Re: New Alps protocol in the wild?

Ben Gamari [off-list ref] writes:

Sadly, this avenue of investigation is apparently a dead-end. After
seeing nothing outbound to the mouse and hacking around enough to
convince myself that filter driver is catching all traffic passed
through the i8042prt driver, I finally decided to disassemble
apfiltr.sys. Perhaps not unexpectedly, it seems they do some direct port
I/O without going through the driver stack. Whether this is incompetance
or malice we will never know, but it seems that the "clean" filter
driver approach will not work here.

Thankfully, it seems that an I/O port sniffer driver[1] has been written
which might save me. Sadly, this isn't supported on 64-bit machines as
Microsoft's compiler inexplicably lacks support for inline assembler on
amd64. I've found a 32-bit copy of Vista lying around so we'll see how
this works.

Unfortunately, it seems that this approach too may be a dead end. The
iosniffer driver appears to cause an immediate reboot (triple fault?) on
installing its hooks. Given the low-level nature of the crash, the
thought of tracking it down makes me shudder. If anyone else wants to
try installing the driver, it would be nice to have a second opinion. I
guess it's back to the virtualization approach.

Cheers,

- Ben