VOGONS


First post, by shakeyourbunny

User metadata
Rank Newbie
Rank
Newbie

Hello,

I have written a new DOSBox, that is all about automation. It is a fork of DOSBox Staging 0.82/0.84-alpha that inherits its code base, but is focused - without losing its emulation qualities - on automation, augmentation and securing the included HTTP REST-API web server (introduces missing token security, many, many, many (security) fixes, much more functionality, like screen recording, frame export, disk swapping, memory manipulation and other stuff, see the included swagger, that describes everything), as well as a sandboxed lua scripting engine, that drives execution, input, and system state with frame-accurate timing. As a matter of convenience, I also included for General MIDI the FluidSynth R3 soundfont and is enabled by default for a better music experience.

Homepage: https://www.dosbox-automation.org
Downloads are available for Windows and Linux: https://github.com/dosbox-automation/dosbox-a … mation/releases
License: GPLv2+

This is fork has been in development since about March or April 2026 and has about 250 more unit tests as well as a brand new python harness test suite, testing the automation engine with about 200 tests. I also included 6 fully scripted game installation tests, driven by TOML recipes used by a sample installation engine, as well as a macro recorder in Python. The sample installation engine can be used as a base for your own integrations and automation code as well the macro recorder has been used in conjunction with the former. In this sample scripts every new capability of dosbox-automation is employed, as well as video recording the installation process, screen snapping to produce screenshots of it, a s well as runtime log of the executed calls. You can find these scripts in the folder tests/integration/ and the TOML recipes in tests/files/, as well the documentation for that in https://www.dosbox-automation.org/0.84-da1/au … ipes/index.html

I have made a playlist of demo'ing this feature, letting scripted installation sessions, as well as recorded macro sessions run, with enabled On Screen Display indicating the automated activity.
https://www.youtube.com/playlist?list=PLazWnU_un5ig

Playlist includes installation (with automated disk swaps) of Turbo Pascal 5.5 (lua scripted), System Shock (input replay, keyboard and mouse), Epic Pinball (lua scripted), DOOM shareware (lua scripted), The Incredible Machine demo (input replay, mostly mouse), Quest for Glory IV (input replay, mixed).

This whole package enables gamers, developers and game launchers to have a much more remote control over the DOSBOX, as in these features different and added to upstream:
- HTTP REST API (with swagger, enforced token authentication): https://www.dosbox-automation.org/0.84-da1/au … -api/index.html
- HTTP REST API: crisp video memory frame capture and information in PNG,JPG,RAW(+palette)
- HTTP REST API: video recording in ZMBV (start,stop,pause,status )
- HTTP REST API: drive swap (and mounting): intended for automatic disk image change for installation and other situations, where an automatic image swap is needed. CD iso swap is supported.
- HTTP REST API: keyboard (presses) + mouse events (movement, buttons) injection and recording (start,stop,pause,status),
- sandboxed lua script (loads, run, status via HTTP REST API call), most functions like REST API + wait for text on screen and other things, see https://www.dosbox-automation.org/0.84-da1/au … /lua/index.html

A notable change is also the introduction - due to the webserver - of a tight, white-list orientated mounting policy, that blocks and restricts remote access to the local file system via the dosbox emulator meaningfully. This prevents the scenario of shipping a trojanized dosbox.conf, as well as - as that is the reason for doing that - prevent remote mounting of any local directories via REST API or letting it remote keyboard type in these mount commands. For more details, please read

If you have any questions or feedback, I'd gladly answer your questions.


Note: This software (and parts of the documentation) has been developed with the aid of tooled assistance, but I've been reviewing, testing and signing off the code myself; but upstream also uses AI nowadays heavily.

Reply 1 of 1, by shakeyourbunny

User metadata
Rank Newbie
Rank
Newbie

A note to the mounting policy, if that is not well understood or curious and want to have a more in-depth explanation of it:

https://www.dosbox-automation.org/0.84-da1/au … rity/index.html

This web page also includes a comparison matrix, what is allowed, or not, or whitelisted, when the webserver module is running or not. TLDR is, if the webserver is not active, the rules for mounting a disk image are more relaxed, because you cannot exploit that remotely without it.