Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

UNCLASSIFIED//FOUO
Loader
The loader needs to be able to load standard dlls but should also provide Athena dll
loading. Athena DLLS must not have an MZ or PE header. At the very least, these
identifying characteristics must be removed for Athena executable dll (AXE). It
would also be preferred that the engine is self-loading and does not require boot
strapping from the host dll except for PAGE_EXECUTE_READ and a thread of
execution. Any imports that are required by the AXE file must be obfuscated. The
easiest way to accomplish this is to overwrite the import section with a custom hash
(adler32 – dword) of each function name. The loader must also be engine aware
and allow AXE files the ability to link to the engine.dll without exposing the
engine.dll name in the final AXE file.
Capabilities:
Ability to load pic or dll or AXE
Ability to unload dll or AXE
Self-loading from read execute page
Use PEB to find loaded module list
pPEB = (PPEB)__readgsqword(0x60); for x64
pPEB = (PPEB)__readfsdword(0x30); for x86
Support forwarding proc addresses (e.g. ntdll.NtCreateFile)
Support import address table functions
Support relocation table resolution
Call DllMain DLL_PROCESS_ATTACH / DLL_THREAD_ATTACH /
DLL PROCESS_DETACH / DLL_THREAD_DETACH
#ifdef _WIN64
typedef struct tagPEB_LDR_DATA
{
ULONG dLength;
UCHAR bInitialized;
UCHAR reserved1[3];
PVOID pSsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID pEntryInProgress;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
#else
typedef struct tagPEB_LDR_DATA
{
ULONG dLength;
UCHAR bInitialized;
UCHAR reserved1[3];
PVOID pSsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID pEntryInProgress;
} PEB_LDR_DATA, *PPEB_LDR_DATA;
#endif
#endif
#ifdef _WIN64
typedef struct tagPEB
{
UCHAR bInheritedAddressSpace;
UCHAR bReadImageFileExecOptions;
UCHAR bBeingDebugged;
UCHAR bSpareBool;
UNCLASSIFIED//FOUO

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh