Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//ORCON//NOFORN
1.4.1 Reorder
The reorder obfuscation technique was primarily designed to mask PE headers
from the initial scans of PSPs. The technique uses a randomized block size, with
min and max size defined in the catalog entry, and it swaps out all of the chunks
so the first chunk ends up being the last. In testing, this method has been very
successful in bypassing the PSP initial scans with no issues. To use this method,
set the “Obfuscate” tag to type “reorder”. An example of this is shown below:
<Obfuscate type='reorder'>
<MinBlockSize>50</MinBlockSize>
<MaxBlockSize>100</MaxBlockSize>
</Obfuscate>
In the example above, the module will be set to use reorder obfuscation and the
block size used will be a random value between 50 and 100 bytes.
14
SECRET//ORCON//NOFORN