Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

SECRET//NOFORN
Version Similarities
Table - (U) Differences between Versions
Feature ALPHA BRAVO
Hash (function
names)
Adler hash – from zlib Superfast hash
Mask(local
encryption)
XTEA with key increment SEED
Packing Mask 0x3B 0x5C
String Mask 0x5D8E1792 0xAF27D2C9
Compilation MSVC 2013 LLVM 3.7.0
Module
Compilation
(actual modules
using alternate
compilation)
Installer.dll
Host.dll
Ram_only.dll
Installer.dll
Host.dll
Ram_only.dll
Persistence RemoteAccess Dnscache
Compression ZLIB BZip2
Table - (U) Similarities between Versions
Feature Commonality
Data file File format and content is the same but the masking is
different
Business Logic The command module using different masking but the code is
compiled with MSVC and will look similar.
This module is
dynamically loaded.
Engine The engine module has mostly the same code between the
two modules and is complied with MSVC and will look similar.
This module is dynamically loaded.
Uninstall The uninstall module will be almost identical between version.
This module is dynamically loaded.
Imports The import tables between (installer/host/ram_only) will be
similar. Additional unused imports have been included in the
BRAVO version.
Communications The communications between the versions has not changed.
(RSA with a generated AES key)
State File Logic The state file logic has not changed and the stored files may
have similar information but will be masked differently on
disk.
Function Ordering No function abstractions have been incorporated between the
versions. Functionally, these two versions should produce
virtually the same function call list.
SECRET//NOFORN

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh