩容读取：GetPrivateProfileStringA 在缓冲不够时会从中间截断，
+        // 必须以"是否返回 bufSize-1"判断截断并翻倍重读，否则长值（如团购授权的
+        // IP 列表）会被悄无声息地切断，且后续 read-modify-write 把截断结果写回时
+        // 造成永久数据丢失。
+        DWORD bufSize = 4096;
+        const DWORD kMaxBufSize = 1024 * 1024;  // 1MB 兜底，避免失控
+        std::vector<char> buf;
+        for (;;) {
+            buf.assign(bufSize, 0);
+            DWORD n = ::GetPrivateProfileStringA(MainKey.c_str(), SubKey.c_str(),
+                                                 def.c_str(), buf.data(), bufSize,
+                                                 m_IniFilePath);
+            // 未截断：n < bufSize - 1
+            if (n + 1 < bufSize || bufSize >= kMaxBufSize) {
+                return std::string(buf.data(), n);
+            }
+            bufSize *= 2;
+            if (bufSize > kMaxBufSize) bufSize = kMaxBufSize;
+        }
    }

    virtual bool SetStr(const std::string& MainKey, const std::string& SubKey, const std::string& Data)
--- a/common/logger.h
+++ b/common/logger.h
@@ -228,16 +228,19 @@ private:
    }

    // 后台线程处理日志
+    // 退出语义：stop() 设 running=false 后，本线程必须把队列里**已入队**的日志
+    // 全部刷盘再退出。否则进程死亡前最后几条 Mprintf（包括退出原因）会丢失。
    void processLogs()
    {
        threadRun = true;
-        while (running) {
+        while (true) {
            std::unique_lock<std::mutex> lock(queueMutex);
            cv.wait(lock, [this]() {
                return !running || !logQueue.empty();
            });

-            while (running && !logQueue.empty()) {
+            // drain：不带 running 判断，确保 stop() 时残留条目也写完
+            while (!logQueue.empty()) {
                std::string logEntry = logQueue.front();
                logQueue.pop();
                lock.unlock();
@@ -247,7 +250,9 @@ private:

                lock.lock();
            }
-            lock.unlock();
+
+            // 队列已空再决定要不要退出
+            if (!running) break;
        }
        threadRun = false;
    }
--- a/compress/ffmpeg/dav1d_x64.lib
+++ b/compress/ffmpeg/dav1d_x64.lib
--- a/compress/ffmpeg/vpl_x64.lib
+++ b/compress/ffmpeg/vpl_x64.lib
--- a/compress/ffmpeg/vpl_x64d.lib
+++ b/compress/ffmpeg/vpl_x64d.lib
--- a/docs/HardwareEncoding_Design.md
+++ b/docs/HardwareEncoding_Design.md
@@ -0,0 +1,977 @@
+# 视频编码硬件加速实现指导文档
+
+本文档供 AI 编码助手参考，用于在现有 C++ 远程控制程序中实现 H.264 硬件编码 + AV1 编码路径。
+
+---
+
+## 1. 项目背景
+
+### 1.1 当前状态
+
+- C++ Windows 远程控制程序
+- 已实现 H.264 编码，基于 x264 软编（`CX264Encoder`），preset = `ultrafast + zerolatency`
+- 视频管线：桌面捕获（RGB/BGRA）→ 编码 → 网络传输 → 客户端解码显示
+- 当前架构：每个主控端连接对应一个独立编码器实例
+- **分发模式**：单 exe，FFmpeg 静态链接
+
+### 1.2 目标
+
+分两阶段渐进推进，**始终保留 x264 软编作为兜底**：
+
+**阶段一（H.264 硬编加速）**
+- 新增 H.264 硬编（NVENC / QSV / AMF），按 GPU 能力探测优先走硬编
+- x264 软编在无 GPU / 虚拟机 / 远程桌面会话等环境下兜底
+- 浏览器解码零兼容性风险（H.264 全平台原生支持）
+
+**阶段二（AV1 路径）**
+- 新增 AV1 硬编（`av1_nvenc` / `av1_qsv` / `av1_amf`）
+- 客户端浏览器握手时声明 AV1 能力
+- 双方都能用就走 AV1，否则回落 H.264
+
+**最终产物仍为单 exe**，体积增量可接受 6–10 MB。
+
+### 1.3 关键决策记录
+
+#### 1.3.1 为什么跳过 HEVC
+
+经评估，HEVC 在本项目目标场景下没有独占价值：
+
+| 维度 | 现状 |
+|---|---|
+| **浏览器解码** | Firefox 完全不支持；Chrome/Edge 需 Win11 + 商店付费的 HEVC Video Extensions |
+| **专利授权** | 商用涉及 MPEG-LA / Access Advance / Velos Media 三个专利池 |
+| **替代方案** | AV1 压缩效率更高、AOMedia 免专利、浏览器原生支持广 |
+
+HEVC 编码端硬件普及度好（几乎所有 2015+ GPU）这个优势，被解码端短板完全抵消。
+
+#### 1.3.2 为什么 H.264 硬编先于 AV1
+
+- **AV1 硬编硬件门槛高**：仅 NVIDIA RTX 40+ / AMD RX 7000+ / Intel Arc 才有
+- **"多机混杂"场景**下大部分编码端 GPU 没有 AV1 硬编
+- **H.264 硬编**（NVENC/QSV/AMF）几乎所有现代 GPU 都有，覆盖面广
+- **客户端浏览器解 H.264** 是零兼容性问题，跨浏览器/跨平台 100% 通用
+
+H.264 硬编是先把"地板抬起来"，AV1 是"在新硬件上的天花板"。
+
+### 1.4 设计约束
+
+- **平台**：仅 Windows（macOS/Linux 未来另行设计）
+- **GPU 不确定**：NVIDIA / AMD / Intel / 无独显 / 虚拟机无 GPU 都需支持
+- **延迟要求**：不敏感（不追求极致低延迟）
+- **并发模型**：通常 1 对 1，少数 1 对多（每个连接独立编码器）
+- **客户端**：浏览器（WebCodecs 优先，`<video>` 次之），未来集成
+- **工具链**：Visual Studio 2019
+- **属性**：个人项目，暂不商用，专利问题搁置但仍优先选免专利方案
+
+---
+
+## 2. 技术方案总览
+
+### 2.1 编码器优先级链
+
+```
+新连接进入（带客户端能力）
+       │
+       ├─ 客户端声明支持 AV1？─── 否 ────┐
+       │       是                       │
+       │       ↓                        │
+       ├─ av1_nvenc/qsv/amf 能开？──┐   │
+       │       │                    │   │
+       │       成功 → 用 AV1         │   │
+       │                            ↓   ↓
+       └─ h264_nvenc/qsv/amf/mf 能开？──┐
+              │                         │
+              成功 → 用 H.264 硬编        │
+                                        ↓
+                                  x264 软编（始终可用）
+```
+
+### 2.2 编码器后端表
+
+| 类型 | FFmpeg 编码器名 | 硬件要求 | 备注 |
+|---|---|---|---|
+| AV1 硬编 | `av1_nvenc` | NVIDIA RTX 40+（Ada Lovelace） | 2022 Q4 起 |
+| AV1 硬编 | `av1_amf`   | AMD RX 7000+（RDNA 3） | 2022 Q4 起 |
+| AV1 硬编 | `av1_qsv`   | Intel Arc / 部分新 Iris Xe | 2022 起 |
+| H.264 硬编 | `h264_nvenc` | 几乎所有 NVIDIA GPU（GTX 650+） | 2012 起 |
+| H.264 硬编 | `h264_qsv`   | 几乎所有 Intel 核显（HD 4000+） | 2012 起 |
+| H.264 硬编 | `h264_amf`   | 几乎所有 AMD GPU | |
+| H.264 硬编 | `h264_mf`    | Windows Media Foundation | 兜底，质量/稳定性一般 |
+| H.264 软编 | `libx264`（现有 `CX264Encoder`） | 任意 CPU | 始终兜底 |
+
+**不使用 `libx265` / `libaom-av1` / `libsvtav1`**（CPU 软编），原因：
+- 远控产品对 CPU 占用敏感，AV1/HEVC 软编实时编码压力大
+- `libx265` 会让 FFmpeg 切到 GPL，`libaom-av1` 编码速度也不够
+
+### 2.3 类结构
+
+```
+VideoEncoderBase（新增抽象接口）
+    ├── CX264Encoder           （改造现有类继承接口，保留软编兜底）
+    ├── CFFmpegH264Encoder     （新增，封装 h264_nvenc/qsv/amf/mf）
+    └── CFFmpegAV1Encoder      （新增，封装 av1_nvenc/qsv/amf）
+```
+
+### 2.4 协商流程
+
+```
+握手阶段：
+- 客户端（浏览器）在 WebSocket 握手时上报能力：
+    { "codecs": ["av1", "h264"] }    // 浏览器实际能解的，按优先级排
+- 服务端取「客户端能力 ∩ 自己硬件能力」选 codec
+
+会话阶段：
+- 选定 codec 后创建对应编码器，整个连接生命周期不变
+- 运行中不切换 codec（保持简单，需要切换就重连）
+```
+
+---
+
+## 3. 硬编 vs 现有 x264 软编对比
+
+### 3.1 CPU 占用（最大收益）
+
+| 编码器 | 1080p @ 30fps CPU 占用 |
+|---|---|
+| x264 `ultrafast`（现状） | 单核 15–30% |
+| x264 `medium`（同画质基准） | 单核 60–100% |
+| `h264_nvenc p4` | 总 **1–3%** |
+| `h264_qsv medium` | 总 2–5% |
+| `h264_amf balanced` | 总 2–5% |
+
+被控端是用户的主力工作机，他自己还在干活。CPU 让出来意味着远控对他几乎不可感。
+
+### 3.2 同 CPU 预算下画质更高
+
+x264 的 preset 排序（同码率下画质）：
+
+```
+ultrafast < superfast < veryfast < faster < fast < medium < slow ...
+   ↑ 现状                                       ↑ 标准基准
+```
+
+NVENC `p4` 预设大致对应 x264 `fast` ~ `medium`，**画质明显优于当前 ultrafast，且 CPU 占用低一个数量级**。
+
+### 3.3 其他收益
+
+- **编码延迟稳定**：ASIC 不受 CPU 调度影响，单帧 1–5 ms
+- **笔记本电池/温度**：ASIC 几瓦，键盘不烫、风扇不转
+- **可拉高分辨率/帧率**：4K@30 / 多屏拼接软编扛不住，硬编轻松
+
+### 3.4 代价（必须接受）
+
+- **二进制 +6–10 MB**（FFmpeg 静态库，可接受）
+- **编译复杂度上升**：vcpkg 或自编 FFmpeg
+- **不同后端参数语义有差异**：rc 模式、preset 名字、bitrate 表现都不一样
+- **必须保留 x264 软编兜底**：无 GPU / 远程桌面 / 虚拟机 / NVENC session 满 等场景
+
+---
+
+## 4. 现有 H.264 编码器现状
+
+`CX264Encoder` 签名（`client/X264Encoder.cpp`）：
+
+```cpp
+class CX264Encoder
+{
+private:
+    x264_t*         m_pCodec;
+    x264_picture_t* m_pPicIn;
+    x264_picture_t* m_pPicOut;
+    x264_param_t    m_Param;
+
+public:
+    bool open(int width, int height, int fps, int crf);
+    bool open(x264_param_t* param);
+    void close();
+    int encode(uint8_t* rgb, uint8_t bpp, uint32_t stride,
+               uint32_t width, uint32_t height,
+               uint8_t** lppData, uint32_t* lpSize,
+               int direction = 1);
+};
+```
+
+集成点（`client/ScreenCapture.h`）：
+
+| 位置 | 内容 |
+|---|---|
+| `L148` | `CX264Encoder* m_encoder;`（持有具体类，需改为接口） |
+| `L926-930` | 关键帧路径硬编码 `new CX264Encoder()` |
+| `L956-960` | 增量帧路径硬编码 `new CX264Encoder()` |
+| `L170-176` | `BitRateToCRF(bitRate)` 码率→CRF 映射 |
+
+参数现状：
+- `param.i_threads = 1`
+- `preset = "ultrafast", tune = "zerolatency"`
+- `i_keyint_max = fps * 15`（15 秒一个 IDR）
+- `i_bframe = 0`、`b_open_gop = 0`
+- `rc.i_rc_method = X264_RC_CRF`（CRF 模式，未设 VBV）
+
+需要的改造（详见 §6）：
+1. `ScreenCapture::m_encoder` 改 `std::unique_ptr<VideoEncoderBase>`
+2. 编码器创建走 `CreateEncoder` 工厂
+3. 接口的 quality 语义解耦（CRF vs kbps，详见 §6.2）
+
+---
+
+## 5. FFmpeg 静态库准备
+
+### 5.1 推荐方案：vcpkg
+
+VS2019 + vcpkg 是最稳的路径：
+
+```
+vcpkg install ffmpeg[core,nvcodec,amf,qsv]:x64-windows-static-md
+```
+
+要点：
+- **三元组选 `x64-windows-static-md`**：链接静态 FFmpeg 但用动态 CRT（`/MD`），与本项目当前工程一致
+- 如果工程是 `/MT` 改用 `x64-windows-static`
+- `nvcodec` feature 引入 NVENC 头文件，`amf` 引入 AMF，`qsv` 引入 libmfx
+- 阶段一只需要 H.264，可以先不带这些 feature，但建议一次到位
+
+阶段二需要 AV1，FFmpeg 较新版本默认已支持 `av1_nvenc` / `av1_amf` / `av1_qsv`，无需额外 feature 名。
+
+### 5.2 备选方案：自编
+
+MSYS2 + MinGW-w64 + `--toolchain=msvc` 产出 MSVC 兼容 `.lib`：
+
+```bash
+./configure \
+  --prefix=/path/to/install \
+  --arch=x86_64 \
+  --target-os=mingw64 \
+  --toolchain=msvc \
+  --disable-shared --enable-static \
+  --disable-everything \
+  --disable-autodetect \
+  --disable-network \
+  --disable-doc \
+  --disable-programs \
+  --disable-debug \
+  --enable-small \
+  --enable-encoder=h264_nvenc \
+  --enable-encoder=h264_amf \
+  --enable-encoder=h264_qsv \
+  --enable-encoder=h264_mf \
+  --enable-encoder=av1_nvenc \
+  --enable-encoder=av1_amf \
+  --enable-encoder=av1_qsv \
+  --enable-protocol=file
+```
+
+**不要** `--enable-gpl` 或 `--enable-libx265 / --enable-libaom`，保持 LGPL 且避免软编 H.265/AV1。
+
+### 5.3 工程链接配置（MSVC）
+
+**附加包含目录**（C/C++ → 常规）：
+```
+$(VcpkgRoot)\installed\x64-windows-static-md\include
+```
+
+**附加库目录**（链接器 → 常规）：
+```
+$(VcpkgRoot)\installed\x64-windows-static-md\lib
+```
+
+**附加依赖项**（链接器 → 输入）：
+```
+avcodec.lib
+avutil.lib
+swresample.lib
+
+# FFmpeg 静态链接依赖的 Windows 系统库
+mfplat.lib
+mfuuid.lib
+strmiids.lib
+ws2_32.lib
+secur32.lib
+bcrypt.lib
+```
+
+**预处理器定义**：
+```
+ENABLE_HW_ENCODER
+__STDC_CONSTANT_MACROS    # FFmpeg C 头文件在 C++ 中需要
+```
+
+---
+
+## 6. 实现任务清单
+
+### 6.1 文件清单
+
+| 文件 | 操作 | 说明 |
+|---|---|---|
+| `VideoEncoderBase.h` | 新增 | 抽象基类 + EncoderParams |
+| `X264Encoder.h/.cpp` | 修改 | 继承 `VideoEncoderBase`，新增 `forceIDR()` / `codec()` / `backendName()` |
+| `CFFmpegH264Encoder.h/.cpp` | 新增（阶段一） | 封装 `h264_nvenc/qsv/amf/mf` |
+| `CFFmpegAV1Encoder.h/.cpp` | 新增（阶段二） | 封装 `av1_nvenc/qsv/amf` |
+| `EncoderFactory.h/.cpp` | 新增 | 工厂 + 多后端探测 |
+| `EncoderProbe.h/.cpp` | 新增 | 启动时一次性探测可用后端，缓存结果 |
+| `ScreenCapture.h` | 修改 | `m_encoder` 改 `std::unique_ptr<VideoEncoderBase>` |
+| 握手协议代码 | 修改（阶段二） | 加 `codecs` 能力字段 |
+| 工程配置 | 修改 | FFmpeg 静态库链接（详见 §5.3） |
+
+### 6.2 抽象接口定义
+
+`VideoEncoderBase.h`：
+
+```cpp
+#pragma once
+#include <cstdint>
+
+enum class VideoCodec { H264, AV1 };
+enum class RateControl { CRF, BITRATE };
+
+struct EncoderParams {
+    int width;
+    int height;
+    int fps;
+    RateControl rc = RateControl::BITRATE;
+    int crf = 23;            // 当 rc == CRF 时使用（x264 路径）
+    int bitrate_kbps = 4000; // 当 rc == BITRATE 时使用（硬编路径）
+    int gop_seconds = 4;     // 关键帧间隔（秒），编码器内部转 frames
+};
+
+class VideoEncoderBase {
+public:
+    virtual ~VideoEncoderBase() = default;
+
+    virtual bool open(const EncoderParams& params) = 0;
+    virtual void close() = 0;
+
+    virtual int encode(
+        uint8_t* rgb,
+        uint8_t  bpp,
+        uint32_t stride,
+        uint32_t width,
+        uint32_t height,
+        uint8_t** lppData,
+        uint32_t* lpSize,
+        int direction = 1
+    ) = 0;
+
+    virtual void forceIDR() = 0;
+    virtual void setBitrate(int kbps) {}   // 默认空实现
+    virtual VideoCodec codec() const = 0;
+    virtual const char* backendName() const = 0;  // "x264" / "h264_nvenc" / "av1_amf" ...
+};
+```
+
+设计要点：
+- **抛弃** `open(w, h, fps, quality)` 的设计 —— `quality` 在 H.264 是 CRF、在硬编是 kbps，语义不清楚是坑
+- 改用 `EncoderParams` 结构体 + `RateControl` 枚举，明确指定速率控制模式
+- `backendName()` 返回实际后端名（"x264" / "h264_nvenc" / "av1_amf"），调用方可用于日志/监控
+
+### 6.3 CFFmpegH264Encoder 设计
+
+```cpp
+#pragma once
+#include "VideoEncoderBase.h"
+#include <vector>
+#include <string>
+
+extern "C" {
+#include <libavcodec/avcodec.h>
+#include <libavutil/opt.h>
+#include <libavutil/imgutils.h>
+}
+
+class CFFmpegH264Encoder : public VideoEncoderBase {
+public:
+    CFFmpegH264Encoder();
+    ~CFFmpegH264Encoder() override;
+
+    bool open(const EncoderParams& params) override;
+    void close() override;
+
+    int encode(uint8_t* rgb, uint8_t bpp, uint32_t stride,
+               uint32_t width, uint32_t height,
+               uint8_t** lppData, uint32_t* lpSize,
+               int direction = 1) override;
+
+    void forceIDR() override;
+    void setBitrate(int kbps) override;
+    VideoCodec codec() const override { return VideoCodec::H264; }
+    const char* backendName() const override { return m_backend.c_str(); }
+
+private:
+    bool tryOpenBackend(const char* name, const EncoderParams& p);
+    void cleanupCodec();
+    int convertToNV12(uint8_t* rgb, uint8_t bpp, uint32_t stride,
+                      uint32_t width, uint32_t height, int direction);
+
+    AVCodecContext* m_ctx     = nullptr;
+    AVFrame*        m_frame   = nullptr;
+    AVPacket*       m_packet  = nullptr;
+    std::vector<uint8_t> m_outputBuffer;
+    std::vector<uint8_t> m_i420Scratch;   // RGB24 路径用
+    int64_t  m_pts       = 0;
+    bool     m_forceIDR  = false;
+    std::string m_backend;
+};
+```
+
+#### 6.3.1 后端探测顺序
+
+```cpp
+static const char* kH264Backends[] = {
+    "h264_nvenc",   // NVIDIA：质量/速度/稳定性都最好
+    "h264_qsv",     // Intel：核显普及度高
+    "h264_amf",     // AMD
+    "h264_mf",      // Media Foundation 兜底（可选，质量一般）
+};
+
+bool CFFmpegH264Encoder::open(const EncoderParams& p) {
+    for (auto name : kH264Backends) {
+        if (tryOpenBackend(name, p)) {
+            m_backend = name;
+            return true;
+        }
+        cleanupCodec();
+    }
+    return false;
+}
+```
+
+#### 6.3.2 各后端参数差异
+
+```cpp
+bool CFFmpegH264Encoder::tryOpenBackend(const char* name, const EncoderParams& p) {
+    const AVCodec* codec = avcodec_find_encoder_by_name(name);
+    if (!codec) return false;
+
+    m_ctx = avcodec_alloc_context3(codec);
+    if (!m_ctx) return false;
+
+    // 通用参数
+    m_ctx->width        = p.width;
+    m_ctx->height       = p.height;
+    m_ctx->time_base    = {1, p.fps};
+    m_ctx->framerate    = {p.fps, 1};
+    m_ctx->pix_fmt      = AV_PIX_FMT_NV12;
+    m_ctx->gop_size     = p.fps * p.gop_seconds;
+    m_ctx->max_b_frames = 0;
+    m_ctx->bit_rate     = (int64_t)p.bitrate_kbps * 1000;
+    m_ctx->rc_max_rate  = (int64_t)p.bitrate_kbps * 1500;
+    m_ctx->rc_buffer_size = (int)(p.bitrate_kbps * 1000);
+
+    if (strcmp(name, "h264_nvenc") == 0) {
+        av_opt_set(m_ctx->priv_data, "preset", "p4", 0);
+        av_opt_set(m_ctx->priv_data, "tune", "ll", 0);
+        av_opt_set(m_ctx->priv_data, "rc", "cbr", 0);
+        av_opt_set(m_ctx->priv_data, "zerolatency", "1", 0);
+        av_opt_set(m_ctx->priv_data, "delay", "0", 0);
+    } else if (strcmp(name, "h264_qsv") == 0) {
+        av_opt_set(m_ctx->priv_data, "preset", "medium", 0);
+        av_opt_set_int(m_ctx->priv_data, "async_depth", 1, 0);
+        av_opt_set_int(m_ctx->priv_data, "low_power", 0, 0);
+    } else if (strcmp(name, "h264_amf") == 0) {
+        av_opt_set(m_ctx->priv_data, "usage", "lowlatency", 0);
+        av_opt_set(m_ctx->priv_data, "quality", "balanced", 0);
+        av_opt_set(m_ctx->priv_data, "rc", "cbr", 0);
+    } else if (strcmp(name, "h264_mf") == 0) {
+        av_opt_set_int(m_ctx->priv_data, "hw_encoding", 1, 0);
+        av_opt_set(m_ctx->priv_data, "rate_control", "cbr", 0);
+    }
+
+    if (avcodec_open2(m_ctx, codec, nullptr) < 0) return false;
+
+    m_frame = av_frame_alloc();
+    m_frame->format = AV_PIX_FMT_NV12;
+    m_frame->width  = p.width;
+    m_frame->height = p.height;
+    if (av_frame_get_buffer(m_frame, 32) < 0) return false;
+
+    m_packet = av_packet_alloc();
+    return m_packet != nullptr;
+}
+```
+
+#### 6.3.3 encode 实现
+
+```cpp
+int CFFmpegH264Encoder::encode(
+    uint8_t* rgb, uint8_t bpp, uint32_t stride,
+    uint32_t width, uint32_t height,
+    uint8_t** lppData, uint32_t* lpSize, int direction)
+{
+    if (av_frame_make_writable(m_frame) < 0) return -1;
+
+    // 像素格式转换（直接用 libyuv，与现有 x264 路径保持一致，不引入 sws_scale）
+    int signed_height = direction * (int)height;
+    if (bpp == 32) {
+        libyuv::ARGBToNV12(
+            rgb, stride,
+            m_frame->data[0], m_frame->linesize[0],
+            m_frame->data[1], m_frame->linesize[1],
+            width, signed_height
+        );
+    } else if (bpp == 24) {
+        if (convertToNV12(rgb, bpp, stride, width, height, direction) != 0)
+            return -1;
+    } else {
+        return -2;
+    }
+
+    m_frame->pts = m_pts++;
+
+    if (m_forceIDR) {
+        m_frame->pict_type = AV_PICTURE_TYPE_I;
+        m_frame->key_frame = 1;
+        m_forceIDR = false;
+    } else {
+        m_frame->pict_type = AV_PICTURE_TYPE_NONE;
+        m_frame->key_frame = 0;
+    }
+
+    if (avcodec_send_frame(m_ctx, m_frame) < 0) return -3;
+
+    int ret = avcodec_receive_packet(m_ctx, m_packet);
+    if (ret == AVERROR(EAGAIN)) {
+        // 首帧延迟正常情况：返回成功但本次无输出
+        *lpSize = 0;
+        *lppData = nullptr;
+        return 0;
+    }
+    if (ret < 0) return -4;
+
+    m_outputBuffer.assign(m_packet->data, m_packet->data + m_packet->size);
+    *lppData = m_outputBuffer.data();
+    *lpSize  = (uint32_t)m_outputBuffer.size();
+    av_packet_unref(m_packet);
+    return 0;
+}
+```
+
+#### 6.3.4 RGB24 → NV12（libyuv 无直接 API，两步走）
+
+```cpp
+int CFFmpegH264Encoder::convertToNV12(uint8_t* rgb, uint8_t /*bpp*/,
+                                      uint32_t stride, uint32_t width, uint32_t height,
+                                      int direction)
+{
+    int signed_height = direction * (int)height;
+    int y_size  = width * height;
+    int uv_size = (width / 2) * (height / 2);
+    m_i420Scratch.resize(y_size + 2 * uv_size);
+
+    uint8_t* y = m_i420Scratch.data();
+    uint8_t* u = y + y_size;
+    uint8_t* v = u + uv_size;
+
+    libyuv::RGB24ToI420(
+        rgb, stride,
+        y, width,
+        u, width / 2,
+        v, width / 2,
+        width, signed_height
+    );
+    libyuv::I420ToNV12(
+        y, width,
+        u, width / 2,
+        v, width / 2,
+        m_frame->data[0], m_frame->linesize[0],
+        m_frame->data[1], m_frame->linesize[1],
+        width, height
+    );
+    return 0;
+}
+```
+
+### 6.4 CFFmpegAV1Encoder 设计
+
+结构与 `CFFmpegH264Encoder` **完全对称**，仅 backend 名换：
+
+```cpp
+static const char* kAV1Backends[] = {
+    "av1_nvenc",   // RTX 40+
+    "av1_amf",     // RX 7000+
+    "av1_qsv",     // Intel Arc / 部分 11 代+ 核显
+};
+```
+
+参数差异（av1_nvenc 与 h264_nvenc 略有不同）：
+
+```cpp
+if (strcmp(name, "av1_nvenc") == 0) {
+    av_opt_set(m_ctx->priv_data, "preset", "p4", 0);
+    av_opt_set(m_ctx->priv_data, "tune", "ll", 0);
+    av_opt_set(m_ctx->priv_data, "rc", "cbr", 0);
+    // AV1 特有：tile-columns/rows 可调，多核解码更友好
+    av_opt_set_int(m_ctx->priv_data, "tile-columns", 1, 0);
+} else if (strcmp(name, "av1_amf") == 0) {
+    av_opt_set(m_ctx->priv_data, "usage", "lowlatency", 0);
+    av_opt_set(m_ctx->priv_data, "quality", "balanced", 0);
+    av_opt_set(m_ctx->priv_data, "rc", "cbr", 0);
+} else if (strcmp(name, "av1_qsv") == 0) {
+    av_opt_set(m_ctx->priv_data, "preset", "medium", 0);
+    av_opt_set_int(m_ctx->priv_data, "async_depth", 1, 0);
+}
+```
+
+实现建议：先把 `CFFmpegH264Encoder` 跑通稳定，**再把它复制改名做 AV1 版本**。同步两个类的逻辑可以后续考虑抽公共基类，但不要为了 DRY 提前抽。
+
+### 6.5 EncoderFactory 与探测
+
+`EncoderFactory.h`：
+
+```cpp
+#pragma once
+#include "VideoEncoderBase.h"
+#include <memory>
+
+struct ClientCapability {
+    bool supportAV1  = false;
+    bool supportH264 = true;   // 假定都支持
+};
+
+struct EncoderRequest {
+    int width, height, fps;
+    int bitrate_kbps;
+    ClientCapability client;
+};
+
+std::unique_ptr<VideoEncoderBase> CreateEncoder(const EncoderRequest& req);
+```
+
+`EncoderFactory.cpp`：
+
+```cpp
+#include "EncoderFactory.h"
+#include "EncoderProbe.h"
+#include "CFFmpegAV1Encoder.h"
+#include "CFFmpegH264Encoder.h"
+#include "X264Encoder.h"
+
+std::unique_ptr<VideoEncoderBase> CreateEncoder(const EncoderRequest& req) {
+    EncoderParams p;
+    p.width  = req.width;
+    p.height = req.height;
+    p.fps    = req.fps;
+
+    // 1. AV1 路径（仅当客户端支持且启动探测确认硬件可用）
+    if (req.client.supportAV1 && EncoderProbe::HasAV1Hw()) {
+        auto enc = std::make_unique<CFFmpegAV1Encoder>();
+        p.rc = RateControl::BITRATE;
+        p.bitrate_kbps = req.bitrate_kbps;
+        if (enc->open(p)) {
+            LOG_INFO("encoder: AV1 backend=%s", enc->backendName());
+            return enc;
+        }
+        LOG_WARN("encoder: AV1 open failed, falling back to H.264");
+    }
+
+    // 2. H.264 硬编路径
+    if (EncoderProbe::HasH264Hw()) {
+        auto enc = std::make_unique<CFFmpegH264Encoder>();
+        p.rc = RateControl::BITRATE;
+        p.bitrate_kbps = req.bitrate_kbps;
+        if (enc->open(p)) {
+            LOG_INFO("encoder: H264-HW backend=%s", enc->backendName());
+            return enc;
+        }
+        LOG_WARN("encoder: H264 HW open failed, falling back to x264");
+    }
+
+    // 3. H.264 软编兜底（始终可用）
+    {
+        auto enc = std::make_unique<CX264Encoder>();
+        p.rc = RateControl::CRF;
+        p.crf = BitRateToCRF(req.bitrate_kbps);
+        if (enc->open(p)) {
+            LOG_INFO("encoder: H264-SW (libx264)");
+            return enc;
+        }
+    }
+
+    LOG_ERROR("encoder: all backends failed");
+    return nullptr;
+}
+```
+
+要点：
+- **不要**引入会话池（`HEVCSessionPool` 那套）—— 个人项目场景下不需要
+- NVENC session 限制由 FFmpeg 自己报错，工厂捕获后自动降级
+- 失败路径都打日志，方便定位
+
+### 6.6 启动时一次性后端探测
+
+避免每个新连接都重复尝试每个 backend：
+
+```cpp
+// EncoderProbe.h
+class EncoderProbe {
+public:
+    static void RunOnce();                 // 程序启动时调用一次
+    static bool HasAV1Hw();
+    static bool HasH264Hw();
+    static const char* PreferredAV1Backend();   // 第一个能用的 AV1 后端名
+    static const char* PreferredH264Backend();
+};
+
+// EncoderProbe.cpp 实现思路：
+// 对每个候选后端尝试 alloc_context → open2 → free
+// 用最低分辨率（如 640x480 @30fps）减少探测开销
+// 结果缓存在静态变量，加 std::once_flag 保证线程安全
+```
+
+启动时探测 1 次，运行时 `CreateEncoder` 直接读结果。
+
+### 6.7 ScreenCapture.h 改造
+
+**当前**（`client/ScreenCapture.h:148, 926-930, 956-960`）：
+```cpp
+CX264Encoder* m_encoder;
+// ...
+m_encoder = new CX264Encoder();
+int br = (m_nBitRate > 0) ? m_nBitRate : (width * height / 1266);
+m_encoder->open(width, height, 20, BitRateToCRF(br));
+```
+
+**改造后**：
+```cpp
+std::unique_ptr<VideoEncoderBase> m_encoder;
+ClientCapability m_clientCap;   // 握手阶段填入
+// ...
+if (!m_encoder) {
+    EncoderRequest req{
+        (int)width, (int)height, 20,
+        m_nBitRate > 0 ? m_nBitRate : (int)(width * height / 1266),
+        m_clientCap
+    };
+    m_encoder = CreateEncoder(req);
+    if (!m_encoder) return nullptr;
+}
+int err = m_encoder->encode(nextData, 32, 4 * width, width, height,
+                            &encoded_data, &encoded_size);
+```
+
+注意：两处 `new CX264Encoder()` 提取成一个 `ensureEncoder()` 私有方法，避免重复。
+
+### 6.8 协议握手（阶段二）
+
+客户端浏览器 WebSocket 连接时上报：
+
+```json
+{
+  "type": "client_capability",
+  "codecs": ["av1", "h264"]
+}
+```
+
+浏览器端探测脚本（JS）：
+
+```javascript
+async function probeBrowserCodecs() {
+    const codecs = [];
+    if (typeof VideoDecoder !== 'undefined') {
+        // AV1 Main Profile, Level 4.0, 8-bit
+        const av1 = await VideoDecoder.isConfigSupported({ codec: 'av01.0.04M.08' });
+        if (av1.supported) codecs.push('av1');
+    }
+    codecs.push('h264');   // 兜底假定支持，<video> 标签也支持
+    return codecs;
+}
+```
+
+**向后兼容**：老版本客户端不发 `codecs` 字段 → 服务端按 H.264 处理。`ClientCapability::supportAV1` 默认 false。
+
+可参考 `docs/hevc_browser_decode_test.html`（改造一份 AV1 版本）做浏览器解码端到端验证。
+
+---
+
+## 7. 像素格式与转换
+
+保持与现有 x264 路径完全一致的做法：
+
+- **硬编内部格式**：`AV_PIX_FMT_NV12`（NVENC/QSV/AMF 通用）
+- **转换库**：libyuv（不引入 `sws_scale`）
+- **BGRA → NV12**：`libyuv::ARGBToNV12` 直接
+- **RGB24 → NV12**：libyuv 无直接 API，分两步 RGB24 → I420 → NV12
+- **direction 参数**：沿用现有 `X264Encoder.cpp:136` 的写法（`direction * height` 作为乘子）
+
+---
+
+## 8. 测试要求
+
+### 8.1 单元测试
+
+- `VideoEncoderBase` 各实现的 `open / encode / close` 生命周期
+- `CFFmpegH264Encoder` 在缺失各后端时降级到下一个
+- `EncoderFactory` 在不同 `ClientCapability` × 硬件能力 矩阵下返回正确后端
+- `EncoderProbe::RunOnce()` 在不同 GPU 上的结果一致性
+
+### 8.2 集成测试
+
+| 场景 | 期望 |
+|---|---|
+| 客户端支持 AV1 + 编码端 RTX 40 | 使用 AV1（`av1_nvenc`） |
+| 客户端支持 AV1 + 编码端 GTX 1080 | 降级 H.264 硬编（`h264_nvenc`） |
+| 客户端不支持 AV1 + 编码端任意 | H.264（硬编优先） |
+| 编码端无 GPU / 虚拟机 | x264 软编 |
+| 编码端集显 + 独显 | 优先级中第一个成功的后端 |
+| 中途客户端能力变化 | 当前连接不变；下次握手按新能力 |
+| H264 硬编创建失败 | 自动回落 x264 软编，连接不断 |
+
+### 8.3 硬件验证矩阵
+
+| 编码端 | 客户端浏览器 | 期望 |
+|---|---|---|
+| RTX 40 / 50 | Chrome / Firefox / Edge | AV1 |
+| GTX 10/16 / RTX 20/30 | Chrome / Firefox / Edge | H.264 NVENC |
+| Intel Arc | Chrome / Firefox | AV1（`av1_qsv`） |
+| Intel 12 代+ 核显 | Chrome / Firefox | H.264 QSV |
+| AMD RX 7000+ | Chrome / Firefox | AV1（`av1_amf`） |
+| AMD 老卡 | Chrome / Firefox | H.264 AMF |
+| 虚拟机 / 远程桌面会话 | 任意 | x264 软编 |
+| iOS Safari < 17 | 任意编码端 | H.264 |
+| iOS Safari ≥ 17（A17 Pro+） | 任意编码端 | AV1 优先 |
+
+### 8.4 体积验证
+
+- exe 体积增量 < 12 MB（vcpkg 静态链接，含 AV1+H264 全后端）
+- 若超出明显，检查 vcpkg feature 是否引入了不需要的 codec
+
+### 8.5 回归测试（关键）
+
+每一步改造后必须验证：
+- 现有 x264 软编通路完全可用（在禁用所有硬编后端的环境下）
+- 现有客户端（不发 `codecs` 字段）可正常工作
+- 编码码流向后兼容，老客户端能解
+
+---
+
+## 9. 已知风险与注意事项
+
+### 9.1 多 GPU 跨适配器
+笔记本集显+独显场景，FFmpeg 默认走主显卡。可能报 "failed to create device"。**Catch 后回落到下一个后端**，不要直接终止。
+
+### 9.2 第一帧延迟
+FFmpeg 硬编可能在首次 `send_frame` 后 `receive_packet` 返回 `EAGAIN`。调用方代码必须能处理 `*lpSize == 0` 的情况（返回 0 表示成功但本次无输出）。`ScreenCapture::GetNextScreenData` 当前 `encoded_size == 0` 会怎么处理需要确认。
+
+### 9.3 NVENC session 数限制
+NVIDIA **消费级**卡（GeForce）有 NVENC session 上限（驱动 522.25+ 起 3 个，更新版可能放宽到 5）。多连接超限时 `open` 失败 → 工厂自动降级到 QSV/AMF/x264。**不要做"会话池"提前拦截** —— 让 FFmpeg 自己报错，工厂处理。
+
+### 9.4 浏览器解 AV1 的硬件依赖
+- 桌面 Chrome/Firefox/Edge：软解兜底（CPU 占用高，但能用）
+- 移动端：iPhone 15 Pro+ / M3+ 才有 AV1 硬解，老设备只能软解（可能卡）
+- `isConfigSupported` 报 true 不等于跑得流畅。**建议握手时也带上设备类型**，弱设备强制走 H.264
+
+### 9.5 LGPL 静态链接合规
+个人项目暂搁置。商用前需法务确认（FFmpeg 源代码提供、重新链接能力等）。
+
+### 9.6 配置项（建议）
+
+建议做成 INI/JSON：
+```
+encoder.prefer_av1            = true
+encoder.h264.bitrate_default  = 4000   (kbps)
+encoder.fallback_to_x264      = true
+encoder.probe_at_startup      = true
+encoder.disable_h264_mf       = true   (h264_mf 质量一般，可禁用)
+```
+
+### 9.7 日志要求
+
+关键路径必须有日志：
+- 启动探测结果：每个后端是否可用 + 失败原因（`av_err2str`）
+- 每个连接选定的 `codec` + `backend`（INFO）
+- 后端打开失败 + 回落（WARN）
+- 编码过程中的异常（ERROR）
+
+### 9.8 线程安全
+- 每个编码器实例不跨线程
+- `EncoderProbe` 单例首次初始化加 `std::once_flag`
+- FFmpeg 新版本不需要全局初始化（`av_register_all` 已废弃）
+
+### 9.9 与现有 `DISABLE_X264_FOR_TEST` 编译开关协同
+项目已有 `DISABLE_X264_FOR_TEST` 宏（见 `X264Encoder.cpp:5`）和最近 `c0a632a` 提交"Compliance: Add building option to disable x264 and ffmpeg"。新代码须遵循同样的可禁用约定：
+- `ENABLE_HW_ENCODER` 关闭时整个 `CFFmpegH264Encoder` / `CFFmpegAV1Encoder` 编译为空实现或不参与链接
+- 工厂在该宏关闭时直接返回 `CX264Encoder`
+
+---
+
+## 10. 实现顺序建议
+
+**每一步独立可合入**，每一步完成后 x264 通路必须可用、客户端无感知。
+
+### Step 0：抽象层（零功能改动）
+1. 新建 `VideoEncoderBase.h`，定义接口 + `EncoderParams` + `RateControl`
+2. `CX264Encoder` 改造继承 `VideoEncoderBase`：
+   - 新增 `forceIDR()`（设置一个标志，下次 encode 时通过 `x264_picture_t::i_type = X264_TYPE_IDR`）
+   - 实现 `codec()` 返回 `H264`
+   - 实现 `backendName()` 返回 `"x264"`
+   - 旧 `open(w, h, fps, crf)` 签名保留，转调新的 `open(EncoderParams)`
+3. `ScreenCapture::m_encoder` 改 `std::unique_ptr<VideoEncoderBase>`，但仍直接 `new CX264Encoder`
+4. **不引 FFmpeg、不引工厂**
+5. 验证：H.264 通路完全不变，对外行为零变化
+
+### Step 1：FFmpeg 集成 + `h264_nvenc` 单后端
+1. vcpkg 安装 `ffmpeg[core,nvcodec]:x64-windows-static-md`
+2. 工程添加包含目录 / 库目录 / 系统库
+3. 新建 `CFFmpegH264Encoder`，仅实现 `h264_nvenc`
+4. 在 `ScreenCapture` 加临时开关：硬编码切到 `CFFmpegH264Encoder` 跑一下
+5. 用浏览器解码 demo 验证码流能解
+6. 体积验证（应 +4–6 MB）
+
+### Step 2：扩展 H.264 硬编后端
+1. `CFFmpegH264Encoder` 加 `h264_qsv` / `h264_amf` 探测
+2. 顺序：`nvenc → qsv → amf`（`mf` 可暂不接）
+3. 不同后端的参数适配（见 §6.3.2）
+4. 测试 Intel 核显 + AMD 卡
+
+### Step 3：工厂 + 软编兜底
+1. 新建 `EncoderFactory` / `EncoderProbe`
+2. 工厂按 `H264 硬编 → x264 软编` 顺序
+3. `ScreenCapture` 改用工厂（消除两处 `new CX264Encoder`）
+4. 测试无 GPU 环境降级到 x264
+
+### Step 4：AV1 路径（独立闭环）
+1. 重跑 vcpkg：`ffmpeg[core,nvcodec,amf,qsv]:x64-windows-static-md`
+2. 新建 `CFFmpegAV1Encoder`，结构与 H.264 对称（直接 copy + 改 backend 名 + 调参）
+3. `EncoderProbe` 加 AV1 探测
+4. 工厂前置 AV1 路径
+5. 硬件验证矩阵执行
+
+### Step 5：握手协商 + 浏览器探测
+1. 客户端 JS `isConfigSupported` 探测 AV1 / H.264
+2. WebSocket 握手字段 `codecs` 上报
+3. 服务端解析后填入 `ClientCapability`
+4. 老客户端向后兼容（无 `codecs` 字段 → 默认 H.264）
+5. 端到端验证：编码端 RTX 40 + 浏览器 Chrome 走 AV1，回落场景走 H.264
+
+---
+
+## 11. 不在本次范围
+
+- HEVC 编码（决策已排除，见 §1.3.1）
+- 软编 AV1（libaom / SVT-AV1，CPU 占用不适合远控）
+- 运行中动态切换 codec（需要切换就重连）
+- 转发流（1 路编码多路分发）
+- 桌面捕获共享
+- 客户端浏览器解码具体实现（可参考 `docs/hevc_browser_decode_test.html` 改 AV1 版本验证）
+- Linux/macOS 移植
+- FFmpeg DLL 形式分发
+
+---
+
+## 12. 参考资料
+
+- FFmpeg 编码器列表：`ffmpeg -encoders | grep -E "h264|av1"`
+- NVENC 参数：`ffmpeg -h encoder=h264_nvenc`、`ffmpeg -h encoder=av1_nvenc`
+- QSV 参数：`ffmpeg -h encoder=h264_qsv`、`ffmpeg -h encoder=av1_qsv`
+- AMF 参数：`ffmpeg -h encoder=h264_amf`、`ffmpeg -h encoder=av1_amf`
+- NVIDIA Video Codec Support Matrix：https://developer.nvidia.com/video-encode-and-decode-gpu-support-matrix-new
+- WebCodecs API：https://developer.mozilla.org/en-US/docs/Web/API/WebCodecs_API
+- libyuv：https://chromium.googlesource.com/libyuv/libyuv/
+- vcpkg ffmpeg port：https://github.com/microsoft/vcpkg/tree/master/ports/ffmpeg
+- FFmpeg HWAccel Intro：https://trac.ffmpeg.org/wiki/HWAccelIntro
+- AOMedia AV1：https://aomedia.org/
+
+---
+
+**文档结束**
+
+实现时如遇到本文档未覆盖的设计抉择，优先选择**简单、与现有 x264 通路对称、不破坏已有功能、不增加运行时外部依赖**的方案，并在代码注释中说明决策依据。
--- a/linux/install.sh
+++ b/linux/install.sh
@@ -0,0 +1,152 @@
+#!/usr/bin/env bash
+# YAMA Ghost (Linux client) — install + autostart deployment
+#
+# 用法（在解压/克隆后的 linux/ 目录下）：
+#   ./install.sh                # 默认安装到 ~/.local/bin/ghost
+#   ./install.sh /opt/yama      # 安装到 /opt/yama/ghost（如需要会自动 sudo）
+#
+# 行为：
+#   1. 复制 ghost 二进制到目标位置并加可执行权
+#   2. 注册 XDG Autostart（~/.config/autostart/ghost.desktop）
+#   3. 可选立即启动一次（继承当前桌面会话的 X 环境）
+
+set -euo pipefail
+
+# ---- 防止以 root 直接运行 ----
+# 用 sudo 跑会让 $HOME 变成 /root（或 sudo 配置决定的值），
+# autostart 写到 /root/.config/autostart/，桌面用户的 session 看不见，
+# 自启动完全失效。需要 sudo 的地方（如装到 /opt/...），脚本会按需自调用 sudo。
+if [[ "${EUID:-$(id -u)}" -eq 0 ]]; then
+    echo "请用普通用户身份运行此脚本，不要 sudo。" >&2
+    echo "如目标目录需要 root 权限，脚本会按需自动调用 sudo。" >&2
+    exit 1
+fi
+
+# ---- 颜色 ----
+if [[ -t 1 ]]; then
+    C_RED=$'\033[31m'; C_GREEN=$'\033[32m'; C_YELLOW=$'\033[33m'
+    C_BLUE=$'\033[34m'; C_BOLD=$'\033[1m'; C_RESET=$'\033[0m'
+else
+    C_RED=''; C_GREEN=''; C_YELLOW=''; C_BLUE=''; C_BOLD=''; C_RESET=''
+fi
+
+info()  { echo "${C_BLUE}[INFO]${C_RESET}  $*"; }
+ok()    { echo "${C_GREEN}[ OK ]${C_RESET}  $*"; }
+warn()  { echo "${C_YELLOW}[WARN]${C_RESET}  $*"; }
+error() { echo "${C_RED}[FAIL]${C_RESET}  $*" >&2; }
+
+# ---- 路径解析 ----
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SRC_BIN="${SCRIPT_DIR}/ghost"
+
+# 安装目标目录（参数 $1，默认 ~/.local/bin）
+INSTALL_DIR="${1:-${HOME}/.local/bin}"
+DEST_BIN="${INSTALL_DIR}/ghost"
+
+AUTOSTART_DIR="${XDG_CONFIG_HOME:-${HOME}/.config}/autostart"
+AUTOSTART_FILE="${AUTOSTART_DIR}/ghost.desktop"
+
+echo "${C_BOLD}YAMA Ghost Linux 安装${C_RESET}"
+echo "  源: ${SRC_BIN}"
+echo "  目标: ${DEST_BIN}"
+echo "  自启动: ${AUTOSTART_FILE}"
+echo ""
+
+# ---- 前置检查 ----
+if [[ ! -f "${SRC_BIN}" ]]; then
+    error "找不到 ghost 二进制 ${SRC_BIN}"
+    error "请把 install.sh 放在 ghost 同目录后再运行"
+    exit 1
+fi
+
+if ! file "${SRC_BIN}" 2>/dev/null | grep -q "ELF.*executable"; then
+    error "${SRC_BIN} 不是有效的 ELF 可执行文件"
+    exit 1
+fi
+
+# 判断目标目录是否需要 sudo
+# 三种情况都要走 sudo 分支：
+#   a) 目录不存在且父目录无写权（如 /opt/yama 父是 /opt root-owned）
+#   b) 目录已存在但当前用户无写权（如已存在的 /usr/local/bin root-owned）
+#   c) 介于两者之间的情况由 mkdir 的退出码决定
+NEED_SUDO=""
+if [[ -d "${INSTALL_DIR}" ]]; then
+    [[ -w "${INSTALL_DIR}" ]] || NEED_SUDO="sudo"
+else
+    if ! mkdir -p "${INSTALL_DIR}" 2>/dev/null; then
+        NEED_SUDO="sudo"
+    fi
+fi
+if [[ -n "${NEED_SUDO}" ]]; then
+    info "目标目录需要 root 权限，将使用 sudo（可能需要输入密码）"
+    ${NEED_SUDO} mkdir -p "${INSTALL_DIR}"
+fi
+
+# ---- 1. 如已运行则先停止 ----
+if pgrep -x ghost > /dev/null; then
+    warn "检测到 ghost 进程正在运行，先停止以替换二进制"
+    pkill -x ghost || true
+    sleep 1
+    if pgrep -x ghost > /dev/null; then
+        warn "进程未优雅退出，强制 kill"
+        pkill -9 -x ghost || true
+        sleep 1
+    fi
+    ok "旧进程已停止"
+fi
+
+# ---- 2. 复制二进制 ----
+info "复制 ghost 到 ${DEST_BIN}"
+${NEED_SUDO} install -m 0755 "${SRC_BIN}" "${DEST_BIN}"
+ok "二进制已部署 (mode 0755)"
+
+# ---- 3. 写 XDG Autostart 文件 ----
+mkdir -p "${AUTOSTART_DIR}"
+cat > "${AUTOSTART_FILE}" <<EOF
+[Desktop Entry]
+Type=Application
+Name=YAMA Ghost
+Comment=YAMA remote control client
+Exec=${DEST_BIN}
+Terminal=false
+X-GNOME-Autostart-enabled=true
+NoDisplay=true
+StartupNotify=false
+EOF
+ok "Autostart 已注册"
+
+# 验证 .desktop 格式（如果系统装了 desktop-file-validate）
+if command -v desktop-file-validate >/dev/null 2>&1; then
+    if desktop-file-validate "${AUTOSTART_FILE}" >/dev/null 2>&1; then
+        ok "Autostart 文件格式验证通过"
+    else
+        warn "desktop-file-validate 报告了警告，但通常不影响功能"
+    fi
+fi
+
+# ---- 4. 可选：立即启动 ----
+echo ""
+echo -n "${C_BOLD}是否立即启动 ghost（验证 X 环境）？[Y/n]${C_RESET} "
+read -r ans
+if [[ -z "${ans}" || "${ans}" =~ ^[Yy]$ ]]; then
+    if [[ -z "${DISPLAY:-}" ]]; then
+        warn "当前 shell 没有 DISPLAY 变量，可能不在桌面会话内 — 启动后远控仍可能 0x0"
+        warn "建议在 GNOME 终端/桌面环境的终端里运行此脚本"
+    fi
+    nohup "${DEST_BIN}" >/dev/null 2>&1 &
+    sleep 1
+    if pgrep -x ghost > /dev/null; then
+        ok "ghost 已启动 (PID=$(pgrep -x ghost | head -1))"
+    else
+        error "启动失败，请手动跑 ${DEST_BIN} 看错误输出"
+        exit 1
+    fi
+fi
+
+echo ""
+echo "${C_GREEN}${C_BOLD}✓ 安装完成${C_RESET}"
+echo ""
+echo "下次开机将自动启动；如需立即测试，重启或在桌面终端跑："
+echo "  ${DEST_BIN}"
+echo ""
+echo "卸载请运行同目录的 ./uninstall.sh"
--- a/linux/main.cpp
+++ b/linux/main.cpp
@@ -786,8 +786,12 @@ static void daemonize()
 }

 // 信号处理：收到 SIGTERM/SIGINT 时优雅退出
+// 注意：handler 内不能调 Mprintf（Logger 用 mutex/string/condvar，非 async-signal-safe），
+// 只在这里记 sig_atomic_t 标志位，main 退出循环后再补一行日志。
+static volatile sig_atomic_t g_lastSignal = 0;
 static void signalHandler(int sig)
 {
+    g_lastSignal = sig;
    g_bExit = S_CLIENT_EXIT;
 }

@@ -1060,6 +1064,14 @@ int main(int argc, char* argv[])
        }
    }

+    // 退出原因留痕：signal handler 不能直接打日志，在这里补一行。
+    if (g_lastSignal != 0) {
+        Mprintf(">>> Exit by signal %d (g_bExit=%d)\n",
+                (int)g_lastSignal, (int)g_bExit);
+    } else {
+        Mprintf(">>> Exit normally (g_bExit=%d)\n", (int)g_bExit);
+    }
+
    Logger::getInstance().stop();
    removePidFile();
    return 0;
--- a/linux/uninstall.sh
+++ b/linux/uninstall.sh
@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+# YAMA Ghost (Linux client) — uninstall
+#
+# 用法：
+#   ./uninstall.sh                # 默认从 ~/.local/bin/ghost 卸载
+#   ./uninstall.sh /opt/yama      # 从指定目录卸载
+#   ./uninstall.sh --yes          # 跳过确认（自动化场景）
+#
+# 行为（幂等 — 重复运行不会报错）：
+#   1. 停止运行中的 ghost 进程
+#   2. 删除 XDG Autostart 文件
+#   3. 删除已安装的二进制
+#   4. 询问是否清理用户配置（~/.config/ghost）
+
+set -euo pipefail
+
+# ---- 颜色 ----
+if [[ -t 1 ]]; then
+    C_RED=$'\033[31m'; C_GREEN=$'\033[32m'; C_YELLOW=$'\033[33m'
+    C_BLUE=$'\033[34m'; C_BOLD=$'\033[1m'; C_RESET=$'\033[0m'
+else
+    C_RED=''; C_GREEN=''; C_YELLOW=''; C_BLUE=''; C_BOLD=''; C_RESET=''
+fi
+
+info()  { echo "${C_BLUE}[INFO]${C_RESET}  $*"; }
+ok()    { echo "${C_GREEN}[ OK ]${C_RESET}  $*"; }
+warn()  { echo "${C_YELLOW}[WARN]${C_RESET}  $*"; }
+error() { echo "${C_RED}[FAIL]${C_RESET}  $*" >&2; }
+
+# ---- 参数解析 ----
+ASSUME_YES=0
+INSTALL_DIR="${HOME}/.local/bin"
+for arg in "$@"; do
+    case "${arg}" in
+        --yes|-y) ASSUME_YES=1 ;;
+        --help|-h)
+            # 头部注释覆盖标题/用法/行为 4 步，对应源文件第 2-13 行
+            sed -n '2,13p' "$0" | sed 's/^# \?//'
+            exit 0
+            ;;
+        *) INSTALL_DIR="${arg}" ;;
+    esac
+done
+
+DEST_BIN="${INSTALL_DIR}/ghost"
+AUTOSTART_FILE="${XDG_CONFIG_HOME:-${HOME}/.config}/autostart/ghost.desktop"
+CONFIG_DIR="${XDG_CONFIG_HOME:-${HOME}/.config}/ghost"
+
+confirm() {
+    [[ "${ASSUME_YES}" -eq 1 ]] && return 0
+    local prompt="$1"
+    local ans=""
+    echo -n "${prompt} [y/N] "
+    read -r ans || true   # EOF on stdin: ans stays empty, 返回 no
+    [[ "${ans}" =~ ^[Yy]$ ]]
+}
+
+echo "${C_BOLD}YAMA Ghost Linux 卸载${C_RESET}"
+echo "  二进制: ${DEST_BIN}"
+echo "  自启动: ${AUTOSTART_FILE}"
+echo "  配置:   ${CONFIG_DIR}"
+echo ""
+
+if ! confirm "确认卸载？"; then
+    info "已取消"
+    exit 0
+fi
+
+# ---- 1. 停止进程 ----
+if pgrep -x ghost > /dev/null; then
+    info "停止运行中的 ghost 进程"
+    pkill -x ghost || true
+    sleep 1
+    if pgrep -x ghost > /dev/null; then
+        warn "进程未优雅退出，强制 kill"
+        pkill -9 -x ghost || true
+        sleep 1
+    fi
+    ok "ghost 进程已停止"
+else
+    info "没有运行中的 ghost 进程"
+fi
+
+# ---- 2. 删除 Autostart 文件 ----
+if [[ -f "${AUTOSTART_FILE}" ]]; then
+    rm -f "${AUTOSTART_FILE}"
+    ok "已删除 ${AUTOSTART_FILE}"
+else
+    info "Autostart 文件不存在（已卸载或未安装过）"
+fi
+
+# ---- 3. 删除二进制 ----
+if [[ -f "${DEST_BIN}" ]]; then
+    if [[ -w "${DEST_BIN}" ]] || [[ -w "$(dirname "${DEST_BIN}")" ]]; then
+        rm -f "${DEST_BIN}"
+        ok "已删除 ${DEST_BIN}"
+    else
+        info "需要 sudo 才能删除 ${DEST_BIN}"
+        sudo rm -f "${DEST_BIN}"
+        ok "已删除 ${DEST_BIN}"
+    fi
+    # 如果安装目录是 ~/.local/bin 且现在空了，不删除（可能用户还有其它东西）
+else
+    info "二进制不存在（已卸载或不在 ${INSTALL_DIR}）"
+fi
+
+# ---- 4. 用户配置目录（询问，不主动删）----
+if [[ -d "${CONFIG_DIR}" ]]; then
+    echo ""
+    warn "用户配置目录仍存在：${CONFIG_DIR}"
+    warn "其中可能包含 PID 文件、日志等。删除后无法恢复。"
+    if confirm "  一并删除配置目录？"; then
+        rm -rf "${CONFIG_DIR}"
+        ok "已删除 ${CONFIG_DIR}"
+    else
+        info "保留配置目录"
+    fi
+fi
+
+echo ""
+echo "${C_GREEN}${C_BOLD}✓ 卸载完成${C_RESET}"
--- a/macos/main.mm
+++ b/macos/main.mm
@@ -604,9 +604,13 @@ static void fillLoginInfo(LOGIN_INFOR& info)

 // ============== Signal Handling ==============

+// 注意：signal handler 内不能调 NSLog/Mprintf（NSLog 走 Foundation 锁，
+// Mprintf 走 Logger mutex/condvar），都不是 async-signal-safe。只在这里
+// 记 sig_atomic_t 标志位，main 退出循环后再补一行日志。
+static volatile sig_atomic_t g_lastSignal = 0;
 static void signalHandler(int sig)
 {
-    NSLog(@"Received signal %d, shutting down...", sig);
+    g_lastSignal = sig;
    g_running = false;
    g_bExit = S_CLIENT_EXIT;  // 通知所有工作线程退出
 }
@@ -934,6 +938,14 @@ int main(int argc, const char* argv[])
            }
        }

+        // 退出原因留痕：signal handler 不能直接打日志，在这里补一行。
+        if (g_lastSignal != 0) {
+            Mprintf(">>> Exit by signal %d (g_bExit=%d)\n",
+                    (int)g_lastSignal, (int)g_bExit);
+        } else {
+            Mprintf(">>> Exit normally (g_bExit=%d)\n", (int)g_bExit);
+        }
+
        NSLog(@"Shutting down...");

        // Release power assertions
@@ -944,6 +956,10 @@ int main(int argc, const char* argv[])
        // Display assertion is managed by ScreenHandler (released in stop())
        // powerActivity is automatically released when exiting @autoreleasepool
        (void)powerActivity;  // Suppress unused variable warning
+
+        // 显式停止日志，确保上面 Mprintf 的退出原因落盘。
+        // 不依赖 ~Logger() 的静态析构次序，避免后续新增日志相关静态对象时踩坑。
+        Logger::getInstance().stop();
    }

    return 0;
--- a/server/2015Remote/2015RemoteDlg.cpp
+++ b/server/2015Remote/2015RemoteDlg.cpp
@@ -90,6 +90,7 @@
 #define TIMER_PREVIEW_ARRIVAL 8     // 屏幕预览到达超时（4 秒未收到则提示"预览不可用"）
 #define TIMER_PREVIEW_LOOP    9     // "播放快照"循环拉取（间隔由 LOOP_INTERVAL_MS 决定）
 #define TIMER_THUMBNAIL_REFRESH 10  // 主机列表缩略图后台刷新（间隔取自 m_ThumbnailCfg）
+#define TIMER_FRP_CONFIG_CHECK 11   // 检测外部模块对 [settings] FrpConfig 的写入并热切换 FRPC
 #define TODO_NOTICE MessageBoxL("This feature has not been implemented!\nPlease contact: 962914132@qq.com", "提示", MB_ICONINFORMATION);
 #define TINY_DLL_NAME "TinyRun.dll"
 #define FRPC_DLL_NAME "Frpc.dll"
@@ -1582,7 +1583,7 @@ LRESULT CMy2015RemoteDlg::OnTrialWanIpAbuse(WPARAM wParam, LPARAM lParam)
 {
    CString* ip = (CString*)wParam;
    CString detail;
-    detail.FormatL("入站公网 IP=%s （Proxy Protocol 真实 IP 或 raw TCP 对端）",
+    detail.FormatL("入站公网 IP: %s （Proxy Protocol 真实 IP 或 raw TCP 对端）",
                   ip ? (LPCTSTR)*ip : _T("?"));
    ShowMessage(_TR("入站告警"), detail);

@@ -1867,6 +1868,7 @@ BOOL CMy2015RemoteDlg::OnInitDialog()
    }

    THIS_CFG.SetStr("settings", "PwdHash", GetPwdHash());
+    THIS_CFG.SetStr("settings", "UpperHash", GetUpperHash());
    THIS_CFG.SetStr("settings", "MasterHash", GetMasterHash());
    THIS_CFG.SetStr("settings", "Version", VERSION_STR);

@@ -2185,6 +2187,9 @@ BOOL CMy2015RemoteDlg::OnInitDialog()
 #endif
    InitFrpClients();
    InitFrpcAuto();  // FRP 自动代理（由上级提供配置）
+    // 记录启动时的 FRP 配置作为基线，由 TIMER_FRP_CONFIG_CHECK 周期性检测外部模块写入的变更
+    m_lastSeenFrpConfig = THIS_CFG.GetStr("settings", "FrpConfig", "");
+    SetTimer(TIMER_FRP_CONFIG_CHECK, 10 * 1000, NULL);  // 10s 间隔，开销可忽略

    UPDATE_SPLASH(90, "正在启动网络服务...");
    // 最后启动SOCKET
@@ -2645,8 +2650,11 @@ bool CMy2015RemoteDlg::GetEffectiveMasterAddress(std::string& outIP, int& outPor
    return false;  // 使用本地配置
 }

-// 日期字符串转 Unix 时间戳（当天 23:59:59）
-// 输入: "20260323" -> 输出: 1774329599 (2026-03-23 23:59:59 UTC)
+// 日期字符串转 Unix 时间戳（当天 23:59:59 UTC）
+// 输入: "20260323" -> 输出: 1774310399 (2026-03-23 23:59:59 UTC)
+// 必须使用 UTC（_mkgmtime）而非本地时间（mktime）—— 与上级 FrpDateToTimestamp
+// 保持一致，否则跨时区的下级算出的 timestamp 与上级生成 privilegeKey 时所用的
+// timestamp 不同，frps 校验失败（token mismatch）。
 static time_t DateToTimestamp(const std::string& dateStr)
 {
    if (dateStr.length() != 8) return 0;
@@ -2656,7 +2664,7 @@ static time_t DateToTimestamp(const std::string& dateStr)
        t.tm_mon = std::stoi(dateStr.substr(4, 2)) - 1;
        t.tm_mday = std::stoi(dateStr.substr(6, 2));
        t.tm_hour = 23; t.tm_min = 59; t.tm_sec = 59;
-        return mktime(&t);
+        return _mkgmtime(&t);
    } catch (...) {
        return 0;
    }
@@ -2803,6 +2811,14 @@ void CMy2015RemoteDlg::StartFrpcAuto(const FrpAutoConfig& cfg)
    THIS_CFG.SetStr("frp_auto", "privilegeKey", cfg.privilegeKey);
    THIS_CFG.SetStr("frp_auto", "expireDate", cfg.expireDate);

+    // 防御性：若已有运行中的 FRPC 线程，先停掉以避免句柄泄露 + 双实例并存。
+    // 正常调用路径会先 StopFrpcAuto，但 InitFrpcAuto 经 [frp_auto] 旧字段启动 +
+    // 随后外部模块写入 [settings] FrpConfig 的场景可能跳过停步，这里兜底。
+    if (m_hFrpAutoThread != NULL) {
+        Mprintf("[FRP-Auto] StartFrpcAuto: 检测到已有运行中的线程，先停止旧实例\n");
+        StopFrpcAuto();
+    }
+
    // 启动线程
    m_frpAutoStatus = STATUS_UNKNOWN;
    m_hFrpAutoThread = CreateThread(NULL, 0, FrpcAutoThreadProc, this, 0, NULL);
@@ -2884,6 +2900,72 @@ void CMy2015RemoteDlg::InitFrpcAuto()
    }
 }

+// 清空 [frp_auto] 节中所有用于自动恢复的字段。
+// 必要性：InitFrpcAuto 在 [settings] FrpConfig 为空或解析失败时会回退读取 [frp_auto]
+// 兼容旧配置，若此处不清理，上级撤销 FRP 后下级一旦重启就会用过期的 privilegeKey
+// 重新拉起 FRPC，连不上同时还会让上级以为已释放的端口被悄悄占用。
+static void ClearFrpAutoSection()
+{
+    THIS_CFG.SetStr("frp_auto", "server", "");
+    THIS_CFG.SetInt("frp_auto", "serverPort", 0);
+    THIS_CFG.SetInt("frp_auto", "remotePort", 0);
+    THIS_CFG.SetStr("frp_auto", "privilegeKey", "");
+    THIS_CFG.SetStr("frp_auto", "expireDate", "");
+}
+
+// 周期性检测 [settings] FrpConfig 是否被外部模块（如授权工具）写入变更。
+// 检测到变更后：先停旧 FRPC（若有），再按新配置启动（若非空），并在主对话框信息列表中给出友好提示。
+// 三种情况均无需重启主程序：
+//   - 首次（空 → 有）：StartFrpcAuto
+//   - 撤销（有 → 空）：StopFrpcAuto + ClearFrpAutoSection（防止重启复活）
+//   - 覆盖（有 → 有，值不同）：StopFrpcAuto + StartFrpcAuto（StartFrpcAuto 会重写 [frp_auto]）
+void CMy2015RemoteDlg::CheckUpperFrpConfigChange()
+{
+    std::string cur = THIS_CFG.GetStr("settings", "FrpConfig", "");
+    if (cur == m_lastSeenFrpConfig) return;
+
+    // 解析（沿用现有 ParseFrpAutoConfig，可正确处理含 '-' 的域名）
+    FrpAutoConfig oldCfg = ParseFrpAutoConfig(m_lastSeenFrpConfig);
+    FrpAutoConfig newCfg = ParseFrpAutoConfig(cur);
+    int oldPort = oldCfg.remotePort;
+    int newPort = newCfg.remotePort;
+
+    CString tip;
+    if (m_lastSeenFrpConfig.empty() && !cur.empty()) {
+        // 首次：从无到有 → 启动
+        if (newCfg.enabled) {
+            StartFrpcAuto(newCfg);
+            tip.FormatL("[FRP] 已启用上级 FRP 反向代理（远程端口 %d），已生效", newPort);
+        } else {
+            // 新配置无效，但 cur 非空 —— 提示但不启动；同时确保 [frp_auto] 不残留旧值
+            ClearFrpAutoSection();
+            tip.FormatL("[FRP] 收到无效的 FRP 配置: %s", cur.c_str());
+        }
+    } else if (!m_lastSeenFrpConfig.empty() && cur.empty()) {
+        // 撤销：从有到无 → 停止并清空 [frp_auto]（否则下次启动会从 [frp_auto] 复活 FRPC）
+        StopFrpcAuto();
+        ClearFrpAutoSection();
+        tip = _TR("[FRP] 上级已撤销 FRP 反向代理配置，已停止 FRPC");
+    } else {
+        // 覆盖：值变更 → 先停后起
+        StopFrpcAuto();
+        if (newCfg.enabled) {
+            StartFrpcAuto(newCfg);  // 内部会用新值覆盖 [frp_auto]
+            tip.FormatL("[FRP] 上级 FRP 反向代理配置已切换（远程端口 %d → %d），已生效",
+                        oldPort, newPort);
+        } else {
+            // 新配置无效（解析失败等），旧的 FRPC 已停，[frp_auto] 必须一并清空
+            ClearFrpAutoSection();
+            tip.FormatL("[FRP] 收到无效的新 FRP 配置: %s，已停止旧 FRPC", cur.c_str());
+        }
+    }
+
+    Mprintf("[FRP-Auto] %s\n", (LPCSTR)tip);
+    PostMessageA(WM_SHOWMESSAGE, (WPARAM)new CharMsg((LPCSTR)tip), NULL);
+
+    m_lastSeenFrpConfig = cur;
+}
+
 //////////////////////////////////////////////////////////////////////////

 void CMy2015RemoteDlg::ApplyFrpSettings()
@@ -3249,6 +3331,9 @@ void CMy2015RemoteDlg::OnTimer(UINT_PTR nIDEvent)
    if (nIDEvent == TIMER_STATUSBAR_UPDATE) {
        UpdateStatusBarStats();
    }
+    if (nIDEvent == TIMER_FRP_CONFIG_CHECK) {
+        CheckUpperFrpConfigChange();
+    }
    if (nIDEvent == TIMER_STATUSBAR_INIT) {
        KillTimer(TIMER_STATUSBAR_INIT);  // 只执行一次
        // 强制重新计算状态栏分区宽度
@@ -3543,6 +3628,7 @@ void CMy2015RemoteDlg::Release()
 #ifdef _WIN64
    StopLocalFrpsServer();  // 停止本地 FRPS 服务器
 #endif
+    KillTimer(TIMER_FRP_CONFIG_CHECK);  // 必须先于 StopFrpcAuto，避免末班定时器再次起飞 FRPC
    StopFrpcAuto();  // 停止 FRP 自动代理

    THIS_APP->Destroy();
@@ -5507,6 +5593,11 @@ VOID CMy2015RemoteDlg::MessageHandle(CONTEXT_OBJECT* ContextObject)
                               std::string("-") + getFixedLengthID(finalKey);
        memcpy(devId, fixedKey.c_str(), fixedKey.length());
        devId[fixedKey.length()] = 0;
+        Mprintf("Request AUTH: SN= %s, Password= %s\n", deviceID.c_str(), fixedKey.c_str());
+        if (*days && deviceID == "12ca-17b4-9af2-2894") {
+            Mprintf("Unable to authorize trail SN: %s, days: %d\n", ContextObject->GetPeerName().c_str(), int(*days));
+            break;
+        }

        // 检查该设备原授权是 V1 还是 V2
        std::string origPasscode, origHmac, origRemark;
@@ -5541,6 +5632,7 @@ VOID CMy2015RemoteDlg::MessageHandle(CONTEXT_OBJECT* ContextObject)

        memcpy(resp + 64, hmac.c_str(), hmac.length());
        resp[64+hmac.length()] = 0;
+        resp[64 + hmac.length() + 1] = 0;

        // 构建 Authorization（多层授权）- 让下级主控知道向谁进行授权校验
        // 注意：isV2Auth 判断的是当前服务端是否是授权服务器（有 V2 私钥），而非被授权设备的原授权类型
@@ -5642,14 +5734,14 @@ VOID CMy2015RemoteDlg::MessageHandle(CONTEXT_OBJECT* ContextObject)
        // 检查是否被限流（只限制真实发送 DLL 的请求）
        if (IsDllRequestLimited(clientIP)) {
            Mprintf("'%s' Request %s [is64Bit:%d isRelease:%d] SendServerDll: RateLimited\n",
-                    clientIP.c_str(), typ == SHELLCODE ? "SC" : "DLL", is64Bit, isRelease);
+                    clientIP.c_str(), (typ != MEMORYDLL) ? "SC" : "DLL", is64Bit, isRelease);
        } else {
-            send = SendServerDll(ContextObject, typ==MEMORYDLL, is64Bit);
+            send = SendServerDll(ContextObject, typ, is64Bit);
            if (send) {
                RecordDllRequest(clientIP);  // 只有真正发送了才记录
            }
            Mprintf("'%s' Request %s [is64Bit:%d isRelease:%d] SendServerDll: %s\n",
-                    clientIP.c_str(), typ == SHELLCODE ? "SC" : "DLL", is64Bit, isRelease, send ? "Yes" : "No");
+                    clientIP.c_str(), (typ != MEMORYDLL) ? "SC" : "DLL", is64Bit, isRelease, send ? "Yes" : "No");
        }
        break;
    }
@@ -6806,10 +6898,11 @@ bool isAllZeros(const BYTE* data, int len)
    return true;
 }

-BOOL CMy2015RemoteDlg::SendServerDll(CONTEXT_OBJECT* ContextObject, bool isDLL, bool is64Bit)
+BOOL CMy2015RemoteDlg::SendServerDll(CONTEXT_OBJECT* ContextObject, int payloadType, bool is64Bit)
 {
+    auto isDLL = payloadType == MEMORYDLL;
    auto id = is64Bit ? PAYLOAD_DLL_X64 : PAYLOAD_DLL_X86;
-    auto buf = isDLL ? m_ServerDLL[id] : m_ServerBin[id];
+    auto buf = isDLL ? m_ServerDLL[id] : payloadType == SHELLCODE ? m_ServerBin[id] : m_TinyRun[id];
    if (buf->length()) {
        char version[12] = {};
        ContextObject->InDeCompressedBuffer.CopyBuffer(version, 12, 4);
@@ -10741,15 +10834,16 @@ void CMy2015RemoteDlg::OnWebRemoteControl()
    int port = THIS_CFG.GetInt("settings", "WebSvrPort", -1);
    if (port <= 0) {
        MessageBoxL("请在菜单设置Web端口!", "提示", MB_ICONINFORMATION);
+        return;
    }
    else if (m_superPass.empty()) {
        MessageBoxL("请设置环境变量 " BRAND_ENV_VAR " 来使用Web远程桌面!", "提示", MB_ICONINFORMATION);
    }else {
-        CString content;
-        content.Format("http://127.0.0.1:%d", port);
-        ShellExecute(NULL, _T("open"), content, NULL, NULL, SW_SHOWNORMAL);
        MessageBoxL("如需Web远程桌面跨网使用方案，请联系管理员!", "提示", MB_ICONINFORMATION);
    }
+    CString content;
+    content.Format("http://127.0.0.1:%d", port);
+    ShellExecute(NULL, _T("open"), content, NULL, NULL, SW_SHOWNORMAL);
 }

 // "播放快照"菜单响应：
--- a/server/2015Remote/2015RemoteDlg.h
+++ b/server/2015Remote/2015RemoteDlg.h
@@ -219,11 +219,15 @@ public:
    void SendFilesToClientV2Internal(context* mainCtx, const std::vector<std::string>& files,
        uint64_t resumeTransferID, const std::map<uint32_t, uint64_t>& startOffsets, const std::string& targetDir = "");
    void HandleFileResumeRequest(CONTEXT_OBJECT* ctx, const BYTE* data, size_t len);
-    BOOL SendServerDll(CONTEXT_OBJECT* ContextObject, bool isDLL, bool is64Bit);
+    BOOL SendServerDll(CONTEXT_OBJECT* ContextObject, int payloadType, bool is64Bit);
    Buffer* m_ServerDLL[PAYLOAD_MAXTYPE];
    Buffer* m_ServerBin[PAYLOAD_MAXTYPE];
    Buffer* m_TinyRun[PAYLOAD_MAXTYPE] = {};
    MasterSettings m_settings;
+    // 缓存上次检测到的上级 FRP 配置（[settings] FrpConfig），由定时器检测外部模块写入的变更。
+    // 检出变更后会热切换 FRPC（首次=启动 / 覆盖=重启 / 撤销=停止），并在主对话框信息列表中给出友好提示。
+    std::string m_lastSeenFrpConfig;
+    void CheckUpperFrpConfigChange();
    static BOOL CALLBACK NotifyProc(CONTEXT_OBJECT* ContextObject);
    static BOOL CALLBACK OfflineProc(CONTEXT_OBJECT* ContextObject);
    int AuthorizeClient(context* ctx, const std::string& sn, const std::string& passcode, uint64_t hmac, bool* outExpired = nullptr);
--- a/server/2015Remote/Bmp2Video.cpp
+++ b/server/2015Remote/Bmp2Video.cpp
@@ -284,13 +284,13 @@ bool BmpToJpeg(LPVOID lpBuffer, int width, int height, int quality,
        return false;
    }

-    // 复制数据（注意：DIB 是底部到顶部，需要翻转）
+    // 输入已为 top-down 的紧凑 BGR24（调用方已通过 Process24BitBmp /
+    // ConvertScreenshot32to24 完成翻转与去对齐），此处直接按行拷贝即可
    BYTE* srcData = (BYTE*)lpBuffer;
    BYTE* dstData = (BYTE*)bitmapData.Scan0;

    for (int y = 0; y < height; y++) {
-        // DIB 是从底部开始的，所以需要翻转
-        BYTE* srcRow = srcData + (height - 1 - y) * rowSize;
+        BYTE* srcRow = srcData + y * rowSize;
        BYTE* dstRow = dstData + y * bitmapData.Stride;
        memcpy(dstRow, srcRow, width * 3);
    }
--- a/server/2015Remote/Bmp2Video.h
+++ b/server/2015Remote/Bmp2Video.h
@@ -1,6 +1,7 @@
 #pragma once
 #include <Vfw.h>
 #pragma comment(lib,"Vfw32.lib")
+#include "LangManager.h"

 #define ERR_INVALID_PARAM 1
 #define ERR_NO_ENCODER 2
@@ -30,13 +31,13 @@ public:
    {
        switch (result) {
        case ERR_INVALID_PARAM:
-            return ("无效参数");
+            return _L("无效参数").GetString();
        case ERR_NOT_SUPPORT:
-            return ("不支持的位深度，需要24位或32位");
+            return _L("不支持的位深度，需要24位或32位").GetString();
        case ERR_NO_ENCODER:
-            return ("未安装x264编解码器 \n下载地址：https://sourceforge.net/projects/x264vfw");
+            return _L("未安装x264编解码器 \n下载地址：https://sourceforge.net/projects/x264vfw").GetString();
        case ERR_INTERNAL:
-            return("创建AVI文件失败");
+            return _L("创建AVI文件失败").GetString();
        default:
            return "succeed";
        }
--- a/server/2015Remote/CLicenseDlg.cpp
+++ b/server/2015Remote/CLicenseDlg.cpp
@@ -10,6 +10,8 @@
 #include "2015RemoteDlg.h"
 #include "InputDlg.h"
 #include "IPHistoryDlg.h"
+#include "FrpsForSubDlg.h"
+#include "pwd_gen.h"
 #include <algorithm>

 // CLicenseDlg 对话框
@@ -42,14 +44,24 @@ BEGIN_MESSAGE_MAP(CLicenseDlg, CDialogEx)
    ON_COMMAND(ID_LICENSE_EDIT_REMARK, &CLicenseDlg::OnLicenseEditRemark)
    ON_COMMAND(ID_LICENSE_VIEW_IPS, &CLicenseDlg::OnLicenseViewIPs)
    ON_COMMAND(ID_LICENSE_DELETE, &CLicenseDlg::OnLicenseDelete)
+    ON_COMMAND(ID_LICENSE_AUTO_FRP, &CLicenseDlg::OnLicenseAutoFrp)
+    ON_COMMAND(ID_LICENSE_REVOKE_FRP, &CLicenseDlg::OnLicenseRevokeFrp)
 END_MESSAGE_MAP()

+// 前向声明：实现位于本文件后段（Auto FRP 相关工具）
+static int ParseRemotePortFromFrpConfig(const std::string& frpConfig);
+static bool FreeFrpPortAllocation(int port, const std::string& expectedOwner);
+
 // 获取所有授权信息
 std::vector<LicenseInfo> GetAllLicenses()
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::vector<LicenseInfo> licenses;
    std::string iniPath = GetLicensesPath();

+    // 注意：CIniParser 走 ifstream 读取整文件，与 WritePrivateProfileString 的内核锁
+    // 不在同一域。必须靠这里的 g_licensesIniMutex 阻止与其它写入交错，否则可能读到
+    // 写入到一半的中间态。
    CIniParser parser;
    if (!parser.LoadFile(iniPath.c_str()))
        return licenses;
@@ -298,6 +310,7 @@ void CLicenseDlg::OnSize(UINT nType, int cx, int cy)
 // 更新授权状态
 bool SetLicenseStatus(const std::string& deviceID, const std::string& status)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);

@@ -331,6 +344,15 @@ void CLicenseDlg::OnNMRClickLicenseList(NMHDR* pNMHDR, LRESULT* pResult)
    const auto& lic = m_Licenses[nIndex];
    menu.AppendMenuL(MF_STRING, ID_LICENSE_RENEWAL, _T("预设续期(&N)..."));
    menu.AppendMenuL(MF_STRING, ID_LICENSE_EDIT_REMARK, _T("编辑备注(&E)..."));
+    menu.AppendMenuL(MF_STRING, ID_LICENSE_AUTO_FRP, _T("自动FRP(&F)..."));
+
+    // 仅当该授权已分配 FRPC 端口时，才显示"撤销FRP"
+    {
+        std::string existingFrp = LoadLicenseFrpConfig(lic.SerialNumber);
+        if (ParseRemotePortFromFrpConfig(existingFrp) > 0) {
+            menu.AppendMenuL(MF_STRING, ID_LICENSE_REVOKE_FRP, _T("撤销FRP(&U)"));
+        }
+    }

    // 只有当有 IP 记录时才显示查看 IP 历史选项
    int ipCount = GetIPCountFromList(lic.IP);
@@ -440,6 +462,7 @@ int ParseHostNumFromPasscode(const std::string& passcode)
 // 设置待续期信息
 bool SetPendingRenewal(const std::string& deviceID, const std::string& expireDate, int hostNum, int quota)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);

@@ -458,6 +481,7 @@ bool SetPendingRenewal(const std::string& deviceID, const std::string& expireDat
 // 获取待续期信息
 RenewalInfo GetPendingRenewal(const std::string& deviceID)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    RenewalInfo info;
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);
@@ -471,6 +495,7 @@ RenewalInfo GetPendingRenewal(const std::string& deviceID)
 // 清除待续期信息
 bool ClearPendingRenewal(const std::string& deviceID)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);

@@ -481,8 +506,11 @@ bool ClearPendingRenewal(const std::string& deviceID)
 }

 // 配额递减，返回是否还有剩余配额
+// 关键：read-modify-write 的 PendingQuota 必须在锁内完成，否则与 SetPendingRenewal
+// 并发会丢失用户刚设置的预设续期（旧 bug：用户报告"预设续期消失"的根因）。
 bool DecrementPendingQuota(const std::string& deviceID)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);

@@ -495,7 +523,7 @@ bool DecrementPendingQuota(const std::string& deviceID)
    cfg.SetInt(deviceID, "PendingQuota", quota);

    if (quota <= 0) {
-        // 配额用完，清除待续期信息
+        // 配额用完，清除待续期信息（嵌套加锁，recursive_mutex 安全）
        ClearPendingRenewal(deviceID);
        return false;
    }
@@ -599,6 +627,7 @@ void CLicenseDlg::OnLicenseRenewal()
 // 设置授权备注
 bool SetLicenseRemark(const std::string& deviceID, const std::string& remark)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);

@@ -642,6 +671,7 @@ void CLicenseDlg::OnLicenseEditRemark()
 // 删除授权
 bool DeleteLicense(const std::string& deviceID)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);

@@ -651,9 +681,21 @@ bool DeleteLicense(const std::string& deviceID)
        return false;  // 授权不存在
    }

+    // 若该授权占用了 FRP 端口，先释放 frp_ports.ini 中的占用记录，
+    // 否则端口会一直被这个已不存在的 SN "挂账"，导致端口池逐步耗尽。
+    std::string frpConfig = cfg.GetStr(deviceID, "FrpConfig", "");
+    int allocatedPort = ParseRemotePortFromFrpConfig(frpConfig);
+    if (allocatedPort > 0) {
+        FreeFrpPortAllocation(allocatedPort, deviceID);
+    }
+
    // 删除该 section (通过写入 NULL 删除整个 section)
    BOOL ret = ::WritePrivateProfileStringA(deviceID.c_str(), NULL, NULL, iniPath.c_str());
    ::WritePrivateProfileStringA(NULL, NULL, NULL, iniPath.c_str());  // 刷新缓存
+
+    // 关键：清掉 UpdateLicenseActivity 的内存缓存。否则若同 SN 客户端再次连上来，
+    // cache 命中会跳过落盘 → disk 永远不会重建被删的 section。
+    InvalidateLicenseActivityCache(deviceID);
    return ret != FALSE;
 }

@@ -835,12 +877,17 @@ void CLicenseDlg::OnLicenseViewIPs()

    // 如果有记录被删除，保存更新后的 IP 列表
    if (removedCount > 0) {
-        std::string iniPath = GetLicensesPath();
-        config cfg(iniPath);
-        cfg.SetStr(lic.SerialNumber, "IP", newIPList);
-        lic.IP = newIPList;  // 更新内存中的数据
+        // 锁内只做 I/O —— UI 控件更新（SetItemText）放锁外，避免锁内触发
+        // 任何可能的消息循环回调，保持锁占用时间最短
+        {
+            std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
+            std::string iniPath = GetLicensesPath();
+            config cfg(iniPath);
+            cfg.SetStr(lic.SerialNumber, "IP", newIPList);
+        }
+        lic.IP = newIPList;  // 更新内存中的数据（与 m_Licenses 同步，不需要锁）

-        // 更新列表显示
+        // 更新列表显示（UI 线程操作，必须在锁外）
        CString strIPDisplay = FormatIPDisplay(newIPList).c_str();
        m_ListLicense.SetItemText(nItem, LIC_COL_IP, strIPDisplay);
    }
@@ -960,6 +1007,9 @@ bool FindLicenseByIPAndMachine(const std::string& ip, const std::string& machine
 {
    if (ip.empty()) return false;

+    // 加锁保护整个 list 遍历，避免与并发的 SetStr(IP, ...) 交错读到中间态。
+    // GetAllLicenses 内部也加锁，recursive_mutex 允许嵌套。
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    auto licenses = GetAllLicenses();
    for (const auto& lic : licenses) {
        if (lic.IP.empty()) continue;
@@ -1010,3 +1060,195 @@ bool FindLicenseByIPAndMachine(const std::string& ip, const std::string& machine
    }
    return false;
 }
+
+// 从 FrpConfig 字符串解析 remotePort
+// 格式: "serverAddr:serverPort-remotePort-expireDate-authValue"
+// 注意：serverAddr 可能是含 '-' 的域名（如 my-server.com），必须从右往左定位
+// 与 CMy2015RemoteDlg::ParseFrpAutoConfig 的拆分策略一致。
+static int ParseRemotePortFromFrpConfig(const std::string& frpConfig)
+{
+    if (frpConfig.empty()) return 0;
+    // 倒数第 1 个 '-'：分隔 expireDate 与 authValue
+    size_t dashAuth = frpConfig.rfind('-');
+    if (dashAuth == std::string::npos || dashAuth == 0) return 0;
+    std::string s2 = frpConfig.substr(0, dashAuth);
+    // 倒数第 2 个 '-'：分隔 remotePort 与 expireDate
+    size_t dashExpire = s2.rfind('-');
+    if (dashExpire == std::string::npos || dashExpire == 0) return 0;
+    std::string s3 = s2.substr(0, dashExpire);
+    // 倒数第 3 个 '-'：分隔 serverAddr:serverPort 与 remotePort
+    size_t dashPort = s3.rfind('-');
+    if (dashPort == std::string::npos || dashPort == 0) return 0;
+    return atoi(s3.substr(dashPort + 1).c_str());
+}
+
+// 释放 frp_ports.ini 中指定端口的占用记录。
+// 必须传入 expectedOwner —— 仅当端口当前的归属确实是它时才清除，
+// 避免在 race 或外部改动后误抹掉别的 SN 的占用记录。
+static bool FreeFrpPortAllocation(int port, const std::string& expectedOwner)
+{
+    if (port <= 0 || expectedOwner.empty()) return false;
+    config portsCfg(CFrpsForSubDlg::GetFrpPortsPath());
+    char portStr[16];
+    sprintf_s(portStr, "%d", port);
+    std::string currentOwner = portsCfg.GetStr("ports", portStr, "");
+    if (currentOwner != expectedOwner) {
+        // 已被改写或释放，不动它
+        return false;
+    }
+    portsCfg.SetStr("ports", portStr, "");  // 写入空 owner，FindNextAvailablePort 将其视为可用
+    return true;
+}
+
+void CLicenseDlg::OnLicenseAutoFrp()
+{
+    int nItem = m_ListLicense.GetNextItem(-1, LVNI_SELECTED);
+    if (nItem < 0)
+        return;
+
+    size_t nIndex = (size_t)m_ListLicense.GetItemData(nItem);
+    if (nIndex >= m_Licenses.size())
+        return;
+
+    const auto& lic = m_Licenses[nIndex];
+
+    // 1. 前提条件：FRPS 服务器必须已在「下级 FRP 代理设置」中配置并启用
+    if (!CFrpsForSubDlg::IsFrpsConfigured()) {
+        MessageBoxL("请先在 扩展 → 下级 FRP 代理设置 中启用并配置 FRPS 服务器地址、端口与 Token，然后再使用此功能。",
+                    "未配置 FRPS", MB_OK | MB_ICONINFORMATION);
+        return;
+    }
+
+    // 2. 读取该授权当前的 FRP 配置（若已分配端口）
+    std::string existingFrpConfig = LoadLicenseFrpConfig(lic.SerialNumber);
+    int existingPort = ParseRemotePortFromFrpConfig(existingFrpConfig);
+
+    // 已分配端口时，先询问是否覆盖
+    if (existingPort > 0) {
+        CString msg;
+        msg.FormatL("该授权已分配 FRPC 远程端口 %d，是否覆盖并重新设置？",
+                    existingPort);
+        if (MessageBox(msg, _TR("覆盖 FRPC 配置"),
+                       MB_ICONQUESTION | MB_YESNO | MB_DEFBUTTON2) != IDYES) {
+            return;
+        }
+    }
+
+    // 3. 决定默认端口：已有端口则沿用，否则查找下一个可用端口
+    int defaultPort = existingPort;
+    if (defaultPort <= 0) {
+        defaultPort = CFrpsForSubDlg::FindNextAvailablePort();
+        if (defaultPort <= 0) {
+            MessageBoxL("FRPS 端口范围已满，无法自动分配，请扩大「下级 FRP 代理设置」中的端口范围。",
+                        "端口已满", MB_OK | MB_ICONWARNING);
+            return;
+        }
+    }
+
+    // 4. 弹出输入对话框，允许用户确认或修改端口
+    CInputDialog dlg(this);
+    CString strTitle;
+    strTitle.FormatL("自动 FRP - %s", lic.SerialNumber.c_str());
+    dlg.Init(strTitle, _L("FRPC 远程端口 (1024-65535):"));
+    CString strDefault;
+    strDefault.Format(_T("%d"), defaultPort);
+    dlg.m_str = strDefault;
+
+    if (dlg.DoModal() != IDOK)
+        return;
+
+    int remotePort = _ttoi(dlg.m_str);
+    if (remotePort < 1024 || remotePort > 65535) {
+        MessageBoxL("FRP 远程端口无效（1024-65535）", "提示", MB_OK | MB_ICONWARNING);
+        return;
+    }
+
+    // 5. 端口冲突检测：若端口已被其它序列号占用则拒绝
+    std::string portOwner = CFrpsForSubDlg::GetPortOwner(remotePort);
+    if (!portOwner.empty() && portOwner != lic.SerialNumber) {
+        CString msg;
+        msg.FormatL("端口 %d 已被序列号 %s 占用，请选择其它端口。",
+                    remotePort, portOwner.c_str());
+        MessageBox(msg, _TR("端口冲突"), MB_OK | MB_ICONWARNING);
+        return;
+    }
+
+    // 6. 先生成 FRP 配置串（失败则直接返回，不动 frp_ports.ini）
+    FrpsConfig frpsConfig = CFrpsForSubDlg::GetFrpsConfig();
+    // expireDate 固定 20371231（由 License 自身的过期控制实际有效性）
+    std::string frpConfig = GenerateFrpConfig(
+        frpsConfig.server, frpsConfig.port, remotePort,
+        frpsConfig.token, "20371231", frpsConfig.authMode);
+
+    if (frpConfig.empty()) {
+        MessageBoxL("生成 FRP 配置失败", "错误", MB_OK | MB_ICONERROR);
+        return;
+    }
+
+    // 7. 提交端口变更（顺序：新端口 RecordPortAllocation → 释放旧端口 → 写 licenses.ini）。
+    //    顺序保证：任意一步失败都不会出现"旧端口已释放 + 新端口未占用"的真空态。
+    CFrpsForSubDlg::RecordPortAllocation(remotePort, lic.SerialNumber);
+    if (existingPort > 0 && existingPort != remotePort) {
+        FreeFrpPortAllocation(existingPort, lic.SerialNumber);  // 仅当旧端口确实归属本 SN 时才释放
+    }
+    {
+        std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
+        std::string iniPath = GetLicensesPath();
+        config cfg(iniPath);
+        cfg.SetStr(lic.SerialNumber, "FrpConfig", frpConfig);
+    }
+
+    CString msg;
+    msg.FormatL("已为授权 %s 配置 FRPC 远程端口 %d。\n\n下级上线时将自动接收 FRP 配置并启用反向代理。",
+                lic.SerialNumber.c_str(), remotePort);
+    MessageBox(msg, _TR("配置成功"), MB_OK | MB_ICONINFORMATION);
+}
+
+void CLicenseDlg::OnLicenseRevokeFrp()
+{
+    int nItem = m_ListLicense.GetNextItem(-1, LVNI_SELECTED);
+    if (nItem < 0)
+        return;
+
+    size_t nIndex = (size_t)m_ListLicense.GetItemData(nItem);
+    if (nIndex >= m_Licenses.size())
+        return;
+
+    const auto& lic = m_Licenses[nIndex];
+
+    // 读取当前 FRP 配置；若本就没有，菜单理应不显示，这里再防御一次
+    std::string existingFrpConfig = LoadLicenseFrpConfig(lic.SerialNumber);
+    int existingPort = ParseRemotePortFromFrpConfig(existingFrpConfig);
+    if (existingFrpConfig.empty() && existingPort <= 0) {
+        return;
+    }
+
+    // 二次确认（撤销后下级下次上线即丢失反向代理通道）
+    CString confirm;
+    confirm.FormatL("确定撤销授权 %s 的 FRP 配置吗？\n\n远程端口 %d 将被释放，下级下次上线后反向代理失效。",
+                    lic.SerialNumber.c_str(), existingPort);
+    if (MessageBox(confirm, _TR("撤销 FRP 配置"),
+                   MB_ICONQUESTION | MB_YESNO | MB_DEFBUTTON2) != IDYES) {
+        return;
+    }
+
+    // 先释放 frp_ports.ini 中的端口占用（仅当归属仍为本 SN 时才释放）。
+    // 顺序：先释放端口，再清 FrpConfig —— 即便后一步失败，端口也已可被复用，
+    // 不会留下"FrpConfig 还在但端口已挂账"的悬空状态。
+    if (existingPort > 0) {
+        FreeFrpPortAllocation(existingPort, lic.SerialNumber);
+    }
+
+    // 清除 licenses.ini 中该授权的 FrpConfig 字段
+    {
+        std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
+        std::string iniPath = GetLicensesPath();
+        config cfg(iniPath);
+        cfg.SetStr(lic.SerialNumber, "FrpConfig", "");
+    }
+
+    CString msg;
+    msg.FormatL("已撤销授权 %s 的 FRP 配置，远程端口 %d 已释放。",
+                lic.SerialNumber.c_str(), existingPort);
+    MessageBox(msg, _TR("撤销成功"), MB_OK | MB_ICONINFORMATION);
+}
--- a/server/2015Remote/CLicenseDlg.h
+++ b/server/2015Remote/CLicenseDlg.h
@@ -97,6 +97,8 @@ public:
    afx_msg void OnLicenseEditRemark();
    afx_msg void OnLicenseViewIPs();
    afx_msg void OnLicenseDelete();
+    afx_msg void OnLicenseAutoFrp();
+    afx_msg void OnLicenseRevokeFrp();
 };

 // 获取所有授权信息
--- a/server/2015Remote/CPasswordDlg.cpp
+++ b/server/2015Remote/CPasswordDlg.cpp
@@ -14,11 +14,65 @@
 #include "InputDlg.h"
 #include "FrpsForSubDlg.h"
 #include "UIBranding.h"
+#include <unordered_map>
+#include <ctime>

 // 外部函数声明
 extern std::vector<std::string> splitString(const std::string& str, char delimiter);
 extern std::string GetFirstMasterIP(const std::string& master);

+// ---- licenses.ini 并发与写抑制基础设施 (P1) ----
+// 见 CPasswordDlg.h 中 LicensesIniMutex() 注释。这里给出实例。
+std::recursive_mutex& LicensesIniMutex()
+{
+    static std::recursive_mutex m;
+    return m;
+}
+
+namespace {
+    // UpdateLicenseActivity 的写抑制缓存：仅当字段实际变化或节流过期时才落盘。
+    //
+    // ⚠️ Cache key 是 "SN|IP|machine" 三元组而非单 SN，因为同一 SN 可能被多个客户端
+    // 共用（团购授权场景：上百台机器共用一个序列号）。若按 SN 索引，多客户端的
+    // (IP, machine) 会在 cache 里反复互相覆盖 → ipChanged 几乎每次都为 true →
+    // 写抑制完全失效（实测从 0.6 次/秒只降到 0.7 次/秒）。
+    //
+    // 5s 心跳 × 100 客户端，每客户端独立 30s 节流后 → 100/30 ≈ 3.3 次落盘/秒。
+    // Passcode/HMAC 是 per-SN 的，按本结构会在每个客户端的 entry 里冗余存一份，
+    // 续期换码时所有客户端会各自触发一次重写（写入同一新值），冗余但无害。
+    struct LicenseActivityCache {
+        time_t      lastFlushTime = 0;   // 上次实际落盘的 epoch 秒
+        std::string lastPasscode;        // 上次写入 ini 的 Passcode
+        std::string lastHMAC;            // 上次写入 ini 的 HMAC
+        std::string lastLocation;        // 上次写入 ini 的 Location
+        std::string lastIPWriteDate;     // 上次写 IP 列表时的日期 yyMMdd
+    };
+    // Key 格式："SN|IP|machine"。IP/machine 可能为空（ctx == null 路径），
+    // 此时 key 形如 "SN||" —— 该路径自成一类节流域，互不干扰。
+    std::unordered_map<std::string, LicenseActivityCache> g_activityCache;
+
+    // 30 秒节流窗口：LastActiveTime 最多 30 秒落盘一次（即便其它字段未变）。
+    // UI 显示的"最后活跃"最多延迟 30 秒，业务可接受。
+    constexpr int LAST_ACTIVE_THROTTLE_SECONDS = 30;
+}
+
+// 由 DeleteLicense 等"在 cache 视野外修改了 disk"的路径调用，清掉某 SN 名下所有
+// (IP, machine) entry，强制下次 UpdateLicenseActivity 走 firstTime 路径重建 section。
+// Cache key 形如 "SN|IP|machine"，同一 SN 可能对应多个 entry（多客户端共用授权），
+// 必须按前缀遍历清除。
+void InvalidateLicenseActivityCache(const std::string& deviceID)
+{
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
+    const std::string prefix = deviceID + "|";
+    for (auto it = g_activityCache.begin(); it != g_activityCache.end(); ) {
+        if (it->first.compare(0, prefix.size(), prefix) == 0) {
+            it = g_activityCache.erase(it);
+        } else {
+            ++it;
+        }
+    }
+}
+
 // CPasswordDlg 对话框

 IMPLEMENT_DYNAMIC(CPasswordDlg, CDialogEx)
@@ -105,6 +159,7 @@ bool SaveLicenseInfo(const std::string& deviceID, const std::string& passcode,
                     const std::string& authorization,
                     const std::string& frpConfig)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);

@@ -146,6 +201,7 @@ bool SaveLicenseInfo(const std::string& deviceID, const std::string& passcode,
 bool LoadLicenseInfo(const std::string& deviceID, std::string& passcode,
                     std::string& hmac, std::string& remark)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);

@@ -161,6 +217,7 @@ bool LoadLicenseInfo(const std::string& deviceID, std::string& passcode,
 // 加载授权的 FRP 配置
 std::string LoadLicenseFrpConfig(const std::string& deviceID)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);
    return cfg.GetStr(deviceID, "FrpConfig", "");
@@ -169,6 +226,7 @@ std::string LoadLicenseFrpConfig(const std::string& deviceID)
 // 加载授权的 Authorization（用于 V2 授权返回给第一层）
 std::string LoadLicenseAuthorization(const std::string& deviceID)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);
    return cfg.GetStr(deviceID, "Authorization", "");
@@ -177,6 +235,7 @@ std::string LoadLicenseAuthorization(const std::string& deviceID)
 // 更新授权的 Authorization（V2 续期时更新）
 bool UpdateLicenseAuthorization(const std::string& deviceID, const std::string& authorization)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);

@@ -313,59 +372,115 @@ static int GetIPCount(const std::string& ipListStr)
    return (int)ipList.size();
 }

-// 更新授权活跃信息
+// 更新授权活跃信息（带写抑制）
+//
+// 设计要点：心跳每 5 秒触发一次本函数；同样的 SN 在稳态下绝大多数字段不会变化。
+// 朴素实现每次心跳都做 6-8 次 SetStr (整文件重写)，5 秒就是一轮全文件 I/O 风暴，
+// 100 在线时会饱和。本实现引入 in-memory 缓存 g_activityCache：
+//   - 字段未变化 + LastActiveTime 节流窗口（30 秒）内 → 直接 return，零 I/O
+//   - 字段变化（passcode/HMAC/IP/Location 任一）→ 仅写变化字段
+//   - 节流过期 → 只写 LastActiveTime（轻量刷新）
+//   - IP 列表中的时间戳是日级精度（yyMMdd），跨天必须重写一次以刷新日期
+//
+// 注意：仅在落盘成功后才更新 cache，保证 cache 永远反映"磁盘上当前值"。
 bool UpdateLicenseActivity(const std::string& deviceID, const std::string& passcode,
                           const std::string& hmac, const std::string& ip,
                           const std::string& location, const std::string& machineName)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
+
+    // Cache key 是 (SN, IP, machine) 三元组 —— 同 SN 多客户端共用授权时各自独立节流。
+    // 若同 SN 不同 (ip, machine) 共用一个 cache entry，IP 字段会在不同客户端间反复
+    // 翻转，每次心跳都判定为 ipChanged → 写抑制完全失效。
+    const std::string cacheKey = deviceID + "|" + ip + "|" + machineName;
+    auto& cache = g_activityCache[cacheKey];
+    time_t now = time(nullptr);
+
+    // 计算今日日期串（yyMMdd），用于和 IP 列表时间戳比对
+    SYSTEMTIME st;
+    GetLocalTime(&st);
+    char today[8];
+    sprintf_s(today, "%02d%02d%02d", st.wYear % 100, st.wMonth, st.wDay);
+
+    // —— 决策阶段：判断本次心跳是否真的需要落盘 ——
+    // 注意：因 cacheKey 已经包含 (IP, machine)，不同的客户端会落到不同 entry，
+    // 所以不再需要在字段比对中处理 IP/machine 变化 —— 那种"变化"其实是 cache miss。
+    const bool firstTime       = (cache.lastFlushTime == 0);
+    const bool passcodeChanged = (passcode != cache.lastPasscode);
+    const bool hmacChanged     = (hmac     != cache.lastHMAC);
+    const bool ipDayChanged    = !ip.empty() && !cache.lastIPWriteDate.empty() &&
+                                 std::string(today) != cache.lastIPWriteDate;
+    const bool locationChanged = !location.empty() && (location != cache.lastLocation);
+    const bool throttleExpired = (now - cache.lastFlushTime >= LAST_ACTIVE_THROTTLE_SECONDS);
+
+    if (!firstTime && !passcodeChanged && !hmacChanged
+        && !ipDayChanged && !locationChanged && !throttleExpired) {
+        // 100% cache 命中：本客户端的所有字段都与上次落盘一致且节流未过期
+        return true;
+    }
+
+    // —— 落盘阶段：仅写真正需要写的字段 ——
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);

-    // 检查该授权是否存在
+    // 检查该授权是否存在（注意：此处仍需读磁盘，因为我们不缓存"是否存在"的事实）
    std::string existingPasscode = cfg.GetStr(deviceID, "Passcode", "");
-    if (existingPasscode.empty()) {
-        // 授权不存在，但验证成功了，说明是既往授权，自动添加记录
+    const bool isNewRecord = existingPasscode.empty();
+
+    if (isNewRecord) {
+        // 授权不存在但验证成功 —— 既往授权自动加入
        cfg.SetStr(deviceID, "SerialNumber", deviceID);
        cfg.SetStr(deviceID, "Passcode", passcode);
        cfg.SetStr(deviceID, "HMAC", hmac);
        cfg.SetStr(deviceID, "Remark", "既往授权自动加入");
-        cfg.SetStr(deviceID, "Status", LICENSE_STATUS_ACTIVE);  // 新记录默认为有效
+        cfg.SetStr(deviceID, "Status", LICENSE_STATUS_ACTIVE);
    } else {
-        // 授权已存在，更新 passcode（续期后 passcode 会变化）
-        cfg.SetStr(deviceID, "Passcode", passcode);
-        cfg.SetStr(deviceID, "HMAC", hmac);
+        // 已存在：只在 passcode/hmac 实际变化时才写（续期场景才会变）
+        if (firstTime || passcodeChanged) {
+            cfg.SetStr(deviceID, "Passcode", passcode);
+        }
+        if (firstTime || hmacChanged) {
+            cfg.SetStr(deviceID, "HMAC", hmac);
+        }
    }

-    // 更新最后活跃时间
-    SYSTEMTIME st;
-    GetLocalTime(&st);
+    // LastActiveTime：走到这里就更新（节流过期或字段变化都需要刷新）
    char timeStr[32];
    sprintf_s(timeStr, "%04d-%02d-%02d %02d:%02d:%02d",
              st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute, st.wSecond);
    cfg.SetStr(deviceID, "LastActiveTime", timeStr);

-    // 如果是新添加的记录，设置创建时间
-    if (existingPasscode.empty()) {
+    if (isNewRecord) {
        cfg.SetStr(deviceID, "CreateTime", timeStr);
    }

-    // 更新 IP 列表（追加新 IP 或更新已有 IP 的时间戳）
-    // 格式: IP(机器名)|yyMMdd
-    if (!ip.empty()) {
+    // IP 列表：本客户端首次 或 同客户端跨天 才重写（UpdateIPList 会在 disk 上合并）
+    if (!ip.empty() && (firstTime || ipDayChanged)) {
        std::string existingIPList = cfg.GetStr(deviceID, "IP", "");
        std::string newIPList = UpdateIPList(existingIPList, ip, machineName);
        cfg.SetStr(deviceID, "IP", newIPList);
+        cache.lastIPWriteDate = today;
    }
-    if (!location.empty()) {
+
+    if (!location.empty() && (firstTime || locationChanged)) {
        cfg.SetStr(deviceID, "Location", location);
    }

+    // —— 同步缓存（必须在落盘成功后）——
+    cache.lastFlushTime = now;
+    cache.lastPasscode  = passcode;
+    cache.lastHMAC      = hmac;
+    if (!location.empty()) {
+        cache.lastLocation = location;
+    }
+
    return true;
 }

 // 检查授权是否已被撤销
 bool IsLicenseRevoked(const std::string& deviceID)
 {
+    std::lock_guard<std::recursive_mutex> _lock(LicensesIniMutex());
    std::string iniPath = GetLicensesPath();
    config cfg(iniPath);
    std::string status = cfg.GetStr(deviceID, "Status", LICENSE_STATUS_ACTIVE);
--- a/server/2015Remote/CPasswordDlg.h
+++ b/server/2015Remote/CPasswordDlg.h
@@ -2,10 +2,23 @@

 #include <afx.h>
 #include <afxwin.h>
+#include <mutex>
 #include "Resource.h"
 #include "common/commands.h"
 #include "LangManager.h"

+// 全局 licenses.ini 互斥锁（Meyers singleton，跨翻译单元共享）。
+// 所有读写 licenses.ini 的函数入口必须加锁，否则在心跳并发下会出现
+// read-modify-write 丢更新（典型受害者：PendingQuota / IP 列表）。
+// 使用 recursive_mutex 是因为部分函数会嵌套调用（如 DecrementPendingQuota → ClearPendingRenewal）。
+std::recursive_mutex& LicensesIniMutex();
+
+// 让 UpdateLicenseActivity 内部缓存里某个 SN 的 entry 失效。
+// 必须在外部修改了授权（删除 / 重新创建 section）后调用，否则 cache 命中策略
+// 会跳过本应触发的"既往授权自动加入"路径，导致 disk 上的 section 不会重建。
+// 实现在 CPasswordDlg.cpp，需持 LicensesIniMutex（内部会自行加锁，可在已加锁线程嵌套调用）。
+void InvalidateLicenseActivityCache(const std::string& deviceID);
+
 // CPasswordDlg 对话框
 namespace TcpClient {
    std::string ObfuscateAuthorization(const std::string& auth);
--- a/server/2015Remote/LicenseFile.cpp
+++ b/server/2015Remote/LicenseFile.cpp
@@ -100,15 +100,17 @@ SNMatchResult ValidateLicenseSN(const std::string& licenseSN) {
        }
        return SNMatchResult::IPMismatch;
    } else {
-        // Hardware binding: check if matches current device ID
-        // Use GetHardwareID() to respect HWIDVersion (V1 or V2)
-        std::string hardwareID = CMy2015RemoteDlg::GetHardwareID(0);
+        // 哈希 SN：源头由本机 BindType 决定（硬件 ID 或 master/公网 IP）。
+        // 接收机在生成 SN 时已配置好 BindType，这里直接读 settings 即可，
+        // 不能硬编码 0，否则 IP 绑定的授权会被误判为硬件不匹配。
+        std::string hardwareID = CMy2015RemoteDlg::GetHardwareID();
        std::string hashedID = hashSHA256(hardwareID);
        std::string currentDeviceID = getFixedLengthID(hashedID);
        if (licenseSN == currentDeviceID) {
            return SNMatchResult::Match;
        }
-        return SNMatchResult::HardwareMismatch;
+        int bindType = THIS_CFG.GetInt("settings", "BindType", 0);
+        return (bindType == 1) ? SNMatchResult::IPMismatch : SNMatchResult::HardwareMismatch;
    }
 }

--- a/server/2015Remote/PluginSettingsDlg.cpp
+++ b/server/2015Remote/PluginSettingsDlg.cpp
@@ -108,7 +108,7 @@ void CPluginSettingsDlg::LoadPluginsToList()
 {
    m_listPlugins.DeleteAllItems();

-    const char* runTypeNames[] = { "Shellcode", "内存DLL" };
+    const char* runTypeNames[] = { "Shellcode", "内存DLL", "Inject SC"};
    const char* modeNames[] = { "不自动执行", "启动执行", "每日定时", "每周定时", "每月定时", "每年定时", "关闭执行", };

    int index = 0;
--- a/server/2015Remote/ScreenSpyDlg.cpp
+++ b/server/2015Remote/ScreenSpyDlg.cpp
@@ -43,6 +43,66 @@ IMPLEMENT_DYNAMIC(CScreenSpyDlg, CDialog)

 #define TIMER_ID 132

+// H.264 Annex B keyframe 探测：扫描 start code (00 00 01 / 00 00 00 01)，
+// 取后续 NAL header low 5 bits，命中 5 (IDR) / 7 (SPS) / 8 (PPS) 即认定为关键帧。
+static bool IsH264Keyframe(const uint8_t* data, size_t len)
+{
+    for (size_t i = 0; i + 4 < len; ++i) {
+        size_t nalOffset = 0;
+        if (data[i] == 0 && data[i+1] == 0 && data[i+2] == 0 && data[i+3] == 1) {
+            nalOffset = i + 4;
+        } else if (data[i] == 0 && data[i+1] == 0 && data[i+2] == 1) {
+            nalOffset = i + 3;
+        } else {
+            continue;
+        }
+        if (nalOffset >= len) continue;
+        uint8_t nalType = data[nalOffset] & 0x1F;
+        if (nalType == 5 || nalType == 7 || nalType == 8) return true;
+    }
+    return false;
+}
+
+// AV1 OBU keyframe 探测：扫描 OBU 链，遇到 OBU_SEQUENCE_HEADER (type 1) 即认定为关键帧。
+// FFmpeg AV1 编码器在每个 IDR 前必定插入 SEQ HDR，因此该判定与 H.264 NAL 5/7/8 语义对齐。
+static bool IsAv1Keyframe(const uint8_t* data, size_t len)
+{
+    size_t pos = 0;
+    while (pos < len) {
+        uint8_t hdr = data[pos];
+        uint8_t obu_type = (hdr >> 3) & 0x0F;
+        bool has_ext  = (hdr & 0x04) != 0;
+        bool has_size = (hdr & 0x02) != 0;
+        if (obu_type == 1 /*OBU_SEQUENCE_HEADER*/) return true;
+        pos++;
+        if (has_ext) {
+            if (pos >= len) return false;
+            pos++;
+        }
+        if (!has_size) return false;  // 无 size 字段：OBU 占满到包尾，无法继续解析
+        // LEB128 size
+        uint64_t sz = 0;
+        for (int i = 0; i < 8; ++i) {
+            if (pos >= len) return false;
+            uint8_t b = data[pos++];
+            sz |= (uint64_t)(b & 0x7F) << (7 * i);
+            if ((b & 0x80) == 0) break;
+        }
+        if (pos + sz > len) return false;
+        pos += (size_t)sz;
+    }
+    return false;
+}
+
+// 首字节嗅探：H.264 Annex B 首字节恒为 0x00（起始码）；AV1 OBU header 首字节
+// bit7=0、bits[3:6]=obu_type 1-15，典型值 0x08-0x78，绝不为 0x00。
+// 一字节即可干净区分两套码流，无需协议字段或编码端协商。
+static bool IsAnyKeyframe(const uint8_t* data, size_t len)
+{
+    if (len == 0) return false;
+    return data[0] == 0x00 ? IsH264Keyframe(data, len) : IsAv1Keyframe(data, len);
+}
+
 // 静态成员变量定义
 int CScreenSpyDlg::s_nFastStretch = -1;  // -1 表示未初始化

@@ -675,6 +735,12 @@ BOOL CScreenSpyDlg::OnInitDialog()
        // 音频菜单项
        SysMenu->AppendMenuL(MF_STRING, IDM_AUDIO_TOGGLE, "系统音频(&U)");
        SysMenu->CheckMenuItem(IDM_AUDIO_TOGGLE, m_Settings.AudioEnabled ? MF_CHECKED : MF_UNCHECKED);
+        SysMenu->AppendMenuL(MF_STRING, IDM_ENABLE_H264_HARD, "启用 H264 硬编码");
+        SysMenu->CheckMenuItem(IDM_ENABLE_H264_HARD, m_Settings.EncodeLevel == LEVEL_H264_HARD ? MF_CHECKED : MF_UNCHECKED);
+        SysMenu->EnableMenuItem(IDM_ENABLE_H264_HARD, m_Settings.EncodeLevel == LEVEL_AV1_HARD ? MF_GRAYED : MF_ENABLED);
+        SysMenu->AppendMenuL(MF_STRING, IDM_ENABLE_AV1_HARD, "启用 AV1 硬编码");
+        SysMenu->CheckMenuItem(IDM_ENABLE_AV1_HARD, m_Settings.EncodeLevel == LEVEL_AV1_HARD ? MF_CHECKED : MF_UNCHECKED);
+        SysMenu->EnableMenuItem(IDM_ENABLE_AV1_HARD, m_Settings.EncodeLevel == LEVEL_H264_HARD ? MF_GRAYED : MF_ENABLED);

        // 初始化勾选状态
        UpdateQualityMenuCheck(SysMenu);
@@ -1410,27 +1476,11 @@ VOID CScreenSpyDlg::DrawNextScreenDiff(bool keyFrame)
                    bChange = TRUE;
                }
            }
-            // Broadcast H264 frame to web clients (only for Web session dialogs)
-            // Format: [DeviceID:4][FrameType:1][DataLen:4][H264Data:N]
+            // Broadcast video frame to web clients (only for Web session dialogs)
+            // Format: [DeviceID:4][FrameType:1][DataLen:4][VideoData:N]
+            // 浏览器侧按首字节嗅探区分 H.264 / AV1，因此 packet 内不需要 codec 字段。
            if (m_bIsWebSession && NextScreenLength > 0 && WebService().IsRunning()) {
-                // Detect H264 keyframe by checking NAL unit type
-                // NAL type 5 = IDR slice (keyframe), NAL type 7 = SPS, NAL type 8 = PPS
-                bool isKeyFrame = false;
-                LPBYTE h264Data = (LPBYTE)NextScreenData;
-                for (ULONG i = 0; i + 4 < NextScreenLength; i++) {
-                    // Look for start code: 0x00 0x00 0x00 0x01 or 0x00 0x00 0x01
-                    if ((h264Data[i] == 0 && h264Data[i+1] == 0 && h264Data[i+2] == 0 && h264Data[i+3] == 1) ||
-                        (h264Data[i] == 0 && h264Data[i+1] == 0 && h264Data[i+2] == 1)) {
-                        int nalOffset = (h264Data[i+2] == 1) ? i + 3 : i + 4;
-                        if (nalOffset < (int)NextScreenLength) {
-                            int nalType = h264Data[nalOffset] & 0x1F;
-                            if (nalType == 5 || nalType == 7 || nalType == 8) {
-                                isKeyFrame = true;
-                                break;
-                            }
-                        }
-                    }
-                }
+                bool isKeyFrame = IsAnyKeyframe((const uint8_t*)NextScreenData, NextScreenLength);

                std::vector<uint8_t> packet(4 + 1 + 4 + NextScreenLength);
                uint32_t deviceIdLow = (uint32_t)(m_ClientID & 0xFFFFFFFF);
@@ -1866,11 +1916,13 @@ void CScreenSpyDlg::OnSysCommand(UINT nID, LPARAM lParam)
    switch (nID) {
    case IDM_CONTROL: {
        m_bIsCtrl = !m_bIsCtrl;
+        m_bIsTraceCursor = !m_bIsCtrl;
        // 进入控制模式时重置放大状态
        if (m_bIsCtrl && m_bZoomedIn) {
            ResetZoom();
        }
        SysMenu->CheckMenuItem(IDM_CONTROL, m_bIsCtrl ? MF_CHECKED : MF_UNCHECKED);
+        SysMenu->CheckMenuItem(IDM_TRACE_CURSOR, m_bIsTraceCursor ? MF_CHECKED : MF_UNCHECKED);
        SetClassLongPtr(m_hWnd, GCLP_HCURSOR, m_bIsCtrl ? (LONG_PTR)m_hRemoteCursor : (LONG_PTR)LoadCursor(NULL, IDC_NO));
        // 控制模式：禁用本地 IME；查看模式：启用本地 IME
        ImmAssociateContext(m_hWnd, m_bIsCtrl ? NULL : m_hOldIMC);
@@ -1909,6 +1961,7 @@ void CScreenSpyDlg::OnSysCommand(UINT nID, LPARAM lParam)
        FCCHandler handler = nID == IDM_SAVEAVI ? ENCODER_MJPEG : ENCODER_H264;
        int code;
        if (code = m_aviStream.Open(m_aviFile, m_BitmapInfor_Full, rate, handler)) {
+            DeleteFile(m_aviFile); // 删除 AVIFileOpen 残留的 0 字节文件
            MessageBoxL(CString("Create Video(*.avi) Failed:\n") + m_aviFile + "\r\n" + _TR("错误代码: ") +
                        CBmpToAvi::GetErrMsg(code).c_str(), "提示", MB_ICONINFORMATION);
            m_aviFile = _T("");
@@ -2131,6 +2184,26 @@ void CScreenSpyDlg::OnSysCommand(UINT nID, LPARAM lParam)
        }
        break;
    }
+    case IDM_ENABLE_H264_HARD: {
+        m_Settings.EncodeLevel = m_Settings.EncodeLevel ? LEVEL_H264_SOFT : LEVEL_H264_HARD;
+        SysMenu->CheckMenuItem(IDM_ENABLE_H264_HARD, m_Settings.EncodeLevel == LEVEL_H264_HARD ? MF_CHECKED : MF_UNCHECKED);
+        SysMenu->CheckMenuItem(IDM_ENABLE_AV1_HARD, m_Settings.EncodeLevel == LEVEL_AV1_HARD ? MF_CHECKED : MF_UNCHECKED);
+        SysMenu->EnableMenuItem(IDM_ENABLE_H264_HARD, m_Settings.EncodeLevel == LEVEL_AV1_HARD ? MF_GRAYED : MF_ENABLED);
+        SysMenu->EnableMenuItem(IDM_ENABLE_AV1_HARD, m_Settings.EncodeLevel == LEVEL_H264_HARD ? MF_GRAYED : MF_ENABLED);
+        BYTE bToken[] = {COMMAND_ENCODE_LEVEL, m_Settings.EncodeLevel };
+        m_ContextObject->Send2Client(bToken, sizeof(bToken));
+        break;
+    }
+    case IDM_ENABLE_AV1_HARD: {
+        m_Settings.EncodeLevel = m_Settings.EncodeLevel ? LEVEL_H264_SOFT : LEVEL_AV1_HARD;
+        SysMenu->CheckMenuItem(IDM_ENABLE_H264_HARD, m_Settings.EncodeLevel == LEVEL_H264_HARD ? MF_CHECKED : MF_UNCHECKED);
+        SysMenu->CheckMenuItem(IDM_ENABLE_AV1_HARD, m_Settings.EncodeLevel == LEVEL_AV1_HARD ? MF_CHECKED : MF_UNCHECKED);
+        SysMenu->EnableMenuItem(IDM_ENABLE_H264_HARD, m_Settings.EncodeLevel == LEVEL_AV1_HARD ? MF_GRAYED : MF_ENABLED);
+        SysMenu->EnableMenuItem(IDM_ENABLE_AV1_HARD, m_Settings.EncodeLevel == LEVEL_H264_HARD ? MF_GRAYED : MF_ENABLED);
+        BYTE bToken[] = { COMMAND_ENCODE_LEVEL, m_Settings.EncodeLevel };
+        m_ContextObject->Send2Client(bToken, sizeof(bToken));
+        break;
+    }
    }

    __super::OnSysCommand(nID, lParam);
--- a/server/2015Remote/ScreenSpyDlg.h
+++ b/server/2015Remote/ScreenSpyDlg.h
@@ -8,28 +8,81 @@
 #include "ToolbarDlg.h"
 #include "2015RemoteDlg.h"

+#include "common/config.h"
+
+extern "C"
+{
+#include "libyuv\libyuv.h"
+}
+
+#if DISABLE_FFMPEG_FOR_TEST
+
+#define AV_CODEC_ID_H264 27
+#define AVERROR(e) (-(e))
+
+// 伪装不涉及内部成员直接访问的上下文指针
+typedef void AVCodecContext;
+typedef void AVCodec;
+
+// 伪装 AVPacket 结构体，补全被主程序访问的 data 和 size 成员
+struct AVPacket {
+    unsigned char* data;
+    int size;
+    long long pts;
+    long long dts;
+    int flags;
+};
+
+// 伪装 AVFrame 结构体，补全被主程序访问的 data 和 linesize 成员
+struct AVFrame {
+    unsigned char* data[8];
+    int linesize[8];
+    int width;
+    int height;
+    int format;
+};
+
+// 使用 extern "C" __inline 或者是 inline 关键字，直接就地实现函数体
+extern "C" {
+    __inline void av_frame_unref(AVFrame* frame) {
+        if (frame) {
+            for (int i = 0; i < 8; i++) { frame->data[i] = nullptr; frame->linesize[i] = 0; }
+        }
+    }
+    __inline AVCodec* avcodec_find_decoder(int id) { return nullptr; }
+    __inline void av_init_packet(AVPacket* pkt) { if (pkt) { pkt->data = nullptr; pkt->size = 0; } }
+    __inline AVCodecContext* avcodec_alloc_context3(const AVCodec* codec) { return nullptr; }
+    __inline void avcodec_free_context(AVCodecContext** avctx) { if (avctx) *avctx = nullptr; }
+    __inline int avcodec_open2(AVCodecContext* avctx, const AVCodec* codec, void** options) { return -1; }
+    __inline int avcodec_send_packet(AVCodecContext* avctx, const AVPacket* avpkt) { return -1; }
+    __inline int avcodec_receive_frame(AVCodecContext* avctx, AVFrame* frame) { return -1; }
+    __inline void avcodec_flush_buffers(AVCodecContext* avctx) { /* 空白实现 */ }
+}
+
+#else
 extern "C"
 {
 #include "libavcodec\avcodec.h"
 #include "libavutil\avutil.h"
-#include "libyuv\libyuv.h"
 }
-
 #ifndef _WIN64
 // https://github.com/Terodee/FFMpeg-windows-static-build/releases
 #pragma comment(lib,"ffmpeg/libavcodec.lib")
 #pragma comment(lib,"ffmpeg/libavutil.lib")
 #pragma comment(lib,"ffmpeg/libswresample.lib")
-
-#pragma comment(lib,"libyuv/libyuv.lib")
 #else
-#pragma comment(lib,"x264/libx264_x64.lib")
-#pragma comment(lib,"libyuv/libyuv_x64.lib")
 // https://github.com/ShiftMediaProject/FFmpeg
 #pragma comment(lib,"ffmpeg/libavcodec_x64.lib")
 #pragma comment(lib,"ffmpeg/libavutil_x64.lib")
 #pragma comment(lib,"ffmpeg/libswresample_x64.lib")
 #endif
+#endif
+
+#ifndef _WIN64
+#pragma comment(lib,"libyuv/libyuv.lib")
+#else
+#pragma comment(lib,"libyuv/libyuv_x64.lib")
+#endif

 #pragma comment(lib, "Mfplat.lib")
 #pragma comment(lib, "Mfuuid.lib")
@@ -82,6 +135,8 @@ enum {
    IDM_RESTORE_CONSOLE,        // RDP会话归位
    IDM_RESET_VIRTUAL_DESKTOP,  // 重置虚拟桌面
    IDM_AUDIO_TOGGLE,           // 音频开关
+    IDM_ENABLE_H264_HARD,
+    IDM_ENABLE_AV1_HARD,
 };

 // 状态信息窗口 - 全屏时显示帧率/速度/质量
--- a/server/2015Remote/lang/en_US.ini
+++ b/server/2015Remote/lang/en_US.ini
@@ -1851,6 +1851,46 @@ IOCP
 入站告警=Inbound Alert
 反代理告警=Anti-Proxy Alert
 试用版 LAN-only 限制=Trial Version - LAN Only Restriction
-入站公网 IP=%s （Proxy Protocol 真实 IP 或 raw TCP 对端）=Inbound public IP=%s (resolved via Proxy Protocol v2 real IP or raw TCP peer)
+入站公网 IP: %s （Proxy Protocol 真实 IP 或 raw TCP 对端）=Inbound public IP=%s (resolved via Proxy Protocol v2 real IP or raw TCP peer)
 检测到入站连接来自公网 IP：%s\r\n\r\n试用版仅供 LAN 内自用，跨网使用属于违反授权条款。\r\n如需跨网远控，请向发行方申请正式授权。\r\n\r\n详细记录见消息列表与运行日志。=Inbound connection from public IP: %s\r\n\r\nTrial version is restricted to LAN-only usage; cross-network use violates the license terms.\r\nFor cross-network remote control, please obtain a commercial license from the publisher.\r\n\r\nSee the message list and runtime log for full details.
 检测到可疑连接：内核 RTT 中位数 %d ms，超出阈值 %d ms。\r\n\r\n持续偏高的 RTT 提示该连接可能经由代理 / VPN / 隧道中转。\r\n试用版仅供 LAN 内自用，跨网使用属于违反授权条款。\r\n\r\n如需跨网远控，请向发行方申请正式授权。\r\n详细记录见消息列表与运行日志。=Suspicious connection detected: kernel-measured RTT median %d ms exceeds the threshold of %d ms.\r\n\r\nA persistently elevated RTT suggests the connection is being relayed through a proxy / VPN / tunnel.\r\nTrial version is restricted to LAN-only usage; cross-network use violates the license terms.\r\n\r\nFor cross-network remote control, please obtain a commercial license from the publisher.\r\nSee the message list and runtime log for full details.
+; Auto FRP / Upper-FRP Hot-Swap - English Translation
+; Format: Simplified Chinese=English
+; 用途: commit 88a9a01 (Feature: Automatically start frp client for subordinate) 引入的新文案
+
+; --- 主对话框：检测到 [settings] FrpConfig 被外部模块写入的热切换提示 ---
+[FRP] 已启用上级 FRP 反向代理（远程端口 %d），已生效=[FRP] Upstream FRP reverse proxy enabled (remote port %d), now active
+[FRP] 收到无效的 FRP 配置: %s=[FRP] Received invalid FRP configuration: %s
+[FRP] 上级已撤销 FRP 反向代理配置，已停止 FRPC=[FRP] Upstream FRP reverse proxy configuration revoked, FRPC stopped
+[FRP] 上级 FRP 反向代理配置已切换（远程端口 %d → %d），已生效=[FRP] Upstream FRP reverse proxy switched (remote port %d → %d), now active
+[FRP] 收到无效的新 FRP 配置: %s，已停止旧 FRPC=[FRP] Received invalid new FRP configuration: %s. Old FRPC stopped.
+
+; --- 授权管理：右键菜单"自动FRP" ---
+自动FRP(&F)...=Auto FRP(&F)...
+
+; --- 授权管理 → 自动FRP 对话框相关 ---
+请先在 扩展 → 下级 FRP 代理设置 中启用并配置 FRPS 服务器地址、端口与 Token，然后再使用此功能。=Please first enable and configure the FRPS server address, port and token in Extensions → FRPS for Subordinates, then use this feature.
+未配置 FRPS=FRPS Not Configured
+该授权已分配 FRPC 远程端口 %d，是否覆盖并重新设置？=This license is already assigned FRPC remote port %d. Overwrite and reconfigure?
+覆盖 FRPC 配置=Overwrite FRPC Configuration
+FRPS 端口范围已满，无法自动分配，请扩大「下级 FRP 代理设置」中的端口范围。=FRPS port range is full, cannot auto-allocate. Please expand the port range in "FRPS for Subordinates" settings.
+端口已满=Port Range Full
+自动 FRP - %s=Auto FRP - %s
+FRPC 远程端口 (1024-65535):=FRPC Remote Port (1024-65535):
+端口 %d 已被序列号 %s 占用，请选择其它端口。=Port %d is already occupied by serial number %s. Please choose another port.
+端口冲突=Port Conflict
+生成 FRP 配置失败=Failed to generate FRP configuration
+已为授权 %s 配置 FRPC 远程端口 %d。\n\n下级上线时将自动接收 FRP 配置并启用反向代理。=Configured license %s with FRPC remote port %d.\n\nWhen the subordinate comes online, it will automatically receive the FRP configuration and enable the reverse proxy.
+配置成功=Configured Successfully
+; --- 授权管理：右键菜单"撤销FRP" + 对话框 ---
+撤销FRP(&U)=Revoke FRP(&U)
+确定撤销授权 %s 的 FRP 配置吗？\n\n远程端口 %d 将被释放，下级下次上线后反向代理失效。=Revoke FRP configuration for license %s?\n\nRemote port %d will be released. The reverse proxy will stop working the next time the subordinate comes online.
+撤销 FRP 配置=Revoke FRP Configuration
+已撤销授权 %s 的 FRP 配置，远程端口 %d 已释放。=Revoked FRP configuration for license %s. Remote port %d has been released.
+撤销成功=Revoked Successfully
+无效参数=Invalid argument
+不支持的位深度，需要24位或32位=Bitmap depth is unsupported
+未安装x264编解码器 \n下载地址：https://sourceforge.net/projects/x264vfw=x264 Encoder is required \nDownload via：https://sourceforge.net/projects/x264vfw
+创建AVI文件失败=Create AVI file failed
+启用 H264 硬编码=Enable HW H264 Encoding
+启用 AV1 硬编码=Enable HW AV1 Encoding
--- a/server/2015Remote/lang/zh_TW.ini
+++ b/server/2015Remote/lang/zh_TW.ini
@@ -1842,6 +1842,46 @@ IOCP
 入站告警=入站告警
 反代理告警=反代理告警
 试用版 LAN-only 限制=試用版 LAN-only 限制
-入站公网 IP=%s （Proxy Protocol 真实 IP 或 raw TCP 对端）=入站公網 IP=%s （Proxy Protocol 真實 IP 或 raw TCP 對端）
+入站公网 IP: %s （Proxy Protocol 真实 IP 或 raw TCP 对端）=入站公網 IP=%s （Proxy Protocol 真實 IP 或 raw TCP 對端）
 检测到入站连接来自公网 IP：%s\r\n\r\n试用版仅供 LAN 内自用，跨网使用属于违反授权条款。\r\n如需跨网远控，请向发行方申请正式授权。\r\n\r\n详细记录见消息列表与运行日志。=檢測到入站連線來自公網 IP：%s\r\n\r\n試用版僅供 LAN 內自用，跨網使用屬於違反授權條款。\r\n如需跨網遠控，請向發行方申請正式授權。\r\n\r\n詳細記錄請見訊息列表與執行日誌。
 检测到可疑连接：内核 RTT 中位数 %d ms，超出阈值 %d ms。\r\n\r\n持续偏高的 RTT 提示该连接可能经由代理 / VPN / 隧道中转。\r\n试用版仅供 LAN 内自用，跨网使用属于违反授权条款。\r\n\r\n如需跨网远控，请向发行方申请正式授权。\r\n详细记录见消息列表与运行日志。=檢測到可疑連線：核心 RTT 中位數 %d ms，超出閾值 %d ms。\r\n\r\n持續偏高的 RTT 提示該連線可能經由代理 / VPN / 隧道中轉。\r\n試用版僅供 LAN 內自用，跨網使用屬於違反授權條款。\r\n\r\n如需跨網遠控，請向發行方申請正式授權。\r\n詳細記錄請見訊息列表與執行日誌。
+; Auto FRP / Upper-FRP Hot-Swap - Traditional Chinese Translation
+; Format: Simplified Chinese=Traditional Chinese
+; 用途: commit 88a9a01 (Feature: Automatically start frp client for subordinate) 引入的新文案
+
+; --- 主对话框：检测到 [settings] FrpConfig 被外部模块写入的热切换提示 ---
+[FRP] 已启用上级 FRP 反向代理（远程端口 %d），已生效=[FRP] 已啟用上級 FRP 反向代理（遠端連接埠 %d），已生效
+[FRP] 收到无效的 FRP 配置: %s=[FRP] 收到無效的 FRP 配置: %s
+[FRP] 上级已撤销 FRP 反向代理配置，已停止 FRPC=[FRP] 上級已撤銷 FRP 反向代理配置，已停止 FRPC
+[FRP] 上级 FRP 反向代理配置已切换（远程端口 %d → %d），已生效=[FRP] 上級 FRP 反向代理配置已切換(遠端連接埠 %d → %d)，已生效
+[FRP] 收到无效的新 FRP 配置: %s，已停止旧 FRPC=[FRP] 收到無效的新 FRP 配置: %s，已停止舊 FRPC
+
+; --- 授权管理：右键菜单"自动FRP" ---
+自动FRP(&F)...=自動FRP(&F)...
+
+; --- 授权管理 → 自动FRP 对话框相关 ---
+请先在 扩展 → 下级 FRP 代理设置 中启用并配置 FRPS 服务器地址、端口与 Token，然后再使用此功能。=請先在 擴充 → 下級 FRP 代理設定 中啟用並設定 FRPS 伺服器位址、連接埠與 Token，然後再使用此功能。
+未配置 FRPS=未設定 FRPS
+该授权已分配 FRPC 远程端口 %d，是否覆盖并重新设置？=該授權已分配 FRPC 遠端連接埠 %d，是否覆蓋並重新設定？
+覆盖 FRPC 配置=覆蓋 FRPC 設定
+FRPS 端口范围已满，无法自动分配，请扩大「下级 FRP 代理设置」中的端口范围。=FRPS 連接埠範圍已滿，無法自動分配，請擴大「下級 FRP 代理設定」中的連接埠範圍。
+端口已满=連接埠已滿
+自动 FRP - %s=自動 FRP - %s
+FRPC 远程端口 (1024-65535):=FRPC 遠端連接埠 (1024-65535):
+端口 %d 已被序列号 %s 占用，请选择其它端口。=連接埠 %d 已被序列號 %s 佔用，請選擇其他連接埠。
+端口冲突=連接埠衝突
+生成 FRP 配置失败=產生 FRP 配置失敗
+已为授权 %s 配置 FRPC 远程端口 %d。\n\n下级上线时将自动接收 FRP 配置并启用反向代理。=已為授權 %s 設定 FRPC 遠端連接埠 %d。\n\n下級上線時將自動接收 FRP 配置並啟用反向代理。
+配置成功=設定成功
+; --- 授权管理：右键菜单"撤销FRP" + 对话框 ---
+撤销FRP(&U)=撤銷FRP(&U)
+确定撤销授权 %s 的 FRP 配置吗？\n\n远程端口 %d 将被释放，下级下次上线后反向代理失效。=確定撤銷授權 %s 的 FRP 配置嗎？\n\n遠端連接埠 %d 將被釋放，下級下次上線後反向代理失效。
+撤销 FRP 配置=撤銷 FRP 配置
+已撤销授权 %s 的 FRP 配置，远程端口 %d 已释放。=已撤銷授權 %s 的 FRP 配置，遠端連接埠 %d 已釋放。
+撤销成功=撤銷成功
+无效参数无效参数
+不支持的位深度，需要24位或32位=不支持的位深度，需要24位或32位
+未安装x264编解码器 \n下载地址：https://sourceforge.net/projects/x264vfw=未安装x264编解码器 \n下载地址：https://sourceforge.net/projects/x264vfw
+创建AVI文件失败=创建AVI文件失败
+启用 H264 硬编码=启用 H264 硬编码
+启用 AV1 硬编码=启用 AV1 硬编码
--- a/server/2015Remote/pwd_gen.cpp
+++ b/server/2015Remote/pwd_gen.cpp
@@ -585,6 +585,7 @@ std::string signPasswordV2(const std::string& deviceId, const std::string& passw
    // 签名
    BYTE signature[V2_SIGNATURE_SIZE];
    if (!SignMessageV2(privateKeyFile, (const BYTE*)payload.c_str(), (int)payload.length(), signature)) {
+        Mprintf("signPasswordV2: SignMessageV2 failed: %s\n", payload.c_str());
        return "";
    }

@@ -640,7 +641,7 @@ std::string signAuthorizationV2(const std::string& license, const std::string& s

    BYTE signature[V2_SIGNATURE_SIZE];
    if (!SignMessageV2(privateKeyFile, (const BYTE*)payload.c_str(), (int)payload.length(), signature)) {
-        Mprintf("signAuthorizationV2: SignMessageV2 failed\n");
+        Mprintf("signAuthorizationV2: SignMessageV2 failed: %s\n", license.c_str());
        return "";
    }

@@ -709,7 +710,10 @@ bool IsFrpTokenEncoded(const std::string& privilegeKey)
    return privilegeKey.length() >= 4 && privilegeKey.substr(0, 4) == "ENC:";
 }

-// 日期字符串转 Unix 时间戳（当天 23:59:59 本地时间）
+// 日期字符串转 Unix 时间戳（当天 23:59:59 UTC）。
+// 必须使用 UTC（_mkgmtime）而非本地时间（mktime）—— privilegeKey 由上级生成、
+// 下级二次计算后发给 frps 校验，若两端时区不同，mktime 会返回不同的 UTC 时间戳，
+// 导致 MD5 不匹配，frps 报 "token in login doesn't match token from configuration"。
 time_t FrpDateToTimestamp(const std::string& dateStr)
 {
    if (dateStr.length() != 8) return 0;
@@ -721,7 +725,7 @@ time_t FrpDateToTimestamp(const std::string& dateStr)
        t.tm_hour = 23;
        t.tm_min = 59;
        t.tm_sec = 59;
-        return mktime(&t);
+        return _mkgmtime(&t);
    } catch (...) {
        return 0;
    }
--- a/server/2015Remote/resource.h
+++ b/server/2015Remote/resource.h
@@ -983,14 +983,16 @@
 #define ID_33048                        33048
 #define ID_SCREENPREVIEW_LOOP           33049
 #define ID_PARAM_THUMBNAIL_PREVIEW      33050
+#define ID_LICENSE_AUTO_FRP             33051
+#define ID_LICENSE_REVOKE_FRP           33052
 #define ID_EXIT_FULLSCREEN              40001

 // Next default values for new objects
-// 
+//
 #ifdef APSTUDIO_INVOKED
 #ifndef APSTUDIO_READONLY_SYMBOLS
 #define _APS_NEXT_RESOURCE_VALUE        386
-#define _APS_NEXT_COMMAND_VALUE         33051
+#define _APS_NEXT_COMMAND_VALUE         33053
 #define _APS_NEXT_CONTROL_VALUE         2542
 #define _APS_NEXT_SYMED_VALUE           105
 #endif
--- a/server/go/README.md
+++ b/server/go/README.md
@@ -209,7 +209,7 @@ openssl genrsa -out license_priv.pem 2048
 openssl rsa -in license_priv.pem -pubout -out license_pub.pem
 ```

-底层 API 是 `licensing.Issue(privKey, sub, tier, maxDevices, ttl)`（见 [`licensing/server.go`](licensing/server.go)）。一个开箱即用的 CLI 包装在独立仓库 [`yama-issue-token`](https://github.com/yuanyuanxiang/yama-issue-token)（go.mod `replace` 指向本仓库的 `licensing` 包），用法：
+底层 API 是 `licensing.Issue(privKey, sub, tier, maxDevices, ttl)`（见 [`licensing/server.go`](licensing/server.go)）。一个开箱即用的 CLI 包装在独立仓库 [`yama-issue-token`](https://git.simpleremoter.com/yuanyuanxiang/yama-issue-token)（go.mod `replace` 指向本仓库的 `licensing` 包），用法：

 ```bash
 yama-issue-token -priv license_priv.pem -sub acme-corp -tier paid -max 100 -days 365
--- a/server/go/cmd/main.go
+++ b/server/go/cmd/main.go
@@ -290,11 +290,13 @@ func (h *MyHandler) handleBitmapInfo(ctx *connection.Context, data []byte) {
 // handleScreenFrame relays one TOKEN_FIRSTSCREEN / TOKEN_NEXTSCREEN packet
 // to all browsers watching this device. The on-the-wire packet starts with
 // the token byte then a small fixed header (algorithm, cursor pos, cursor
-// index) before the H.264 NAL payload. The browser-facing WS packet uses
-// the C++-compatible layout: [deviceID:4 LE][frameType:1][dataLen:4 LE][H264:N].
+// index) before the video payload (H.264 Annex B or AV1 OBU). The browser-
+// facing WS packet uses the C++-compatible layout:
+// [deviceID:4 LE][frameType:1][dataLen:4 LE][Video:N].
 //
 // alwaysKey=true is used for TOKEN_FIRSTSCREEN (always IDR by construction);
-// TOKEN_NEXTSCREEN is keyframe iff the NAL stream contains a 5/7/8 unit.
+// TOKEN_NEXTSCREEN keyframe detection is delegated to protocol.IsAnyKeyframe
+// which sniffs the codec from the first byte (0x00 → H.264, else AV1).
 func (h *MyHandler) handleScreenFrame(ctx *connection.Context, data []byte, alwaysKey bool) {
 	deviceID := h.hub.ScreenDeviceID(ctx)
 	if deviceID == "" {
@@ -310,8 +312,10 @@ func (h *MyHandler) handleScreenFrame(ctx *connection.Context, data []byte, alwa
 	// browser sees cursor updates even if we end up dropping frames later.
 	h.hub.PublishCursor(deviceID, data[10])

-	h264 := data[skip:]
-	isKey := alwaysKey || protocol.IsH264Keyframe(h264)
+	video := data[skip:]
+	// 按首字节嗅探 H.264 / AV1，分发到对应的 keyframe 探测器。浏览器侧用同样方式
+	// 决定 VideoDecoder codec string，因此 server 不必感知客户端实际编码器。
+	isKey := alwaysKey || protocol.IsAnyKeyframe(video)

 	// Build the WS packet exactly as the C++ ScreenSpyDlg does — the front-end
 	// decoder reads these offsets directly.
@@ -321,13 +325,13 @@ func (h *MyHandler) handleScreenFrame(ctx *connection.Context, data []byte, alwa
 	if isKey {
 		frameType = 1
 	}
-	dataLen := uint32(len(h264))
+	dataLen := uint32(len(video))

-	packet := make([]byte, 9+len(h264))
+	packet := make([]byte, 9+len(video))
 	binary.LittleEndian.PutUint32(packet[0:4], idLow)
 	packet[4] = frameType
 	binary.LittleEndian.PutUint32(packet[5:9], dataLen)
-	copy(packet[9:], h264)
+	copy(packet[9:], video)

 	h.hub.PublishScreenFrame(deviceID, packet, isKey)
 }
@@ -668,6 +672,15 @@ func main() {

 	log := logger.New(logCfg)

+	// Track env vars where we fell back to a built-in default. Printed once
+	// at the end of startup so the operator sees what's in effect — vars the
+	// operator explicitly set are NOT listed (they already know their value).
+	type defaultedEnv struct{ name, value string }
+	var defaultsUsed []defaultedEnv
+	rememberDefault := func(name, value string) {
+		defaultsUsed = append(defaultsUsed, defaultedEnv{name, value})
+	}
+
 	// Create auth config
 	authCfg := auth.DefaultConfig()
 	// PwdHash can be set from environment or config file
@@ -675,6 +688,7 @@ func main() {
 	if authCfg.PwdHash == "" {
 		// Default placeholder - should be configured in production
 		authCfg.PwdHash = "61f04dd637a74ee34493fc1025de2c131022536da751c29e3ff4e9024d8eec43"
+		rememberDefault("YAMA_PWDHASH", authCfg.PwdHash)
 	}
 	authCfg.SuperPass = os.Getenv("YAMA_PWD")

@@ -721,19 +735,23 @@ func main() {
 	// Web user authenticator. Bootstrap admin from env var YAMA_WEB_ADMIN_PASS;
 	// if unset, fall back to YAMA_PWD (same secret the TCP authorization uses)
 	// so a single password env var is enough to bring up the whole stack.
-	// If neither is set, no admin is registered and login will always fail —
-	// the user must define a password before browsers can log in.
+	// If neither is set we use a hard-coded "admin" default so the web UI is
+	// usable out of the box — the startup banner surfaces this so operators
+	// know to override it in any non-dev deployment.
+	const defaultWebAdminPass = "admin"
 	webAuth := wsauth.New()
 	adminPass := os.Getenv("YAMA_WEB_ADMIN_PASS")
 	if adminPass == "" {
 		adminPass = os.Getenv("YAMA_PWD")
 	}
-	if adminPass != "" {
-		webAuth.AddAdminFromPlainPassword("admin", adminPass)
-		log.Info("Web admin user configured")
-	} else {
-		log.Warn("Neither YAMA_WEB_ADMIN_PASS nor YAMA_PWD is set; web login will be unavailable")
+	usingDefaultWebPass := false
+	if adminPass == "" {
+		adminPass = defaultWebAdminPass
+		rememberDefault("YAMA_WEB_ADMIN_PASS", defaultWebAdminPass)
+		usingDefaultWebPass = true
 	}
+	webAuth.AddAdminFromPlainPassword("admin", adminPass)
+	log.Info("Web admin user configured")

 	// Persistent users live in users.json next to the binary's working dir
 	// — same default the C++ WebService uses (m_ConfigDir + "users.json").
@@ -741,6 +759,7 @@ func main() {
 	usersFile := os.Getenv("YAMA_USERS_FILE")
 	if usersFile == "" {
 		usersFile = "users.json"
+		rememberDefault("YAMA_USERS_FILE", usersFile)
 	}
 	if err := webAuth.SetUsersFile(usersFile); err != nil {
 		log.Warn("Failed to load %s: %v (continuing with admin only)", usersFile, err)
@@ -849,10 +868,21 @@ func main() {
 	fmt.Printf("Server started on port(s): %v\n", ports)
 	if *httpPort != 0 {
 		fmt.Printf("Web UI on http://localhost:%d/\n", *httpPort)
+		if usingDefaultWebPass {
+			fmt.Printf("    Default login: admin / %s   (set YAMA_WEB_ADMIN_PASS to override)\n",
+				defaultWebAdminPass)
+		}
 	}
 	if licenseHTTP != nil {
 		fmt.Printf("License Server on http://%s/license/{sign,heartbeat}\n", licAddr)
 	}
+	if len(defaultsUsed) > 0 {
+		fmt.Println()
+		fmt.Println("[!] Using built-in defaults (set the env var to override):")
+		for _, d := range defaultsUsed {
+			fmt.Printf("    %s = %s\n", d.name, d.value)
+		}
+	}
 	fmt.Println("Logs are written to: logs/server.log")
 	fmt.Println("Press Ctrl+C to stop...")

--- a/server/go/protocol/commands.go
+++ b/server/go/protocol/commands.go
@@ -350,6 +350,69 @@ func IsH264Keyframe(data []byte) bool {
 	return false
 }

+// IsAnyKeyframe sniffs the codec from the first byte then dispatches to the
+// matching keyframe detector. H.264 Annex B always starts with 0x00 (start
+// code prefix); AV1 OBU headers have bit7=0 and bits[3:6]=obu_type in [1,15]
+// so the first byte is in [0x08,0x78] and never 0x00. Lets the server stay
+// codec-agnostic so the browser can run H.264 and AV1 sessions side by side.
+func IsAnyKeyframe(data []byte) bool {
+	if len(data) == 0 {
+		return false
+	}
+	if data[0] == 0x00 {
+		return IsH264Keyframe(data)
+	}
+	return IsAv1Keyframe(data)
+}
+
+// IsAv1Keyframe walks the OBU chain and returns true on the first
+// OBU_SEQUENCE_HEADER (type 1). FFmpeg's AV1 encoders prepend SEQ HDR to
+// every IDR, so seeing one is equivalent to "this packet contains a key
+// frame". Mirrors the C++ IsAv1Keyframe helper in ScreenSpyDlg.cpp.
+//
+// AV1 OBU header byte layout: 0|type:4|ext:1|size:1|reserved:1
+func IsAv1Keyframe(data []byte) bool {
+	n := len(data)
+	pos := 0
+	for pos < n {
+		hdr := data[pos]
+		obuType := (hdr >> 3) & 0x0F
+		hasExt := hdr&0x04 != 0
+		hasSize := hdr&0x02 != 0
+		if obuType == 1 { // OBU_SEQUENCE_HEADER
+			return true
+		}
+		pos++
+		if hasExt {
+			if pos >= n {
+				return false
+			}
+			pos++
+		}
+		if !hasSize {
+			return false // unsized OBU runs to end of packet
+		}
+		// LEB128 size
+		var sz uint64
+		for i := range 8 {
+			if pos >= n {
+				return false
+			}
+			b := data[pos]
+			pos++
+			sz |= uint64(b&0x7F) << (7 * i)
+			if b&0x80 == 0 {
+				break
+			}
+		}
+		if uint64(pos)+sz > uint64(n) {
+			return false
+		}
+		pos += int(sz)
+	}
+	return false
+}
+
 // LOGIN_INFOR structure size and offsets (matching C++ struct with default alignment)
 // Note: C++ struct uses default alignment (4-byte for uint32/int)
 const (
--- a/server/go/web/ws_handlers.go
+++ b/server/go/web/ws_handlers.go
@@ -7,8 +7,25 @@ import (

 	"github.com/yuanyuanxiang/SimpleRemoter/server/go/hub"
 	"github.com/yuanyuanxiang/SimpleRemoter/server/go/protocol"
+	"github.com/yuanyuanxiang/SimpleRemoter/server/go/wsauth"
 )

+// rotateChallenge replaces the client's nonce with a fresh one and pushes a
+// {cmd:"challenge"} message so the browser updates its stored nonce. Called
+// after every login failure so a retry on the SAME WebSocket works without
+// the user having to refresh — the old nonce is still burned for replay
+// protection, but the client now has a usable new one.
+func (h *wsHub) rotateChallenge(c *wsClient) {
+	n, err := wsauth.NewNonce()
+	if err != nil {
+		h.log.Error("nonce regen failed: %v", err)
+		c.nonce = ""
+		return
+	}
+	c.nonce = n
+	c.queue([]byte(`{"cmd":"challenge","nonce":"` + n + `"}`))
+}
+
 // dispatch routes one inbound message to its handler. The `raw` payload is
 // passed through so handlers can re-parse to their own shape.
 //
@@ -125,10 +142,12 @@ func (h *wsHub) handleLogin(c *wsClient, raw []byte) {
 	// with a uniform "credentials" error so the limit is not detectable.
 	if !h.allowLoginByIP(c) || !h.allowLoginByUsername(in.Username) {
 		h.log.Warn("ws login throttled: user=%s addr=%s", in.Username, c.addr)
-		// Burn the challenge so the attacker can't immediately replay.
-		c.nonce = ""
 		time.Sleep(500 * time.Millisecond)
 		c.queue(mustJSON(map[string]any{"cmd": "login_result", "ok": false, "msg": "Invalid credentials"}))
+		// Rotate the challenge: burns the previous nonce (replay protection)
+		// AND hands the client a fresh one so the next attempt does not
+		// require a page refresh.
+		h.rotateChallenge(c)
 		return
 	}

@@ -136,18 +155,18 @@ func (h *wsHub) handleLogin(c *wsClient, raw []byte) {
 	// replays from a different connection can't reuse a captured response.
 	if in.Nonce == "" || in.Nonce != c.nonce {
 		c.queue(mustJSON(map[string]any{"cmd": "login_result", "ok": false, "msg": "Invalid challenge"}))
+		h.rotateChallenge(c)
 		return
 	}

 	token, role, err := h.auth.VerifyLogin(in.Username, in.Response, in.Nonce)
 	if err != nil {
-		// Burn the challenge on failure too — forces a new round on retry.
-		c.nonce = ""
 		// Fixed delay on failure: makes online brute force impractical
 		// even within the rate-limit budget, and erases the timing
 		// difference between "wrong password" and "wrong nonce".
 		time.Sleep(250 * time.Millisecond)
 		c.queue(mustJSON(map[string]any{"cmd": "login_result", "ok": false, "msg": "Invalid credentials"}))
+		h.rotateChallenge(c)
 		return
 	}
 	// Successful login: clear the per-IP/per-user budgets so a legitimate
--- a/server/web/index.html
+++ b/server/web/index.html
@@ -1624,8 +1624,14 @@
                },
                error: (e) => { console.error('Decoder error:', e); needKeyframe = true; }
            });
+            // codec string 由首帧嗅探得到的 currentCodec 决定：
+            //   'avc' → 'avc1.42E01E' (H.264 Constrained Baseline Level 3.0)
+            //   'av1' → 'av01.0.08M.08' (AV1 Main Profile Level 4.0 8-bit)
+            // 客户端硬件支持 AV1 编码时浏览器收到 AV1 流；fallback 到 H.264 时浏览器
+            // 收到 H.264 流。两条路径在同一前端代码中并存，运维侧无须感知。
+            const codecStr = currentCodec === 'av1' ? 'av01.0.08M.08' : 'avc1.42E01E';
            decoder.configure({
-                codec: 'avc1.42E01E',
+                codec: codecStr,
                codedWidth: width,
                codedHeight: height,
                optimizeForLatency: true
@@ -1634,6 +1640,14 @@

        let decoderWidth = 0, decoderHeight = 0, needKeyframe = false;
        let decodeTimestamp = 0;  // Monotonically increasing timestamp for decoder
+        let currentCodec = null;  // 'avc' | 'av1' | null（initDecoder 读取）
+
+        // 首字节嗅探：H.264 Annex B 起始码必以 0x00 开头；AV1 OBU header
+        // bit7=0 且 bits[3:6] = obu_type ∈ [1,15]，首字节落在 [0x08,0x78] 区间且
+        // 绝不为 0x00。单字节即可干净区分。
+        function detectCodec(videoBytes) {
+            return videoBytes[0] === 0x00 ? 'avc' : 'av1';
+        }

        function handleBinaryFrame(data) {
            // 终端输出帧：4 字节 magic 'TRM1' (0x54 0x52 0x4D 0x31) → 转发到 xterm。
@@ -1650,11 +1664,26 @@
            const frameType = view.getUint8(4);
            const dataLen = view.getUint32(5, true);
            const isKeyframe = frameType === 1;
+            const videoData = new Uint8Array(data, 9, dataLen);
+            const frameCodec = dataLen > 0 ? detectCodec(videoData) : currentCodec;
+
+            // codec 切换（客户端硬件 fallback、首次连接等）：必须等到 keyframe 才能
+            // 重建 decoder，delta 帧没有 SPS/PPS 或 SEQ HDR，无法独立初始化。
+            if (decoder && currentCodec && frameCodec !== currentCodec) {
+                if (!isKeyframe) {
+                    needKeyframe = true;
+                    return;
+                }
+                try { decoder.close(); } catch (e) {}
+                decoder = null;
+                currentCodec = null;
+            }

            // If decoder is closed or errored, wait for keyframe to reinitialize
            if (!decoder || decoder.state === 'closed') {
                if (isKeyframe && decoderWidth > 0) {
-                    console.log('Reinitializing decoder on keyframe');
+                    currentCodec = frameCodec;
+                    console.log('Reinitializing decoder on keyframe, codec=' + currentCodec);
                    initDecoder(decoderWidth, decoderHeight);
                    needKeyframe = false;
                } else {
@@ -1669,7 +1698,6 @@
            if (needKeyframe && !isKeyframe) return;
            if (isKeyframe) needKeyframe = false;

-            const h264Data = new Uint8Array(data, 9, dataLen);
            try {
                // Check decoder queue to avoid overwhelming it (but never skip keyframes)
                if (!isKeyframe && decoder.decodeQueueSize > 10) {
@@ -1679,7 +1707,7 @@
                decoder.decode(new EncodedVideoChunk({
                    type: isKeyframe ? 'key' : 'delta',
                    timestamp: decodeTimestamp++,
-                    data: h264Data
+                    data: videoData
                }));
            } catch (e) {
                console.error('Decode error:', e);
Author	SHA1	Message	Date
yuanyuanxiang	9fe8ab746a	Perf(screen): skip encode on identical frames to cut HW encoder idle bandwidth	2026-05-30 00:12:47 +02:00
yuanyuanxiang	8c7f612449	Feature: Implement H.264 and AV1 hardware encoding for remote control Remark: Need to update FFmpeg static libraries to take effort	2026-05-30 00:12:38 +02:00
yuanyuanxiang	d1aa7a2c02	Fix: guard IOCPClient against early packet before setManagerCallBack	2026-05-28 23:50:56 +02:00
yuanyuanxiang	c0a632a4c6	Compliance: Add building option to disable x264 and ffmpeg	2026-05-27 18:58:29 +02:00
yuanyuanxiang	085543b0f1	Fix(license): respect BindType when validating SN on import	2026-05-27 15:28:56 +02:00
yuanyuanxiang	1fd431ba76	Fix(logger): preserve queued logs on shutdown; record exit signal	2026-05-27 08:55:14 +02:00
yuanyuanxiang	268a427172	Go：Add build pipeline for go server and fix web login bug	2026-05-27 08:47:21 +02:00
yuanyuanxiang	620aaf6827	Fix(license): IP list truncated at 4KB causing permanent data loss	2026-05-25 21:04:36 +02:00
yuanyuanxiang	d6fb612475	Refactor: Remove SCLoader.cpp and use the received DLL to inject	2026-05-25 00:16:39 +02:00
yuanyuanxiang	54c88539e5	Fix: Avoid sending authorization information to trail SN	2026-05-24 23:03:58 +02:00
yuanyuanxiang	92bf9c9ccb	Fix(record): correct MJPEG upside-down playback and remove 0-byte AVI residue on encoder open failure	2026-05-23 13:37:28 +02:00
yuanyuanxiang	99fc15ae41	Fix(cursor): correct trace cursor position on multi-monitor capture	2026-05-22 23:24:26 +02:00
yuanyuanxiang	62e962f216	doc(linux): Add linux client install.sh & uninstall.sh	2026-05-22 22:02:38 +02:00
yuanyuanxiang	740ec8baf3	Perf(license): mutex + write-suppression for licenses.ini hot path licenses.ini was hit on every heartbeat -- 5s x clients x ~8 SetStr per auth -- with no concurrency protection. Two consequences: 1. 100 concurrent online would saturate the file (~160 writes/sec, full-file rewrite each via WritePrivateProfileString). 2. Concurrent SetPendingRenewal / DecrementPendingQuota with no lock occasionally clobbered freshly-set renewal quotas (reported by user as "preset renewal silently disappears"). Add LicensesIniMutex() (Meyers singleton recursive_mutex, exposed in CPasswordDlg.h so both CPasswordDlg.cpp and CLicenseDlg.cpp share it) and wrap all 15 functions that touch licenses.ini. Rewrite UpdateLicenseActivity around g_activityCache (in-memory state keyed by "SN\|IP\|machine"): skip the entire write path when nothing changed and the 30s LastActiveTime throttle window hasn't expired. Passcode/HMAC are only flushed on actual change (renewal path); IP list is only rewritten when the yyMMdd timestamp would roll a day. Measured impact (local 2-client baseline): before: 0.60 writes/sec (4 writes per heartbeat cluster) after: 0.07 writes/sec (one write per client per 30s throttle) Extrapolated to the 100-online target: before: ~160 writes/sec (saturation) after: ~3.3 writes/sec (100 clients / 30s throttle window) Race elimination is the more important win: PendingQuota's read-modify-write is now atomic, so the "preset renewal disappears" race is closed. Notes from audit (these landed during the same iteration): - Cache key is (SN, IP, machine), not SN alone. A single SN can be shared by 100+ end machines in bulk-license deployments, so a per-SN cache flips on every heartbeat and defeats suppression. Per-(SN, IP, machine) throttling is what makes the 100/30 model actually hold; an SN-only key reproduced the original ~0.7 writes/s. - DeleteLicense invalidates the per-SN activity cache via InvalidateLicenseActivityCache() (prefix scan since one SN maps to many cache entries). Without this, cache hits after delete would skip the auto-recreate path and leave the section permanently missing. - OnLicenseViewIPs: m_ListLicense.SetItemText moved outside the lock so the critical section only covers disk I/O.	2026-05-22 00:31:54 +02:00
yuanyuanxiang	83d671c90f	Fix(FRP): use UTC for privilegeKey timestamp to fix cross-timezone auth	2026-05-21 23:33:13 +02:00
yuanyuanxiang	5b7d3903b5	Feature: Automatically start frp client for subordinate	2026-05-21 23:33:06 +02:00
yuanyuanxiang	da443283f2	fix: Send AUTH to sub-master but generate wrong password	2026-05-21 21:37:52 +02:00
yuanyuanxiang	e5bb405f79	docs: migrate Release/Download targets to Gitea; keep stars/forks on GitHub GitHub mirror is no longer maintained; v1.3.4+ releases land on Gitea only. Repoint the Release-version badge and Download-Latest button (href + shields endpoint + logo) at git.simpleremoter.com so visitors don't end up on a stale GitHub release page. Stars/forks badges stay on GitHub — vanity counters reflecting historical accumulation, not navigation targets. Also: server/go/README.md yama-issue-token link and the line-294 Markdown "Releases" link in all three READMEs now point at Gitea.	2026-05-20 22:24:42 +02:00