Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.
SECRET//20350112
15.3 (U) Data Storage (RAM, NVRAM, Firmware Image)
(S) This section describes where particular pieces of data are stored on a device. There
are three different types of “memory” to consider:
1. RAM – read/write volatile memory that is lost when a device is power-cycled
2. NVRAM – read/write non-volatile memory that is persisted when a device is
power-cycled. Some devices will lose NVRAM data when a “hard reset” or
“restore factory defaults” action is performed.
3. Firmware Image – read-only data can be stored in the firmware image at the time
of image formation (see 15.5). This data persists through power-cycles and hard
resets/restore factory defaults actions. This data does not persist through a
firmware upgrade action.
(S) A Flytrap stores the following operational data in the Firmware Image:
• Up to 5 Initial Beacon Addresses/Ports (see 15.2)
• Initial Beacon Interval in seconds (see 15.2)
• Initial Beacon Traffic Requirement (see 15.2)
• Initial Beacon Traffic Requirement Timeout in seconds (see 15.2)
• Initial Beacon Fast Retry Interval in seconds (see 15.2)
• Initial Beacon Number of Fast Retries (see 15.2)
• Initial Beacon Slow Retry Interval in seconds (see 15.2)
(S) After a Flytrap has successfully sent the Initial Beacon and received its first Mission,
it stores the following operational data in NVRAM:
• Up to 5 Periodic Beacon Addresses/Ports (see 15.2)
• Periodic Beacon Interval in seconds (see 15.2)
• Periodic Beacon Traffic Requirement (see 15.2)
• Periodic Beacon Traffic Requirement Timeout in seconds (see 15.2)
• Periodic Beacon Fast Retry Interval in seconds (see 15.2)
• Periodic Beacon Slow Retry Interval in seconds (see 15.2)
• Beacon Power-Cycle Wait Period in seconds (see 15.2)
• Initial Beacon Successfully Sent Flag
• Ontime (periodically updated) in seconds (see 15.1.2)
• Ontime Commit Interval in seconds (see 9.11.8)
• Last Successful Beacon Ontime
• Suicide Interval (see 5.2.3.15 and 9.11.16)
• Kill Flag (see 5.2.3.16 and 9.17)
(S) All other operational data is stored in RAM.
(S) It should be noted that time values are stored in seconds as 32-bit signed integers, so
that maximum times are on the order of 2^31-1 seconds, which is approximately 68
years.
135
SECRET//20350112