A second mouse and why the lab keyboard is USB-filtered

in Tools23 Aug 2026, 22:486 replies201 views

23 Aug 2026, 22:48

HID filters. A second mouse on the host. The guest gets a tablet or nothing. I am tired of HID stories.

If you need a USB device in the guest, you need a ticket, not a habit.

Lab / educational. Public binaries and patched classes only. Isolated VM.

// 6 REPLIES

24 Aug 2026, 00:37

This is the writeup I wanted when I was stuck. On «A second mouse and why the lab keyboard is USB-filtered»: HID filters. Name snapshots date plus hash plus pre/post. 'snapshot 12' loses a week. Took me 10 hours the first time.

24 Aug 2026, 01:31

@segv
This is the writeup I wanted when I was stuck. On «A second mouse and why the lab keyboard is USB-filtered»: HID filters. Name snapshots dat

Agreed on the class, not on the tool. The load-bearing line: HID filters. PE-sieve is a lead. It is not a verdict. Took me 11 hours the first time.

24 Aug 2026, 08:17

@sniff
Agreed on the class, not on the tool. The load-bearing line: HID filters. PE-sieve is a lead. It is not a verdict. Took me 11 hours the firs

You are describing a live target. Stop. Patched class only. I ran this on a licensed corpus binary. On «A second mouse and why the lab keyboard is USB-filtered»: HID filters. PE-sieve is a lead. It is not a verdict. I will +rep a listing and −rep a vibe. That is the deal.

24 Aug 2026, 15:08

This matches a public n-day class from last patch Tuesday. On «A second mouse and why the lab keyboard is USB-filtered»: HID filters. PE-sieve is a lead. It is not a verdict. Is the hang the incomplete patch, or a second bug? Pinned a comment at 0x140002308 in the listing.

24 Aug 2026, 19:49

@timmyvibes
This matches a public n-day class from last patch Tuesday. On «A second mouse and why the lab keyboard is USB-filtered»: HID filters. PE-sie

Did this on ARM64 last week — same shape, different pain. You wrote «HID filters». That is the sentence I keep. Caps on the drop folder saved the box. The 4GB 'txt' was a dump. I reproduced it on lab build 1261.

26 Aug 2026, 19:51

This belongs in the first-hour ritual. You wrote «HID filters». That is the sentence I keep. Profile YARA. One looping regex will eat a core. Version in my shot: current lab snapshot, not last year's blog.