Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
4.2 Installation and Setup
DarkSeaSkies is installed from a bootable flash drive. The following instructions detail
how to make the installation flash drive from any Apple computer running Mac OSX
10.5 (Leopard).
1. Format flash drive:
Open DiskUtility; select the flash drive; click on the “Partition” tab; select “1
Partition” under “Volume Scheme”; click “Options” button; select “GUID
Partition Table” radio button; edit “Name” field appropriately; select “Mac OS
Extended (journaled)” as the “Format”; click “Apply”.
2. Copy Installer EFI file to the flash drive.
> cp I.efi /Volumes/I/I.efi
3. Bless the Installer EFI file on the flash drive.
> sudo bless –-folder /Volumes/I/ –-file
/Volumes/I/I.efi --bootinfo
The following message is expected and not an error.
Can’t load /Volues/I//usr/standalone/ppc/bootx.bootinfo
4. Eject the flash drive.
> diskutil eject /Volumes/I
5. Insert the flash drive into the target.
6. Boot the target system while holding the “option” key until the screen displays a
boot drive selection menu. Select the flash drive. Once the DarkSeaSkies
installer has started the screen will blank and a ‘:’ will appear in the upper left
corner of the screen. Once the ‘:’ has appeared the flash drive may be removed
and the laptop’s lid closed. On a successful installation a ‘)’ will follow the ‘:’.
On an unsuccessful installation a ‘(‘ will follow the ‘:’. Once installation is
complete the laptop will shutdown. If DarkSeaSkies has already been installed on
the target with the same implant GUID then the implant will be updated.
For installation and setup of the NightSkies LP refer to NightSkies User Guide.
4.3 Initiating a Session
Refer to NightSkies User Guide.
4.4 Stopping and Suspending Work
Refer to NightSkies User Guide.
4.5 Contingencies and Alternate States and Modes of Operation
DarkSeaSkies status may be queried by checking the value of the Status variable. This
can be done with the nvram command line utility as follows: > nvram $(cat
status.guid):$(cat status.name), where status.guid is the GUID of
the Status variable and status.name is the name of the Status variable as defined in
section 3.1. Valid values of the Status variable and their meanings are also described in
section 3.1.
The Count variable may be queried to determine the number of continuous cautious boots
that DarkSeaSkies has encountered. The Count variable is incremented during a boot in
darkmatter+darkmatter+docs+DarkSeaSkies 1.0 User Manual_Rev New_2009-01-26.doc
4
SECRET//NOFORN