Logitech Flow Protocol — Reverse Engineering Guide

This repository documents the complete reverse engineering of Logitech Flow's Marconi protocol — the encrypted TCP/UDP protocol that Logitech Options+ uses to share mouse, keyboard, and clipboard between computers on a LAN.

Why?

Logitech Flow is proprietary, Windows/macOS-only, and encrypted end-to-end with no public documentation. This documents:

• How the encrypted protocol works end-to-end
• The cryptographic handshake and session key derivation
• The packet structure and serialization format
• A practical reference for anyone building interoperable Flow software

What We Found

• Protocol name: "Marconi" (internal Logitech codename)
• Transport: UDP 59870-59871 (discovery) + TCP 59869 (encrypted tunnel)
• Crypto: AES-256-GCM with bootstrap key hardcoded in the Windows binary, session keys derived via X25519 ECDH + PBKDF1-style SHA-512
• Serialization: thekogans serialization format (FARS) (Flow Application Remote Serialization)
• Session key extraction: Via CDB/WinDbg breakpoints on DeriveSharedSymmetricKey or post-pairing memory dumps

Repository Structure

ReverseEngineering/
├── README.md              ← You are here
├── GUIDE.md               ← Full methodology guide
├── STATUS.md              ← Current protocol understanding status
├── docs/                  ← Protocol reference & operational notes
│   ├── protocol.md        ← Protocol overview, frame format, handshake
│   ├── crypto.md          ← Bootstrap key, session key derivation, tools
│   ├── packet-reference.md ← Definitive wire-level packet reference
│   ├── protocol-behavior-notes.md ← Quirks discovered during testing
│   ├── app-architecture.md ← Logi Options+ internals, protobuf, endpoints
│   ├── appbroker-crypto-re.md ← AppBroker IPC crypto analysis
├── tools/                 ← Python capture/decrypt/analysis tools
│   └── README.md          ← Tool usage guide

Protocol Handshake Overview

  |── ClientHelloPacket ─────────────>|  (bootstrap-encrypted)
  |                                   |  Contains: X25519 public key, cipher suite
  |                                   |
  |<── ServerHelloPacket ─────────────|  (bootstrap-encrypted)
  |                                   |  Contains: X25519 public key, session keyId
  |                                   |
  |── PromoteConnectionPacket ───────>|  (bootstrap-encrypted)
  |                                   |  Confirms session key established
  |                                   |
  |══ All subsequent frames use ══════|  (session-key encrypted)
  |   session key                     |
  |                                   |
  |── ClientDeviceConnectPacket ─────>|  "I'm device X, here are my capabilities"
  |<── ServerDeviceConnectPacket ─────|  "I'm device Y, here are mine"
  |                                   |
  |── SettingsPacket ────────────────>|  "These are my Flow settings and peers"
  |<── SettingsPacket ────────────────|  "These are mine"
  |                                   |
  |── GlobalData(SetOwnerPacket) ────>|  "I'm the owner"
  |<── HeartbeatPacket ───────────────|  Keepalive
  |── HeartbeatPacket ───────────────>|

Quick Start

Read the guide: GUIDE.md

Want to capture your own Flow session?

# On Windows (administrator shell)
cd <repo-root>
python tools\capture_flow_session.py --peer <ip> --name my_capture

Then decrypt:

python3 tools/flow_crypto.py decrypt captures/my_capture/my_capture.pcapng \
  --key-log captures/my_capture/flow_keys.log \
  --outdir captures/my_capture/decrypted

Full Document Index

Document	What it covers
GUIDE.md	Step-by-step methodology: how we reversed it
docs/protocol.md	Protocol architecture, frame format, handshake, discovery
docs/crypto.md	Key hierarchy, bootstrap, session key derivation, extraction methods
docs/packet-reference.md	Complete wire-level packet layout reference
docs/protocol-behavior-notes.md	Runtime evidence and behavioral quirks corroborated during testing
docs/app-architecture.md	Logi Options+ app architecture, protobuf summary, HTTP endpoints
docs/appbroker-crypto-re.md	AppBroker IPC crypto protocol analysis
tools/README.md	Tool usage: capture, decrypt, memory dump
STATUS.md	Current protocol understanding status

Status

Current protocol status, open questions, and artifact caveats live in STATUS.md.