Lasair Engineering · August 1, 2026
How Lasair stays off screen shares: the display-level overlay, explained
Lasair's overlay is not a window with a privacy flag. A signed kernel-mode display driver draws it on a dedicated MPO hardware plane inside the Windows display pipeline, so capture tools that look for app windows or honor capture-exclusion flags have nothing to find.
The problem with window flags
Most overlay apps hide by setting a capture-exclusion flag on an ordinary app window, the same privacy switch screen-share tools respect when they feel like it. That design has two structural limits. First, a flag is a window property, so any process that enumerates windows can inventory it. Second, the flag's behavior depends on the OS and capture path: public documentation shows this class of protection is unreliable against ScreenCaptureKit on macOS 15 and later, and each Windows capture API treats it differently.
The Lasair pipeline
Lasair ships a signed kernel-mode display driver (KMDF) with a signature-verified compositor component, verified byte-for-byte with ed25519 in the kernel before it ever runs. The overlay is drawn on its own MPO hardware plane in the Windows display pipeline, the same mechanism games and video players use for tear-free presentation, rather than in an app window.
Because the plane is composited below the app layer, it never exists as a window. There is no HWND, no capture flag, nothing for window enumeration to list. The hotkeys travel the same depth: the driver is also an upper filter on the keyboard class, so chords are matched in kernel mode and consumed before any app or any capture tool sees a keystroke. On secure desktops (UAC prompts, the lock screen) the filter deliberately passes everything through and the overlay stands down.
A kernel watchdog rounds it out: if software tampers with the registry values that control hardware overlays, the driver marks the overlay tampered and fails closed within a frame rather than risk a half-visible state.
What capture tools see
Nothing unusual. Screen recorders and meeting apps capture the composed desktop or a chosen window; Lasair's plane is part of neither path. There is no process window to screenshot and no flag state to probe.
Current limits, plainly
As of August 2026: Windows 11 x64 on real GPUs (VMs and basic display adapters lack the hardware plane), the primary display only, SDR (the tray will offer to turn HDR off for you), and borderless or windowed apps. Exclusive-fullscreen software bypasses the compositor entirely, so no display-level overlay can draw there; that is a boundary of the approach, not a bug.
FAQ
Does Lasair use a capture-exclusion window flag?
No. Lasair does not create an app window at all. A signed kernel-mode display driver (KMDF) with a signature-verified compositor component draws the overlay on its own MPO hardware plane in the display pipeline. There is no window to enumerate and no flag to scan for.
Why is an MPO plane harder to capture than a flagged window?
A capture-exclusion flag is a window property other software can enumerate and, on some platforms, ignore. An MPO plane is composited by the display pipeline below the app layer, so window-based capture and enumeration never see it.
What are the current limits of Lasair's overlay?
As of August 2026: Windows 11 x64 on real GPUs (virtual machines and basic display adapters are not supported), the primary display only, SDR (HDR off), and borderless or windowed apps; exclusive-fullscreen apps bypass the compositor entirely.
Written by Lasair Engineering. Last reviewed August 2026.