Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
UNCLASSIFIED//FOUO
Engine
The engine contains all the common functions. It would reside with the host file and
have intimate knowledge about finding the data file. It should expose common
functions required by sub-components.
Athena_Hash – calculate adler32 from buffer
Athena_Crypto_Encrypt – encrypt buffer
Athena_Crypto_Decrypt – decrypt buffer
Athena_Compress – compress data zlib
Athena_Decompress – decompress data zlib
Athena_Random – randomize buffer
Athena_Package_Get – retrieve data
Athena_Package_Set – set config data
Athena_Package_Close - called by uninstaller
Athena_Config_Get – retrieve element (keep encrypted in ram unless being
used)
Athena_Config_Set – only write to dyn_config data
Athena_Load – load a dll or axe
Athena_Unload – unload a dll or axe
Athena_malloc – allocate memory (centralized memory management)
Athena_free – free memory
Athena_memset – (vs - intrinsics)
Athena_memcpy – (vs - intrinsics)
C Runtime
Do not statically bind the c runtime to any module. Athena will bind to MSVCRT to
allow exception handling and c++ features. Microsoft has changed MSVCRT in
different builds of the operating system. We have found that
WINDDK\2600\lib\w2k\i386 and WINDKK\3790.1830\lib\crt\amd64 to work best.
NOTE: Visual Studio must be configured to use Configuration
Properties\General\Platform Toolset: Visual Studio 2013 – Windows XP(v120_xp) to
cause the least amount of compilation anxiety.
Packager
File Packager – thought CAB would be fun but now it may be better to create a
simple static file manager. Simply mask offset/size – encrypt content
offset/size - beacon.dll
offset/size – unload.dll
offset/size – config (static config)
{offset/size} – dynamic config (default location) – may be in here/alternate
file/registry
Athena_Package_Get(ATHENA_PACKAGE_XXX,pBuffer, &dBufferSize)
ATHENA_PACKAGE_BEACON
ATHENA_PACKAGE_TRANSPORT
ATHENA_PACKAGE_UNLOAD
ATHENA_PACKAGE_CONFIG (default) – what about config location?
ATHENA_PACKAGE_DYN_CONFIG
Athena_Package_Set(ATHENA_PACKAGE_DYN_CONFIG, pBuffer, dBufferSize)
UNCLASSIFIED//FOUO