Re: New Alps protocol in the wild?

[Ben Gamari <bgamari.foss@gmail.com>]

Ben Gamari <bgamari.foss@gmail.com> writes:

> Sadly, this avenue of investigation is apparently a dead-end. After
> seeing nothing outbound to the mouse and hacking around enough to
> convince myself that filter driver is catching all traffic passed
> through the i8042prt driver, I finally decided to disassemble
> apfiltr.sys. Perhaps not unexpectedly, it seems they do some direct port
> I/O without going through the driver stack. Whether this is incompetance
> or malice we will never know, but it seems that the "clean" filter
> driver approach will not work here.
>
> Thankfully, it seems that an I/O port sniffer driver[1] has been written
> which might save me. Sadly, this isn't supported on 64-bit machines as
> Microsoft's compiler inexplicably lacks support for inline assembler on
> amd64. I've found a 32-bit copy of Vista lying around so we'll see how
> this works.
>
Unfortunately, it seems that this approach too may be a dead end. The
iosniffer driver appears to cause an immediate reboot (triple fault?) on
installing its hooks. Given the low-level nature of the crash, the
thought of tracking it down makes me shudder. If anyone else wants to
try installing the driver, it would be nice to have a second opinion. I
guess it's back to the virtualization approach.

Cheers,

- Ben