# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# Sonic Screwdriver

29 November, 2012

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8

3. (U) Building and Configuring
(S//NF) This section contains instructions for building Sonic Screwdriver. The first section will discuss
how to flash the code onto a new Apple Thunderbolt-to-Ethernet adapter. The second section will discuss
how to configure the boot media intended to be executed by the implanted ethernet adapter.
3.1. (S) Implanting Ethernet Adapter
(S//NF) The Apple Thunderbolt-to-Ethernet Adapter can only be flashed in a real mode operator system,
such as MS-DOS. A CD ISO image is packaged with the tool to make flashing the adapter as seamless as
possible.
1. (U) Locate the following ISO image and burn the image to a DVD or CD:
UNCLASS_SonicScrewdriverInstall.iso
2. (U) Plug in the ethernet adapter into the Thunderbolt port of the MacBook Air mentioned in
Section 2.2. Also plug in the external USB DVD/CD-ROM drive with the DVD/CD created
from step 1.
3. (U) Power up the MacBook Air holding down the ‘option’ key.
4. (U) After a few seconds, a number of boot options should start to appear.
5. (U) Select ‘Windows’. This should be the only option with a DVD/CD icon above it.
6. (U) Let the installer fully boot. All the default options should be fine.
7. (U) Once the DVD/CD boots into FreeDos, the installer will automatically run the Broadcom
flash utility to detect the flash in the adapter. There should be only one device listed at size 64K.
a. (U) If there are no devices listed, ensure the adapter is firmly plugged into the
Thunderbolt port, and repeat back to step 3.
8. (U) Type the following at the command line:
B57UDIAG.exe -ppxe x:\ss.rom
9. (U) It will take roughly 1-2 mins to complete the reprogramming of the adapter. Programming is
complete when control is passed back to the command prompt. Power down system by holding
the power button.
3.2. (S) Configuring Boot Media for Target
(S//NF) Once the Thunderbolt-to-Ethernet adaptor has been implanted, it will search all media devices for
a specific volume name and a file path to execute. This includes both internal and external hard drives,
CD/DVD drives, and USB thumb sticks. The external hard drives and CD/DVD drives can be connected
via USB, Firewire, or Thunderbolt. Hard disk can be formatted FAT16, FAT32, or HFS+. Hard disk
formatted NTFS or ext* will NOT be detected.
SECRET//NOFORN
Sonic Screwdriver User’s Guide – Nov 2012 6
SECRET//NOFORN

- 1
- 2
…
- 4
- 5
- 6
- 7
- 8