# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Archimedes

# Archimedes 1.2 Addendum

23 August, 2013

- 1
- 2
- 3
- 4
…
- 7
- 8

SECRET//NOFORN

1
SECRET//NOFORN
(S)ARCHIMEDES1.2
(S//NF)Thisdocumentissupplementaltothefollowingdocuments:
 FulcrumUserManual0.6
 Archimedes1.0UserGuide
 Archimedes1.1Addendum
(S//NF)Pleaseseetheabovedocumentsforacompletedescriptionofthetool’sfunctionality.Archimedes1.2isa
QRCupdatetothe1.1versionofthetoolthatincludessupportforrunningthetoolinasurveymodeandobeying
awhitelistoftargethosts.
(S//NF)Archimedes1.2makesthefollo wingmodificationstothe1.1version:
1. AddsSURVEY_ONLY(SO)optionasan“injectionmethod”.ThiscausesArchimedestologinformation
aboutthetarget’sHTTPrequeststoalocalfile.
2. AddsHOST_WHITELIST(HW)configurationoption.Ifthewhitelistisprovided,thenArchimedeswillonly
injectintohoststhatmat chnamesontheprovidedlist.
3. ChangesthecommandlineparameterformatforEXEsandDLLstou seargumentswitchesratherth ana
fixedorderofparameters.Notethatthismaybreakcompatibilitywithexi stin gscripts.
4. ChangesthedefaultvalueforINJECTION_METHOD(IM)toSURVEY_ONLY(SO),thedefaultvaluefor
VERIFY_ROUTE(VR)toFALSE,andthenumberofinjectionattemptsto5.
5. Replacesthereadablestringsusedintheconfigurationfile(andtospecifyinjectionmethods)withnon
alertingabbreviations.
(U)FILEINFORMATION
(S)AppendixBcontainsalistoftheb inariesdeliveredinArch imedes1.2alongwithMD5sumsandfilesizesthat
canbeusedtoverifyfileintegrity.
!!!DEBUGBINARI ESARECLASSIFIEDSECRET//NOFORNANDSHOULDNOT/NOTBEDEPLOYEDONTARGET!!!
(S//NF)Notethatthed eliveryincludesbothdebugandreleasebuildsofeachbinary.Thedebugbuildscontain
additionalinstru mentationthatcanbehelpfulinpinpointingerrorsandunexpectedbehaviorandwillgenerate
loginformationthatcanbeusedtotracetheprogram’sexecution.Debugversion sshouldnotbedeployed
outsideofac ontrolledCLASSIFIEDenvironment.Theadditionalinformationinthemmakesthesoftware
particularlyvulnerableto reverseengineeringandanalysis.Debugversionsofthetoolshouldbeusedin
controlledtestenvironmentsonly.

- 1
- 2
- 3
- 4
…
- 7
- 8