WikiLeaks - Vault 7: Projects

# Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

### Hive

# Developers Guide (Figures)

- 1
- 2
- 3

03/20/17
SECRET//NOFORN
Raw TCP/UDP Trigger
Hive 2.6.3
SECRET//NOFORN
CRC
Random
Data
CRC
RANDOM PAD 1
Random Data of length CRC % 200
PAD1
START
PAD
8 bytes
141 Bytes Minimum / 485 Bytes Maximum
Integer
N x 127
Encoded
Trigger
Payload
PAD2
RANDOM PAD 2
Random Data of length CRC % 146
8 920 0 – 199 Bytes 2 Bytes 2 Bytes 29 Bytes 0 – 145 Bytes8 Bytes 8 Bytes91
The twenty eight byte trigger payload is encoded by computing an offset of CRC % 60 into the CRC random data field and XORing each of the twenty eight
following bytes with the corresponding byte of the trigger payload.
1 2 4 5 6 7 26 27 283
Call-back
IP address
Call-back
Port Number
Trigger
Payload CRC
SHA-1(ID Key)
0
Obf.
Seed
The obfuscation seed (byte 0) is required for obfuscating the payload when used with triggers other than the raw TCP/UDP triggers.
03/20/17

- 1
- 2
- 3