# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Dark Matter

# DarkSeaSkies v1.0 - User Manual

26 January, 2009

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9

The following items are either configured or randomly generated for each
deployment. Therefore the values are delivered as files rather than updated in this
document for each deployment.
 DarkSeaSkies Installer EFI file:
o Name: see file installer.name.
o GUID: see file installer.guid.
 DarkSeaSkies Implant:
o The EFI implant name is in the file loader.name.
o The GUID is in the file loader.guid.
o The XXTEA key used to encrypt both NightSkies and SeaPea is in the file
xxtea.key.
 NVRAM Variables:
o The NVRAM variables are obfuscated by using existing variable names
and generating new random GUIDs for each delivery.
o We will refer to them as the conceptual italicized names (i.e. Status) in
this documentation; however, their true names and GUIDs on the target
are documented below.
o Status indicates the status of the payload from the previous boot.
 The name of this variable is “SystemAudioVolume”.
 The GUID of this variable is in the file status.guid.
 Status has the following values.
• ‘\0’ indicates an unknown status, for example the first boot
after install
• ‘0’ indicates that the user-space payload has been dropped
• ‘1’ is reserved for future use
• ‘2’ indicates that NightSkies has failed to execute properly.
• ‘3’ indicates that the user-space payload executed
successfully
• ‘4’ indicates that the user-space payload encountered an
error condition
• ‘5’ indicates that DarkSeaSkies should uninstall itself and
its payload
• Any other value is equivalent to ‘5’.
o Count maintains a counter used to track the number of cautious boots. A
cautious boot is defined fully below. If Count does not exist then it is
assumed to be zero.
 The name of this variable is in the file warning_count.name.
 The GUID of this variable is in the file warning_count.guid.
o Limit indicates the value of Count at which DarkSeaSkies will uninstall
itself and its payload. If Limit does not exist then a pre-configured value
will be used.
 The name of this variable is in the file warning_threshold.name.
 The GUID of this variable is in the file warning_threshold.guid.
 The default value of Limit is in the file warning_threshold.value.
darkmatter+darkmatter+docs+DarkSeaSkies 1.0 User Manual_Rev New_2009-01-26.doc
2
SECRET//NOFORN

- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9