# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Grasshopper

# StolenGoods-2_1-UserGuide

14 July, 2014

- 1
- 2
…
- 6
- 7
- 8
- 9
- 10
…
- 21
- 22

SECRET//NOFORN
1. After installing SG2 (section 3.2), browse to the StolenGoods2 folder in Modules.
Inside there will be the binary 'Vbr.exe'. Run it (double clicking it will be fine). It
should create a file called 'ipl.asm'. This is the VBR persistence code. Each time
you run Vbr.exe, it will remix the VBR persistence code. All but the first 12
bytes of ipl.asm will change each time Vbr.exe is run. This is important if you
wish to create signature diversity between installers.
◦ Windows 8.1 support: In 2.1, SG2 can operate against Windows 8.1. This
requires different IPL code compared to Windows XP-7. To produce the right
IPL code, run VBR.exe from the command line with one of the following
arguments:
1. --832: To generate IPL code for Windows 8.1 x86
2. --864: To generate IPL code for Windows 8.1 x64
2. Start up the Grasshopper or Cricket installer
3. When choosing a payload type, choose the type that corresponds to the DLL
payload you wish to persist.
◦ You can persist a Persistence Spec DLL, or a GH1 compliant DLL
◦ If you're not going to persist a DLL (driver only) then pick any option that is
compatible with SG2
4. When prompted for the Binary path, do not enter the path to the payload DLL
you wish to use. You will be prompted for that path later. Instead, you must enter
the path to one of the following four DLLs: MemStub32, MemStub32-GH1,
MemStub64, MemStub64-GH1. All four DLLs are in the SG2 folder you
installed (<grasshopper install folder>\Modules\StolenGoods2). Pick the correct
one based on the DLL you're going to persist and the target system.
◦ If you're not using a GH1 DLL payload, pick MemStub32 or MemStub64
(based on target OS bitness). If you are, pick one of the GH1 DLLs
◦ If you're not persisting a DLL (driver only) you can pick any DLL that
matches the bitness of the target system
5. The builder will now prompt you to select a persistence method. For 64-bit target
OS, there will be one SG2 entry (Win 7). For 32-bit target, there will be two SG2
entries (Win 7, Win XP, or Win 8.1). Pick the one you want based on your target.
◦ Windows 8.1 support: It is important to pick the correct entry for Windows
8.1. If you pick the Win 7 entry and throw on 8.1, the system will throw a
BSOD on boot.
6. The SG2 persistence module will now take over and prompt you for a path to your
target payload DLL. This is where you enter the path to the DLL you want to
persist
◦ If you're not persisting a DLL, just leave this blank and hit enter
7. Next, you'll be prompted for an optional command line to send to the payload
DLL (Persistence Spec compliant DLLs). Enter a command line here if needed
◦ If not needed, leave blank and hit enter
8. Next, you'll be prompted for the Environment Variable name to create to send the
command line entered previously to a Persistence Spec compliant DLL. Enter
that name here if needed
◦ If not needed, leave blank and hit enter
SECRET//NOFORN
- viii -

- 1
- 2
…
- 6
- 7
- 8
- 9
- 10
…
- 21
- 22