Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
Elsa User Manual.doc
31
SECRET//NOFORN
12. (U) Troubleshooting and Support
12.1 (U) Assistance and Problem Reporting
(S) The ELSA software system is maintained by IOC/EDG. Assistance and problem
solving is provided by IOC/EDG/AED/RDB and problem reporting is provided by
IOC/COG/OED/GB. Please see the Troubleshooting section of this document for more
information.
(S) The IOC Collaboration Portal, Bulletin Board System (BBS) exists for question and
answer. The BBS does not provide mechanism notifying us when topics are created but
its use provides a common forum for lessons learned. Topics should be created and
prefixed using the tool name and version e.g. ' ELSA v3.0 ...' When in doubt the tool
version is included in the sha1 hash files from the installation media.
12.2 (U) Troubleshooting Guide
# Symptom Resolution
1 No log file appears � Check to see
i
f the dll is loaded using
tasklist /m <elsa dll name>. If not,
see the appropriate 'Dll not loaded' entry below
� Check to see if the host process has write
permission in the selected log directory. For
example, rundll32 will not have write permission
in system directories if run from a non-elevated
prompt
2 Dll not loaded – AppInit
Mode
� Check to see
i
f the selected host
p
rocess h
a
s
restarted since the registry keys were edited
� Check to see if the selected host process loads
user32.dll using tasklist /m user32.dll
while the host process is running. If not you must
select a different host process
� Check to see if the target OS supports AppInit
mode using the install section above.
� Check to see if the registry keys were
configured according to the install section
above
3 Dll not loaded – DllHost
Mode
� Check to see
i
f the elsa task appears in the task
scheduler using the active tasks panel in the
taskschd.msc UI. If not, modify the install script
until it successfully adds the task
� Check to see if the elsa task has run yet by
double clicking on the task in the taskschd.msc